Website Hosted on Azure || L7 Protection

AlekseeH 20

We are looking to migrate a website to Azure and protect from DDoS and Layer 7 attacks. Moreover, and since the website will be accessed globally, we are looking to take advantage of an SDN Solution.

As a result, I guess that Azure Front Door will be the suitable solution as an SDN accompanied with the WAF and DDoS on the edge. In this case, all the traffic will be analyzed and cleaned through the WAF of Azure Front Door.

But in case the customer is looking to protect himself with a third-party WAF solution, is it okay to use Front Door only as an SDN solution and re-direct the traffic to a third-party cloud-based WAF solution? And in case he wants it deployed on his network on Azure, is it okay to deploy the WAF solution behind a NGFW?

As a result, please provide me with different scenarios in which Front Door is being used with Third-Party NVA security solutions.

KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2023-03-16T09:44:26.89+00:00
@AlekseeH

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to migrate your website to Azure.

As you are aware, AFD comes with in built DDOS protection and customizable WAF solution.

By "using AFD as SDN", I take it that you are referring to use AFD as a Global Load Balancer.

Using this approach should work. As long as the AFD Origin supports HTTP and HTTPS requests, you can forward any traffic to your origin.

However, I have not seen any customers using this approach.

With WAF of AFD, the rules are processed at the Edge and in case of a DENY/BLOCK, no request to Origin is made and the Origin is not overloaded.

Also, you must consider the fact that if you use a 3rd party Firewall behind AFD, then you are practically doing two redirects, one from AFD to Firewall and other from Firewall to the website. This must have an effect on latency

Wrt, "And in case he wants it deployed on his network on Azure, is it okay to deploy the WAF solution behind a NGFW",

Can you please elaborate more?

Do you want to place AFD behind a NGFW? If so, is this NGFW in Azure or 3rd party cloud?

Or do you want to place a NGFW behind AFD as discussed above?

Cheers,

Kapil
AlekseeH 20 Reputation points

2023-03-16T14:06:11.0166667+00:00

Hello Kapil,

Thanks for the answer.

In case a CDN is not being used, then the traffic flow will be DDoS --> NGFW --> WAF --> Server.

But once the CDN is introduced, what is the suggested traffic flow? Moreover, if AFD is being used, We have to make sure that only this traffic is going to the origin server. As for the NGFW, it will be only used to perform natting to the origin server. The other uses of the NGFW will be the segmentation between the different VNETs and analyzing the east-west traffic internally. Moreover, it will be doing Layer 3/Layer 4 traffic filtering for any other traffic coming into our separate workloads and providing SSL VPN tunnels for any user that might need to access the network.

What's your input on this ?
KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2023-03-16T14:21:53.7933333+00:00
@AlekseeH

I am afraid I cannot provide much inputs on this as they are not Azure Networking products.

You have mentioned WAF and AFD as separate entities.

Are you referring to a different 3rd party WAF?

You have also mentioned CDN here.

In this case, again, where does CDN come? (please note that Azure CDN and AFD are not same.

Please provide more details on this.
AlekseeH 20 Reputation points

2023-03-17T07:22:25.6266667+00:00
@KapilAnanth-MSFT

Just let us consider two scenarios:

Scenario I: Azure Front Door (CDN+WAF+BOT Protection + DDoS) --> Azure Gateway (For internal load balancing) --> Website | This will provide the customer with everything in terms of delivery optimization and security.

Scenario II: What would be the scenario in case the customer will only be taking the CDN and wants to deploy third-party security NVAs to protect his website? CDN (which will provide him indirectly with DDoS Protection if I am not mistaken) --> NGFW --> WAF --> Website ? I just want to understand the flow from Microsoft's point of view.

Thanks.
KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2023-03-20T06:21:38.1633333+00:00

@AlekseeH

I see @msrini-MSFT 's answer has helped you.

Let me know should you require further information.

Cheers,

Kapil

Accepted answer

msrini-MSFT 9,256 Reputation points Microsoft Employee

2023-03-17T11:12:56.4233333+00:00

Hi, When you utilise Azure Frontdoor which comes with WAF and basic DDOS protection, not sure why you need to introduce an another layer of NVA. Your website to Azure Forntdoor would be north south traffic which is protected by WAF and you can also add NSG to whitelist Frontdoor IPs which willl access your web site and block the rest. This way you will simplify the design and minimize the risk of any failure happens on NVA which could distrupt the website traffic.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Website Hosted on Azure || L7 Protection

0 additional answers