I've deployed the Pulse Virtual Traffic Manager template available from the Azure marketplace, but it appears to only be able to function as an external (internet-facing) load balancer. I want to configure the VTM as an internal application gateway, i.e. with the virtual server listening on an internal address behind a firewall, not a public IP address. Can this be done?
The Azure vTM instance can be deployed as an internal facing application gateway. To accomplish the requirements, you must take a copy of the template and remove the public IP from the config. Look into the template for Public IP entries as you may need to update them as well with the new internal IP. The Azure template download is offered on the end of the UI menu.
Basically the Azure vTM instance that sits in front of the VM scale set needs to be configure to listen to a private IP rather than a Public IP.