Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
Enhancements to Azure WAF for Application Gateway now in General Availability
Published Mar 10 2023 06:12 AM 10.5K Views
Microsoft

Introduction

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection for your web applications against common vulnerabilities and exploits. Web applications are increasingly targeted by malicious attacks that vulnerabilities. SQL Injection (SQLi) and Cross-Site Scripting (XSS) are examples of some well-known attacks. Preventing such attacks in application code can be challenging and may require rigorous maintenance, patching, and monitoring at many layers of the application topology. A centralized web application firewall helps make security management much simpler and gives better assurance to application developers and security teams against threats or intrusions.

 

The Azure Web Application Firewall (WAF) engine is the component that inspects traffic and determines whether a web-request represents a potential attack, then takes appropriate action depending on the configuration. Previously, when you used the Azure WAF with Application Gateway, there were certain limitations in the way you could configure and monitor your WAF deployments. We are happy to announce several enhancements to the configurations and monitoring capabilities of Azure WAF when used with Azure Application Gateway going forward.

 

We will be discussing the enhancements which Generally Available in the following sections of this blog.

Scale Limit Increases

Azure WAFs running on the next generation WAF engine can now leverage increased scale limits in key configurations covering security and application needs. The increase in scale limits allows organizations to have greater flexibility and to achieve more with fewer deployments in their environment. Increases in features such as WAF exclusions, HTTP listeners, and SSL certificates allow for better security, improved scale, easier deployment, and better management of applications. 

 

For a compressed version of the new changes introduced, you can reference the table below for more information.

Feature

Previous:

Current:

Notes:

HTTP Listeners

40

200, 100 active listeners

Limited to 100 active listeners that are routing traffic. Active listeners = total number of listeners - listeners not active.
If a default configuration inside a routing rule is set to route traffic (for example, it has a listener, a backend pool, and HTTP settings) then that also counts as a listener. For more information, see Frequently asked questions about Application Gateway.

WAF Exclusions

40

200

 

WAF IP address ranges per match condition

540

600

 

Sites

40

100

1 per HTTP listener

Redirect Configurations

40

100

 

SSL Certificates

40

100

1 per HTTP listener

Load-Balancing Rules

40

400

 

Frontend Ports

40

100

 

You can read more about the next generation WAF engine that makes this possible here, and get a full list of the supported scale limits for Application Gateways running WAF here.

 

Metrics

The WAF’s new metrics will allow security teams to monitor the total requests, managed rule matches, custom rule matches, and bot protection matches and filter them through a range of dimensions. These dimensions can assist security teams in identifying patterns in attack behaviors by splitting and filtering the metric by policy name, method, and geo-location for example. Sending the metrics to a log analytics workspace allows security teams to ingest this data using Microsoft Sentinel, where you can leverage the data using workbooks, notebooks, and analytic rules. These new metrics also allow for real time alerts to trigger against specified alert logic that you can manage with Azure Monitor.

Reference the table below to see what Metrics are available for Application Gateway WAF v2.

Metrics

Description

Dimension

WAF Total Requests

Count of successful requests that WAF engine has served

Action, Country/Region, Method, Mode, Policy Name, Policy Scope

WAF Managed Rule Matches

Count of total managed rule matches

Action, Country/Region, Mode, Policy Name, Policy Scope, Rule Group, Rule ID, Rule Set Name

WAF Custom Rule Matches

Count of custom rule matches

Action, Country/Region, Mode, Policy Name, Policy Scope, Rule Name

WAF Bot Protection Matches1

Count of total bot protection rule matches that have been blocked or logged from malicious IP addresses. The IP addresses are sourced from the Microsoft Threat Intelligence feed.

Action, Country/Region, Bot Type, Mode, Policy Name, Policy Scope

1 Only Bot Manager Rule Set 0.1 will be displayed under “WAF Bot Protection Matches”. Requests matching Bot Manager Rule Set 1.0 will increase “WAF Total Requests” metrics, not “WAF Bot Protection Matches”.

 

You can read more about all metrics supported by Application Gateway v2 SKU here, and how to create Alert rules on metrics here.

Conclusion

With these new improvements, we hope to better meet the security needs of our customers using Azure WAF. For more information on Azure WAF with Application Gateway, please see the following documentation:

What is Azure Web Application Firewall on Azure Application Gateway? - Azure Web Application Firewal...

Best practices for Web Application Firewall on Azure Application Gateway | Microsoft Learn

 

Co-Authors
Version history
Last update:
‎Mar 17 2023 02:59 PM
Updated by: