Requests get blocked in WAF with ERRORINFO_NO_ERROR

Ard de Gelder 0

In Azure, I have an application gateway with web application firewall. Recently, requests from end users have been blocked with http status 403 Forbidden. They're perfectly normal requests, and I see no reason why they should be blocked.

In de logs, the error_info_s is just ERRORINFO_NO_ERROR, and all fields for Message, ruleId_s, ErrorMessage_s are empty.

How can I find out why these requests are getting blocked?

ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2024-09-18T21:33:41.5233333+00:00

@Ard de Gelder

If I understand correctly, you observed the ERRORINFO_NO_ERROR on in the Access Logs category of you diagnostic logs.

Can you please check the AGWFirewallLogs and let us know if you are able to observe any errors?

Thank you!
Ard de Gelder 0 Reputation points

2024-10-07T11:02:58.2+00:00

@ChaitanyaNaykodi-MSFT

I checked the AGWFirewallLogs, but that just shows me 'No results found from the last 7 days'. In the same period, in the AzureDiagnostics, there are many requests which receive a http 403 response.
Ard de Gelder 0 Reputation points

2024-10-07T11:05:15.0066667+00:00

@ChaitanyaNaykodi-MSFT

I check the AGWFirewallLogs, but it just shows 'No results found from the last 7 days'.

In the same time period, in the AzureDiagnostics, there are plenty of requests that receive a http 403 response.
ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2024-10-11T00:04:11.7+00:00
@Ard de Gelder - In this case can you please share the query you are running for AGWFirewallLogs?

A screenshot of the access log entry also will be helpful

Thanks
Ard de Gelder 0 Reputation points

2024-10-11T09:46:33.2566667+00:00

See the screenshots attached. Note that I'm not querying the AGWAccessLogs (those have no results, same as the AGWFirewallLogs), I'm querying the AzureDiagnostics to see requests that have been blocked (http status 403 Forbidden)
ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee

2024-10-14T18:01:39.99+00:00
@Ard de Gelder

Thank you for getting back.

Since you are using the AzureDiagnostics table. Can you run the following query and see if you observe any logs?

AzureDiagnostics | where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayFirewallLog" | limit 10

Reference:
https://learn.microsoft.com/en-us/azure/application-gateway/log-analytics#explore-data-with-examples
Ard de Gelder 0 Reputation points

2024-10-21T14:30:20.3+00:00

Yes, that query does show results of traffic that is blocked by the firewall, which is good. However, it doesn't show the logs I am looking for.

I have managed to find out what's probably the cause. The requests get blocked not by the normal Managed rules (of which the logs do show up in the AzureDiagnostics with all information I expect), but by a Custom rule in the Application Gateway WAF policy. Those logs are in the AzureDiagnostics under the 'ApplicationGatewayAccessLog' category, but not the 'ApplicationGatewayFirewallLog' category.

Could that be the case that requests blocked by Custom rules don't get logged in the ApplicationGatewayFirewallLog?

Share via

Requests get blocked in WAF with ERRORINFO_NO_ERROR

Your answer