我在为一个放置了应用网关（AG）的子网部署网络安全组（NSG）时遇到了一些麻烦。
在部署过程中，我得到以下错误（为了可读性，我删除了资源路径）：
网络安全组nsg-acc-waf阻止端口65200 - 65535上的传入Internet流量到子网snet-acc-waf（与应用网关agw-acc关联）。对于具有V2 Sku的应用网关，不允许这样做。
根据www.example.com上的配置说明，一切看起来都很好https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#allow-access-to-a-few-source-ips
这是我用上面的说明创建的二头肌，我的问题是关于nsgRule110：

resource wafNsg 'Microsoft.Network/networkSecurityGroups@2021-03-01' = {
  name: 'nsg-${environmentName}-waf'
  location: location

  resource nsgRule100 'securityRules' = {
    name: 'AllowPublicIPAddress'
    properties: {
      access: 'Allow'
      description: 'Allow traffic from Public IP Address.'
      destinationAddressPrefix: '*'
      destinationPortRange: '443'
      direction: 'Inbound'
      priority: 100
      protocol: 'Tcp'
      sourceAddressPrefix: publicIpAddress
      sourcePortRange: '*'
    }
  }

  resource nsgRule101 'securityRules' = {
    name: 'AllowInternetAccess'
    properties: {
      access: 'Allow'
      description: 'Allow traffic from Internet on port 443.'
      destinationAddressPrefix: '*'
      destinationPortRange: '443'
      direction: 'Inbound'
      priority: 101
      protocol: 'Tcp'
      sourceAddressPrefix: 'Internet'
      sourcePortRange: '*'
    }
  }

  resource nsgRule110 'securityRules' = {
    name: 'AllowGatewayManager'
    properties: {
      access: 'Allow'
      description: 'Allow traffic from GatewayManager. This port range is required for Azure infrastructure communication.'
      destinationAddressPrefix: '*'
      destinationPortRange: '65200-65535'
      direction: 'Inbound'
      priority: 110
      protocol: '*'
      sourceAddressPrefix: 'GatewayManager'
      sourcePortRange: '*'
    }
  }

  resource nsgRule120 'securityRules' = {
    name: 'AllowAzureLoadBalancer'
    properties: {
      access: 'Allow'
      description: 'Allow traffic from AzureLoadBalancer.'
      destinationAddressPrefix: '*'
      destinationPortRange: '*'
      direction: 'Inbound'
      priority: 120
      protocol: '*'
      sourceAddressPrefix: 'AzureLoadBalancer'
      sourcePortRange: '*'
    }
  }

  resource nsgRule4096 'securityRules' = {
    name: 'DenyAllInboundInternet'
    properties: {
      access: 'Deny'
      description: 'Deny all traffic from Internet.'
      destinationAddressPrefix: '*'
      destinationPortRange: '*'
      direction: 'Inbound'
      priority: 4096
      protocol: '*'
      sourceAddressPrefix: 'Internet'
      sourcePortRange: '*'
    }
  }
}

我也试过设置sourceAddressPrefix: 'Internet'和sourceAddressPrefix: '*'（其中星号是任何）.回答：Azure App Gateway V2无法使用NSG进行配置并将NSG添加到应用程序网关子网
我不知道它有什么问题。看起来只有在部署过程中才会触发这个验证规则。
我尝试过手动添加规则，当绑定到子网时，这是可行的。此外，添加NSG而不直接通过部署将其绑定到子网，但最终手动绑定似乎是可行的。唯一不起作用的情况是，NSG已经绑定到子网（由AG使用），然后（重新）部署。
有人能帮我吗？