Azure Application Gateway WAF

The Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized web application protection against common exploits and vulnerabilities. It helps protect your web applications from threats such as SQL injection, cross-site scripting, and other common web attacks.

What is WAF?

A Web Application Firewall (WAF) is a security solution that monitors, filters, and blocks HTTP/S traffic to and from a web application. It operates at the application layer (Layer 7) and can detect and prevent malicious HTTP/S requests and responses.

Key Features of Azure WAF

• Managed Rule Sets: Azure WAF includes managed rule sets from the Open Web Application Security Project (OWASP) and Microsoft that protect against a wide range of attacks.
• Custom Rules: You can define your own custom rules to block or allow traffic based on specific IP addresses, HTTP headers, request methods, and more.
• Geo-blocking: Restrict access to your applications based on the geographical location of the request origin.
• Bot Protection: Help mitigate traffic from malicious bots with predefined and configurable bot protection rules.
• Threat Intelligence: Leverage Microsoft's threat intelligence to identify and block known malicious IPs.
• Logging and Monitoring: Detailed logs and integration with Azure Monitor and Azure Sentinel provide insights into WAF activity and potential threats.

WAF Policies

A WAF policy is a collection of rules and configurations that define how the WAF protects your web applications. You can create different WAF policies and associate them with your Application Gateway instances.

Creating a WAF Policy

You can create a WAF policy through the Azure portal, Azure CLI, or Azure PowerShell.

Using Azure CLI:

az network application-gateway waf-policy create \
    --name MyWAFPolicy \
    --resource-group MyResourceGroup \
    --location eastus \
    --sku Premium_WAF
            

WAF Modes

Azure WAF can operate in two modes:

• Detection mode: The WAF logs malicious requests but does not block them. This is useful for testing and understanding your application's exposure.
• Prevention mode: The WAF blocks malicious requests and prevents them from reaching your web application.

OWASP Rule Sets

Azure WAF supports two versions of the OWASP core rule set:

• OWASP 3.0: A comprehensive set of rules for detecting common web vulnerabilities.
• OWASP 3.1: The latest version with updated rules and improved performance.

Custom Rules Example

You can create custom rules to match specific patterns in requests. For example, to block requests with a specific User-Agent header:

az network application-gateway waf-policy rule create \
    --policy-name MyWAFPolicy \
    --resource-group MyResourceGroup \
    --name BlockBadUserAgent \
    --type Custom \
    --action Block \
    --match-conditions operator='Equal' matchValue='BadBot/1.0' \
        matchVariable='RequestHeader' selector='User-Agent' \
    --priority 100
            

Monitoring WAF Activity

To effectively manage your WAF, it's crucial to monitor its activity. You can access WAF logs and metrics through Azure Monitor.

Key metrics to monitor include:

• Number of blocked requests
• Number of detected malicious requests
• Top detected threats
• WAF policy performance

Best Practices

• Always start with WAF in detection mode to understand potential false positives before switching to prevention mode.
• Regularly review and update your WAF policies and rule sets.
• Implement custom rules for application-specific threats.
• Enable logging and integrate with Azure Sentinel for advanced threat detection and analysis.
• Keep your application code secure and updated to complement WAF protection.

For more detailed information, please refer to the official Azure Application Gateway WAF documentation.