| title | Routing Architecture |
|---|---|
| titleSuffix | Azure Front Door |
| description | This article helps you understand the global view aspect of Front Door's architecture. |
| author | halkazwini |
| ms.author | halkazwini |
| ms.service | azure-frontdoor |
| ms.topic | concept-article |
| ms.date | 02/24/2026 |
| zone_pivot_groups | front-door-tiers |
Azure Front Door traffic routing takes place over multiple stages. First, traffic is routed from the client to the Front Door. Then, Front Door uses your configuration to determine the origin to send the traffic to. The Front Door web application firewall, routing rules, rules engine, and caching configuration can all affect the routing process.
::: zone pivot="front-door-standard-premium"
The following diagram illustrates the routing architecture:
:::image type="content" source="media/front-door-routing-architecture/routing-process-standard-premium.png" alt-text="Diagram that shows the Front Door routing architecture, including each step and decision point." lightbox="media/front-door-routing-architecture/routing-process-standard-premium.png":::
::: zone-end
::: zone pivot="front-door-classic"
[!INCLUDE Azure Front Door (classic) retirement notice]
The following diagram illustrates the routing architecture:
:::image type="content" source="media/front-door-routing-architecture/routing-process-classic.png" alt-text="Diagram that shows the Front Door routing architecture, including each step and decision point." lightbox="media/front-door-routing-architecture/routing-process-classic.png":::
::: zone-end
The following sections describe these steps in detail.
::: zone pivot="front-door-standard-premium"
The user or client application initiates a connection to the origin behind Azure Front Door. The domain name resolves to the Front Door's Azure Traffic Manager endpoint. The Traffic Manager consumes health and availability signals from all the Front Door PoPs across the world. It determines the optimal PoP to serve the request and returns the unicast IP of that PoP.
Client makes a direct connection to the returned IP address of the Front Door PoP location.
When Front Door receives an HTTP request, it uses the request's Host header to match the request to the correct customer's Front Door profile. If the request is using a custom domain name, the domain name must be registered with Front Door to enable requests to get matched to your profile.
::: zone-end
::: zone pivot="front-door-classic"
The user or client application initiates a connection to the Front Door. The connection terminates at an edge location closest to the end user. Front Door's edge location processes the request.
For more information about how requests are made to Front Door, see Front Door traffic acceleration.
When Front Door receives an HTTP request, it uses the request's Host header to match the request to the correct customer's Front Door instance. If the request is using a custom domain name, the domain name must be registered with Front Door to enable requests to get matched to your Front door.
::: zone-end
The client and server perform a TLS handshake using the TLS certificate you configured for your custom domain name, or by using the Front Door certificate when the Host header ends with *.azurefd.net.
::: zone pivot="front-door-standard-premium"
If your domain has Web Application Firewall enabled, WAF rules are evaluated.
::: zone-end
::: zone pivot="front-door-classic"
If your frontend has Web Application Firewall enabled, WAF rules are evaluated.
::: zone-end
If a rule gets violated, Front Door returns an error to the client and the request processing stops.
::: zone pivot="front-door-standard-premium"
Front Door matches the request to a route. Learn more about the route matching process.
The route specifies the origin group that the request should be sent to.
::: zone-end
::: zone pivot="front-door-classic"
Front Door matches the request to a routing rule. Learn more about the route matching process.
The route specifies the backend pool that the request should be sent to.
::: zone-end
::: zone pivot="front-door-standard-premium"
If you define rule sets for the route, they get process in the order configured. Rule sets can override the origin group specified in a route. Rule sets can also trigger a redirection response to the request instead of forwarding it to an origin.
::: zone-end
::: zone pivot="front-door-classic"
If you define rules engines for the route, they get process in the order configured. Rules engines can override the backend pool specified in a routing rule. Rules engines can also trigger a redirection response to the request instead of forwarding it to a backend.
::: zone-end
::: zone pivot="front-door-standard-premium"
If the Front Door routing rule has caching enabled, and the Front Door edge location's cache includes a valid response for the request, then Front Door returns the cached response.
If caching is disabled or no response is available, the request is forwarded to the origin.
::: zone-end
::: zone pivot="front-door-classic"
If the Front Door routing rule has caching enabled, and the Front Door edge location's cache includes a valid response for the request, then Front Door returns the cached response.
If caching is disabled or no response is available, the request is forwarded to the backend.
::: zone-end
::: zone pivot="front-door-standard-premium"
Front Door selects an origin to use within the origin group. Origin selection is based on several factors, including:
- Health of each origin, which Front Door monitors by using health probes.
- Routing method for your origin group.
- If you enable session affinity
Finally, the request is forwarded to the origin.
::: zone-end
::: zone pivot="front-door-classic"
Front Door selects a backend to use within the backend pool. Backend selection is based on several factors, including:
- Health of each backend, which Front Door monitors by using health probes.
- Routing method for your backend pool.
- If you have enable session affinity
Finally, the request is forwarded to the backend.
::: zone-end
::: zone pivot="front-door-standard-premium"
[!div class="nextstepaction"] Create an Azure Front Door profile
::: zone-end
::: zone pivot="front-door-classic"
[!div class="nextstepaction"] Create an Azure Front Door (classic) profile
::: zone-end