liveBook · Manning

Azure Web Application Firewall

As explained in Azure Security

Azure Web Application Firewall is an Azure-managed service that inspects web traffic and applies rules to protect HTTP applications from common exploits.

Azure Web Application Firewall (WAF) inspects inbound application-layer traffic to help detect and prevent layer-7 attacks against web applications. Its Microsoft-managed rules are based on OWASP Core Rule Sets and address common exploits such as SQL injection and cross-site scripting. section 3.3

Deploy WAF functionality through Azure Application Gateway or Azure Front Door. Both protect web application frontends, but their rule-set, matching, and blocking behavior differs because WAF integrates closely with its attached service. section 3.3 section 3.1

For a regional application behind Application Gateway, configure WAF through a policy:

  • Create a separate WAF policy using a Microsoft-managed OWASP rule set; use the latest available rule-set version. section 3.3.1
  • Associate the policy with an Application Gateway v2 using the WAF_v2 SKU. WAF policies are not available for Application Gateway v1. section 3.3.1
  • Optionally add Microsoft-managed bot protection to log or block requests from IP addresses associated with known malicious bots. section 3.3.1
  • Begin in Detection mode, test legitimate application behavior, and investigate WAF logs for false positives before enabling Prevention mode. section 3.3.3
  • Continue monitoring after switching to Prevention mode, since new application features can introduce legitimate traffic that matches rules. section 3.3.3
Listing 3.8 Creating a WAF policy for Application Gateway v2
az network application-gateway waf-policy create 
--name my-waf-policy                 #1
--resource-group myResourceGroup     #2
--type OWASP                         #3
--version 3.2                        #4
#1 The name of the WAF policy
#2 The name of the resource group in which the WAF policy is deployed
#3 The type of the managed rule set; here, you’re using the Microsoft managed rule set based on OWASP
#4 The version of the managed rule set; as a best practice, use the latest version

Use this Azure CLI command to create an Application Gateway v2 WAF policy with an OWASP managed rule set and selected version. section 3.3.1

Prevention mode blocks requests that match the rule set, so it should follow sufficient detection-mode testing rather than serve as a one-time security switch. WAF contributes one application-security layer within a broader defense-in-depth strategy that also considers network controls and DDoS resiliency. section 3.3.3 section 3.1

How Azure Security covers it

How deep it goes
Walks through policy creation, bot protection, gateway association, operating modes, and false-positive tuning.
Examples
Uses Azure CLI commands to create an OWASP policy, add bot protection, associate Application Gateway v2, and enable Prevention mode.
What it assumes
Assumes basic Azure networking familiarity while pointing readers unfamiliar with OSI layers 3, 4, and 7 to introductory material.
What you can do after
Operate/configure it through WAF policies, detection-mode testing, log review, and a controlled switch to Prevention mode.
How it connects
Connects Azure Application Gateway, Azure Front Door, OWASP Core Rule Sets, managed bot protection, DDoS protection, and defense in depth.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.