Application Gateway WAF v2 only allow specfic IP Traffic

Question

Hi Team,

I have setup a custom rule in WAF previously to only allow few IP to access AGW. However the same rule doesn't works today. Current outcome by setting different combination like either Blocking or Allowing ALL traffic, instead of specific IP.

customrule:

"IP Address"

"Does Not Contain"

"Deny Traffic"

Answer 1

@William Tang

Thank you for reaching out.

As the old custom rule is no longer working this may happen when a custom rule with higher priority is allowing the traffic to pass through. As documented here

"Custom rules allow you to create your own rules that are evaluated for each request that passes through the WAF. These rules hold a higher priority than the rest of the rules in the managed rule sets. The custom rules contain a rule name, rule priority, and an array of matching conditions. If these conditions are met, an action is taken (to allow, block, or log). If a custom rule is triggered, and an allow or block action is taken, no further custom or managed rules are evaluated."

To test this theory, you can enable diagnostic logging for App Gateway and check the firewall log to see if any particular rule is matching the traffic.

Thank you!