Option A: WAF with Azure Application Gateway (Regional / VNet)

This option is the more traditional approach, and is more cost effective as well.

Phase 1: Create the Application Gateway with WAF

1. Prerequisites: You need an Azure Virtual Network (VNet) with a dedicated, empty subnet specifically for the Application Gateway.
2. Navigate to the Portal: Go to the Azure Portal and search for Application Gateways. Click Create.
3. Basics Tab:
   • Select your Subscription and Resource Group.
   • Enter a name and select your Region.
   • Tier: This is critical. Select WAF V2 (do not select Standard, as it does not include WAF capabilities).
4. Configure Virtual Network: Select the VNet and the dedicated empty subnet you created.
5. Frontends, Routing Rules, and Backends: Configure your frontend IP (Public or Private), your backend pool (your VMs, App Services, or AKS clusters), and the routing rules connecting them.

Phase 2: Configure the WAF Policy

1. WAF Tab (during creation or after):
   • Create a new WAF Policy or select an existing one.
   • Firewall status: Enabled.
   • Firewall mode:
     • Detection: Logs alerts but does not block traffic (equivalent to AWS "Count" mode). Start here.
     • Prevention: Blocks malicious traffic based on the rules.
2. Managed Rules: Azure natively uses OWASP (Open Worldwide Application Security Project) Core Rule Sets (CRS). You can select the CRS version (e.g., 3.2 or 3.1). This protects against SQL injection, cross-site scripting (XSS), etc.
3. Custom Rules: You can add custom rules for IP restrictions, rate limiting, or geo-filtering inside the WAF Policy.

Option B: WAF with Azure Front Door (Global)

While more complex and expensive to operate, this option provides more flexibility, is more user friendly, and is essentially a one stop shop.

Phase 1: Create the Azure Front Door Profile

1. Navigate to the Portal: Search for Front Door and CDN profiles and click Create.
2. Select Offering: Choose Azure Front Door (Standard or Premium). Note: Premium includes more advanced managed WAF rules and threat intelligence.
3. Configure Endpoints and Routes: Map your Front Door endpoint to your backend origins (App Services, Storage Accounts, or custom IP addresses).

Phase 2: Create and Attach the WAF Policy

1. Navigate to Web Application Firewall Policies (WAF): Search for Web Application Firewall policies (WAF) in the Azure Portal and click Create.
2. Basics Tab:
   • Policy for: Select Global WAF (Front Door). (If you select Regional, it will only work for App Gateway).
   • Select your Subscription and Resource Group, and name the policy.
   • State: Enabled.
   • Mode: Detection (for testing) or Prevention (for enforcing).
3. Managed & Custom Rules: Enable the Microsoft-managed rule sets (Default Rule Set and Bot Protection). You can also create custom rules for rate limiting or IP blocking.
4. Association Tab:
   • Click Associate a Front Door profile.
   • Select the Front Door profile and specific domain/endpoint you created in Phase 1.

Crucial Enterprise Step: Logging and Monitoring

Regardless of whether you choose Application Gateway or Front Door, WAF logs do not store themselves automatically.

1. Navigate to your Application Gateway or Front Door resource.
2. Go to Diagnostic settings under the Monitoring section.
3. Click Add diagnostic setting.
4. Select the WAF logs (e.g., ApplicationGatewayFirewallLog or FrontDoorWebApplicationFirewallLog).
5. Destination: Send to a Log Analytics workspace (this is the most common requirement for enterprise monitoring and Azure Sentinel integration).
   • NASA Context: NASA typically has mandatory centralized Log Analytics workspaces or Event Hubs where all security logs must be forwarded. Ensure you check your project's security requirements for the correct destination.