Configure Web Application Firewall (WAF) with Azure Application Gateway

This tutorial guides you through the process of enabling and configuring the Web Application Firewall (WAF) feature on an Azure Application Gateway. WAF protects your web applications from common web exploits and vulnerabilities.

Prerequisites

An existing Azure Application Gateway deployment. If you don't have one, follow the tutorial to create an Application Gateway.
Understanding of basic WAF concepts and common attack vectors.

Steps to Configure WAF

Access Application Gateway Settings

Navigate to your Application Gateway resource in the Azure portal. In the left-hand menu, under the Settings section, select Web application firewall.

Enable WAF

On the Web application firewall page, click the Enable WAF button. This will open a configuration pane on the right.

Configure WAF Policy

In the configuration pane:

WAF state: Set to Enabled.
WAF mode: Choose either:
- Detection mode: WAF logs malicious requests but doesn't block them, allowing you to fine-tune rules.
- Prevention mode: WAF blocks malicious requests that match the rules. This is the recommended setting for production environments.
Managed rule set type: Select the rule set you want to use. Azure managed rule sets (e.g., OWASP 3.2, OWASP 3.1) are recommended for comprehensive protection.
Custom rules (Optional): You can define custom rules to block or allow traffic based on specific criteria.
Rule set expansion (Optional): Enable or disable specific rule groups based on your needs.

Click Add or Save to apply these settings.

Associate WAF Policy with Listener

For WAF to protect your application, it needs to be associated with a listener. You typically configure this during Application Gateway creation or by editing an existing listener:

Go to Listeners under the Settings section of your Application Gateway.
Select the listener you want to associate with the WAF policy.
In the listener configuration, ensure the WAF policy dropdown is set to the policy you just created or modified.
Click Save.

Configure WAF Logging

It's crucial to monitor WAF activity. Configure diagnostic logs to capture WAF events:

Go to Diagnostic settings under the Monitoring section.
Click Add diagnostic setting.
Under Logs, select ApplicationGatewayFirewallLog.
Choose where to send the logs (e.g., Log Analytics workspace, Storage account, Event Hub).
Click Save.

Important Considerations

When enabling WAF in Prevention mode, it's advisable to start in Detection mode first. This allows you to identify any legitimate traffic that might be inadvertently blocked by the WAF rules, and create exclusion rules if necessary, before fully enabling prevention.

Testing Your WAF Configuration

After enabling WAF, you should test its effectiveness. You can do this by attempting to send requests that mimic common web attacks (e.g., SQL injection, cross-site scripting) to your application. If WAF is configured correctly in prevention mode, these requests should be blocked, and corresponding entries should appear in your WAF logs.

For more advanced customization, explore creating custom WAF rules and managing exclusion lists.

You have now successfully configured Web Application Firewall (WAF) for your Azure Application Gateway, enhancing the security posture of your web applications.