Frequently asked questions for Azure Web Application Firewall on Application Gateway

Azure Web Application Firewall (WAF) helps protect your web applications from common threats such as SQL injection, cross-site scripting, and other web exploits. You can define a WAF policy that consists of a combination of custom and managed rules to control access to your web applications.

You can apply a WAF policy to web applications hosted on Azure Application Gateway, Application Gateway for Containers, or Azure Front Door.

The WAF tier of Application Gateway supports all the features available in the Standard tier.

Monitor the WAF through diagnostic logging. For more information, see Diagnostic logs for Application Gateway.

No. Detection mode only logs traffic that triggers a WAF rule.

Yes. For more information, see Customize WAF rules.

The latest and most recommended ruleset version of WAF is the Default Rule Set (DRS) 2.2. In addition to the baseline security against most of the top 10 vulnerabilities that Open Web Application Security Project (OWASP) identifies, DRS 2.2 includes additional proprietary protections rules developed by Microsoft Threat Intelligence team, which expand coverage across SQL injection, XSS, and application-security attack patterns:

• Protection against SQL injection
• Protection against cross-site scripting
• Protection against common web attacks such as command injection, HTTP request smuggling, HTTP response splitting, and remote file inclusion
• Protection against HTTP protocol violations
• Protection against HTTP protocol anomalies such as missing Host, User-Agent, and Accept headers
• Prevention against bots, crawlers, and scanners
• Detection of common application misconfigurations (for example, Apache and IIS)

For more information, see the OWASP top 10 vulnerabilities.

You can find more information about older ruleset versions and WAF's managed ruleset support policy [here].(ruleset-support-policy)

The Application Gateway and Application Gateway for Containers WAF supports the following content types for managed rules:

• application/json
• application/xml
• application/x-www-form-urlencoded
• multipart/form-data

And for custom rules:

• application/x-www-form-urlencoded
• application/soap+xml, application/xml, text/xml
• application/json
• multipart/form-data

Yes. You can enable distributed denial-of-service (DDoS) protection on the virtual network where the application gateway is deployed. This setting ensures that the Azure DDoS Protection service also helps protect the application gateway's virtual IP (VIP).

No, the WAF doesn't store customer data.

Azure Application Gateway natively supports WebSocket. WebSocket on the Application Gateway WAF doesn't require any extra configuration to work. However, the WAF doesn't inspect the WebSocket traffic. After the initial handshake between client and server, the data exchange between client and server can be of any format (for example, binary or encrypted). So the WAF can't always parse the data. It just acts as a pass-through proxy for the data.

For more information, see Overview of WebSocket support in Application Gateway.

WAF on Application Gateway for Containers requires two separate configurations:

1. A SecurityPolicy child resource in Azure that references your WAF policy.
2. A WebApplicationFirewallPolicy custom resource in your Kubernetes cluster that references the same WAF policy and targets the resource you want to protect.

If you complete only the Azure configuration, the WAF policy appears as associated in the Azure portal, but no traffic is inspected. Because WAF never evaluates the traffic, it also doesn't generate any firewall logs. If you see no WAF log entries at all, the Kubernetes configuration is the most likely cause.

Apply the WebApplicationFirewallPolicy custom resource to complete the configuration.

For more information, see What is Azure Web Application Firewall on Application Gateway for Containers?

Set targetRef.kind to HTTPRoute in your WebApplicationFirewallPolicy custom resource, and name the specific route.

If you set targetRef.kind to Gateway, the policy applies to all listeners and routes that the Gateway resource handles, which is broader than route-level protection.

Review the firewall logs. The policyScopeName field reports the type of scope the policy is assigned to, and the policyScope field reports the Kubernetes resource reference the scope applies to.

For more information, see Application Gateway for Containers logs.

Yes, air-gapped clouds are supported. However, geo-filtering custom rules, bot protection rulesets, and rate limiting custom rules aren't supported on air-gapped clouds.

You can't disable request buffering if you're running the WAF SKU of Application Gateway or Application Gateway for Containers. The WAF requires the full request to buffer as part of processing. Therefore, even if you disable request buffering within Application Gateway or Application Gateway for Containers, the WAF still buffers the request. Response buffering isn't impacted by the WAF.

Related content

• What is Azure Web Application Firewall?
• What is Azure Front Door?