Page History

Option A: WAF with Azure Application Gateway (Regional / VNet)

This option is the more traditional approach, and is more cost effective as well.

Phase 1: Create the Application Gateway with WAF

1. Prerequisites: You need an Azure Virtual Network (VNet) with a dedicated, empty subnet specifically for the Application Gateway.
2. Navigate to the Portal: Go to the Azure Portal and search for Application Gateways. Click Create.
3. Basics Tab:
   • Select your Subscription and Resource Group.
   • Enter a name and select your Region.
   • Tier: This is critical. Select WAF V2 (do not select Standard, as it does not include WAF capabilities).
4. Configure Virtual Network: Select the VNet and the dedicated empty subnet you created.
5. Frontends, Routing Rules, and Backends: Configure your frontend IP (Public or Private), your backend pool (your VMs, App Services, or AKS clusters), and the routing rules connecting them.

Phase 2: Configure the WAF Policy

1. WAF Tab (during creation or after):
   • Create a new WAF Policy or select an existing one.
   • Firewall status: Enabled.
   • Firewall mode:
     • Detection: Logs alerts but does not block traffic (equivalent to AWS "Count" mode). Start here.
     • Prevention: Blocks malicious traffic based on the rules.
2. Managed Rules: Azure natively uses OWASP (Open Worldwide Application Security Project) Core Rule Sets (CRS). You can select the CRS version (e.g., 3.2 or 3.1). This protects against SQL injection, cross-site scripting (XSS), etc.
3. Custom Rules: You can add custom rules for IP restrictions, rate limiting, or geo-filtering inside the WAF Policy.

...

Option B: WAF with Azure Front Door (Global)

While more complex and expensive to operate, this option provides more flexibility, is more user friendly, and is essentially a one stop shop.

Phase 1: Create the Azure Front Door Profile

1. Navigate to the Portal: Search for Front Door and CDN profiles and click Create.
2. Select Offering: Choose Azure Front Door (Standard or Premium). Note: Premium includes more advanced managed WAF rules and threat intelligence.
3. Configure Endpoints and Routes: Map your Front Door endpoint to your backend origins (App Services, Storage Accounts, or custom IP addresses).

Phase 2: Create and Attach the WAF Policy

1. Navigate to Web Application Firewall Policies (WAF): Search for Web Application Firewall policies (WAF) in the Azure Portal and click Create.
2. Basics Tab:
   • Policy for: Select Global WAF (Front Door). (If you select Regional, it will only work for App Gateway).
   • Select your Subscription and Resource Group, and name the policy.
   • State: Enabled.
   • Mode: Detection (for testing) or Prevention (for enforcing).
3. Managed & Custom Rules: Enable the Microsoft-managed rule sets (Default Rule Set and Bot Protection). You can also create custom rules for rate limiting or IP blocking.
4. Association Tab:
   • Click Associate a Front Door profile.
   • Select the Front Door profile and specific domain/endpoint you created in Phase 1.

...

Crucial Enterprise Step: Logging and Monitoring

Regardless of whether you choose Application Gateway or Front Door, WAF logs do not store themselves automatically.

...