361 questions with Azure Web Application Firewall tags

Sort by: Updated
0 answers

Create Managed Rule Exclusion to exclude a rule on a particular host

Hi, I am trying to create an exclusion rule on a particular OWASP policy code to exclude a particular host name. I include the rule and use the following: Match Variable: Request Header Values Operation: Equals Select: {my.host.com} I've tried various…

Azure Web Application Firewall
asked 2025-06-26T11:03:42.8266667+00:00
Jaco Fourie 0 Reputation points
commented 2025-06-27T15:37:33.96+00:00
Ganesh Patapati 6,915 Reputation points Microsoft External Staff Moderator
2 answers

powershell script to change certificate in WAF

I have renewed my SSL certificate. Is there any powershell script to change certificate in WAF

Azure Web Application Firewall
asked 2025-06-16T05:26:05.38+00:00
GIRISH PAI 0 Reputation points
answered 2025-06-18T05:23:33.2733333+00:00
G Sree Vidya 2,270 Reputation points Microsoft External Staff Moderator
2 answers

Why does Azure application gateway rate limit WAF return a 403 and not a 429?

When Azure Application gateway rate limiter functions as expected, we were expecting a 429, but instead, a 403 is returned. Why is this?

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,213 questions
Azure Web Application Firewall
asked 2024-03-04T13:57:27.39+00:00
Levi 35 Reputation points
commented 2025-06-17T22:33:02.05+00:00
Vids Bhatia 0 Reputation points Microsoft Employee
1 answer One of the answers was accepted by the question author.

Azure Application gateway with WAF

Dear team, I'm using Azure application gateway with tier Standard V2. I concert about the difference between application gateway and WAF. As I understand, when I only use Azure application gateway, it doesn't include all features of WAF, or it includes…

Azure Web Application Firewall
asked 2025-06-17T03:30:25.5566667+00:00
Van Huy Tuyen 20 Reputation points
accepted 2025-06-17T04:41:29.9533333+00:00
Van Huy Tuyen 20 Reputation points
1 answer One of the answers was accepted by the question author.

Is Log Analytics Workspace required to view WAF logs for Azure Front Door? How to identify blocked traffic?

Hi, I want to use Azure Front Door to protect my applications and domains running on several VMs. I would like to review the WAF logs to understand which traffic has been blocked due to potential threats and anomaly score. From what I understand, I can…

Azure Web Application Firewall
asked 2025-06-04T05:56:21.1133333+00:00
Kanie-0317 100 Reputation points
accepted 2025-06-12T10:48:01.11+00:00
Kanie-0317 100 Reputation points
1 answer One of the answers was accepted by the question author.

Is it possible to disable logging for custom rules in Azure WAF?

Is it possible to disable logging for custom rules in Azure WAF? I’d like to avoid logging allowed actions since they produce too much noise.

Azure Web Application Firewall
asked 2025-04-10T08:31:23.9633333+00:00
iuiu 40 Reputation points
accepted 2025-06-12T00:49:19.16+00:00
iuiu 40 Reputation points
1 answer

Exclude/exempt specific IP from WAF managed rules

Hi, I have an application hosted on Azure WAFV2, I need to define an exclusion using client IP address. Basically any request coming from that IP should not be examined against OWASP 3.2 managed rules. I tried defining exclusions but IP specific…

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,213 questions
Azure Web Application Firewall
asked 2022-08-16T12:24:13.163+00:00
WinTechie 286 Reputation points
commented 2025-06-05T08:54:00.5133333+00:00
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator
2 answers One of the answers was accepted by the question author.

Can't add more than three custom domains

I am trying to setup a large quantity of custom domains to be returned to my site and I cannot create more than three. Any ideas on why? A while back I was allowed additional custom domains but now it seems it was either removed or I cannot add anymore.…

Azure Web Application Firewall
asked 2025-06-04T06:52:58.26+00:00
Adam Davis 40 Reputation points
answered 2025-06-05T07:07:21.02+00:00
G Sree Vidya 2,270 Reputation points Microsoft External Staff Moderator
1 answer

User session timeout issues on the WAF-protected web application. After two or three minutes, the session closes, but response times when making requests or navigating within the application are functioning accordingly.

User session timeout issues on the WAF-protected web application. After two or three minutes, the session closes, but response times when making requests or navigating within the application are functioning accordingly. The logs within the login have…

Azure Web Application Firewall
asked 2025-05-27T13:44:52.45+00:00
Juan Eduardo Diaz 20 Reputation points
answered 2025-05-28T10:56:44.69+00:00
Venkat V 2,545 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

「A potentially dangerous Request.Form value was detected from the client」

I am building a web server in Azure with a configuration of CDN - WAF - WebApps. This is a .Net Framework web application. Because requestValidationMode="4.0" "A potentially dangerous Request.Form value was detected from the…

Azure Web Application Firewall
asked 2023-10-18T06:49:47.46+00:00
真 川崎 196 Reputation points
commented 2025-05-18T17:31:22.82+00:00
Sachin srivastava 1 Reputation point
1 answer

WAF policy IP address or range

Are there any limitations on the IP lists associated with IoCs? For example, today we have a list of more than 7,500 IPs reported by the SOC, which we are blocking on security devices. Regards. Humberto G

Azure Web Application Firewall
asked 2025-05-15T20:01:21.86+00:00
Humberto Garcia 0 Reputation points
answered 2025-05-15T21:14:00.5166667+00:00
Ganesh Patapati 6,915 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

WAF error "Execution error - PCRE limits exceeded"

Our waf rules are blocking some content from accessing the backend web server; I searched the wag logs and found some OWASAP rules, the associated rule number is 932150, and the normal error message should be Remote Command Execution: Direct Unix Command…

Azure Web Application Firewall
asked 2025-05-09T06:35:32.68+00:00
Wesley 46 Reputation points
answered 2025-05-12T11:20:30.1433333+00:00
Alex Burlachenko 9,780 Reputation points
2 answers One of the answers was accepted by the question author.

WAF is returning 400 Bad Request - Request too long

WAF -> Azure Firewall -> IIS WAF returning 400 - Bad Request - Request too long. I've disabled "Enforce Request Body Inspection", and "Enforce Maximum Request Body Limit". Also, WAF is in detection mode, not prevention mode. I…

Azure Web Application Firewall
asked 2025-04-30T20:40:24.27+00:00
Bill Fanning 20 Reputation points
accepted 2025-05-06T15:48:44.58+00:00
Bill Fanning 20 Reputation points
2 answers One of the answers was accepted by the question author.

How to configure custom rate limiting rule for Azure Front Door Standard Web Application Firewall

I want to configure a rate limiting rule in the web application firewall for Azure Front Door Standard. When requests from a client IP address exceed the set threshold, the requests should be blocked. I cannot find examples for this scenario. I find only…

Azure Web Application Firewall
asked 2025-04-28T10:04:47.63+00:00
BH 30 Reputation points
commented 2025-04-28T15:00:38.9166667+00:00
BH 30 Reputation points
1 answer

How to Change the Azure WAF Policy Mode

Is there a way to change / switch the WAF policy mode between prevention & detection after the creation of WAF? I can't get such option from the Azure portal, and neither the steps mentioned in Azure documentation. If the option is not available in…

Azure Web Application Firewall
asked 2025-04-22T13:59:55.22+00:00
John Wong Yek Hon 140 Reputation points
commented 2025-04-24T08:19:15.94+00:00
Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Increased Chunk load failure post CDN migration

We recently migrated our CDN from Microsoft(Classic) to AFD premium. Post this migration we are seeing high chunk load failures. We have WAF in detection mode so we are not expecting it to block any traffic. WAF currently has…

Azure Web Application Firewall
asked 2025-04-22T08:55:30.78+00:00
Kushagra Mishra 20 Reputation points Microsoft Employee
commented 2025-04-23T10:18:07.1633333+00:00
Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator
2 answers

Connection Issue of External WAF to an Instance inside Azure Cloud

Hello everyone, I'm reaching out to request guidance and support regarding an issue we're encountering. We are currently unable to receive syslog traffic from our external WAF to one of our log collectors within our Azure network. At present, we are not…

Azure Web Application Firewall
asked 2025-04-16T02:48:50.1466667+00:00
Carl Dela Cruz 0 Reputation points
answered 2025-04-16T07:22:04.12+00:00
Alex Burlachenko 9,780 Reputation points
1 answer

Can I set WAF rules to Log by default and override specific ones to Block?

Hey, I have set the WAF in Prevention mode to allow my custom rules like Rate limiting to be in effect with Blocking action. However as I was facing so many false positives with Microsoft_DefaultRuleSet 2.1, I changed the action as Log for it so that I…

Azure Front Door
Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
850 questions
Azure Web Application Firewall
asked 2025-02-10T06:40:19.2766667+00:00
Rupesh Sonawane 20 Reputation points
edited a comment 2025-04-02T08:16:00.45+00:00
Vinay B 500 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

List of characters or strings blocked in Azure frontdoor WAF policies

Hi, I am need of document link, where I can find what special characters are blocked under which Frontdoor WAF policy. I am at premium tier of Azure Frontdoor and WAF policies.

Azure Web Application Firewall
asked 2025-03-26T11:55:07.07+00:00
Ritika Laddha 170 Reputation points
accepted 2025-03-28T12:07:48.8766667+00:00
Ritika Laddha 170 Reputation points
1 answer One of the answers was accepted by the question author.

During WAF creation Default Ruleset 2.1 showing as in preview

While creating a new WAF policy for Regional WAF (Application Gateway), moving to the Managed rules tab to select the default ruleset, Microsoft_DefaultRuleSet_2.1 is showing (preview). I thought this was GA already? See below image. Thanks.

Azure Web Application Firewall
asked 2025-03-21T17:26:48.99+00:00
Russ Crosbie 40 Reputation points
accepted 2025-03-26T10:50:06.2366667+00:00
Russ Crosbie 40 Reputation points