Azure WAF policy exclusion for application insight connection

Thirumal Rao D 1

How to apply the exclusion on the WAF policy for Appinsight connnection.

AppInsight is connecting through APPGW so we would like to exclude WAF policy for tht.

What would be the request header here to achieve here.

Thanks

Konstantinos Passadis 19,251 MVP

Hello @Thirumal Rao D !

Navigate to the Azure portal and open the Azure Application Gateway instance that is handling traffic for your AppInsight connection.

In the "Settings" blade of the application gateway, select "Web application firewall" under the "Security" section.

In the "Web application firewall" blade, select the WAF policy that is currently in use.

In the "Settings" blade of the WAF policy, select "Exclusions" under the "Policy configuration" section.

In the "Exclusions" blade, select "Add" to add a new exclusion rule.

In the "Add exclusion" blade, enter the following information:

```
Exclusion type: IP Address or URL
```

Exclusion: The IP address of the AppInsight endpoint or the URL of the AppInsight API

I hope this helps

kindly mark the answer as Accepted in case it helped!

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-04-27T10:59:51.2966667+00:00

@Thirumal Rao D

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am not aware of any such headers available from Application insights.

From App Gateway perspective, you can use IP Restriction and allow all the IPs from the service tags "ApplicationInsightsAvailability" or "AzureCloud".

Azure Service Tags

How to : Custom rules for Web Application Firewall v2 on Azure Application Gateway

Also, as per KonstantinosPOfficeLine-9007 's comment,

If you could provide more information on your requirement, I can suggest some alternatives.

Cheers,

Kapil
Thirumal Rao D 1 Reputation point

2023-04-28T02:25:45.2866667+00:00

Thank you for reply.

We have AppGw and its configured with AppInsight as backendpool(southeastasia.1.in.applicationinsight.azure.com) and we have WAF policy enabled with prevention, but its blocking some of the AppInsight traffic.

So we would like to Exclusion AppInsight connection to avoid blocking.

Thanks
Thirumal Rao D 1 Reputation point

2023-04-28T02:35:17.76+00:00

Thanks for reply. Here what would be the match varaible, operator and selector
Konstantinos Passadis 19,251 Reputation points MVP

2023-04-28T09:57:47.1733333+00:00
Hello

For example, if you want to exclude traffic from the AppInsight API URL "https://api.applicationinsights.io/v1/apps", you could configure the exclusion rule as follows:

Match variable: Request URI Operator: BeginsWith Selector: "/v1/apps"

Alternatively, if you want to exclude traffic from a specific IP address, you could configure the exclusion rule as follows:

Match variable: Remote Address Operator: IPMatch Selector: The IP address you want to exclude

BR
Thirumal Rao D 1 Reputation point

2023-04-28T10:23:17.6333333+00:00

Thanks for reply.

But we have appinsight backend pool aa like this southeastasia.1.in.applicationinsight.azure.com. So how can i add this in exclusion. Actaully its blocking so e requests so we would like bypass appinsight connection.

And this is blocking when select "Prevention" mode no issues with Detect mode.
Konstantinos Passadis 19,251 Reputation points MVP

2023-04-28T16:39:24.3233333+00:00
Then it would be :

Match variable: Request Headers Operator: Contains Selector: Host: southeastasia.1.in.applicationinsight.azure.com

Please tell me if it worked !
Thirumal Rao D 1 Reputation point

2023-05-02T03:15:16.0766667+00:00

Thanks . Sure will check and let you know.
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-02T09:02:08.75+00:00
@Thirumal Rao D

Thanks for the update.

However, I am not aware of the requirements for AppInsights.

Looking at your comments, I take it that you want 3rd party services in Internet to access your AppInsights via App Gateway

Let me know if KonstantinosPOfficeLine-9007 's comments to add Match variable : Request Headers helps or not.

Did you follow any documentation or design guidelines from Microsoft on this configuration.

I have not seen users having AppInsights behind an App Gateway.

Cheers,

Kapil.
Konstantinos Passadis 19,251 Reputation points MVP

2023-05-02T10:05:19.2366667+00:00

Hello @Thirumal Rao D !

Any updates ?

We will be glad to help you if any additional help is needed

In case you solved your issue kindly mark the answer that helped as Accepted !

Regards
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-03T11:35:05.67+00:00

@Thirumal Rao D

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
Thirumal Rao D 1 Reputation point

2023-05-03T12:52:22.71+00:00

Its not working.

Even trying with WAF custom rule, but no luck.

Not able give correct request header and value.

Just trying to add custom waf rule for appgw backend pool fqdn ans tried with listener host name bit its not working.

Thanks
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-03T13:13:01.75+00:00
@Thirumal Rao D

Thanks for the update.

As stated, I have not seen users having AppInsights behind an App Gateway and I don't think this will be a supported configuration.

Reason being,

I believe App insights would require traffic be sent on Port 443 (i.e, HTTPS)

However, you will not be able to do TLS handshake with App Gateway in between as you will not be able to create a certificate for your AppInsights domain "*.applicationinsights.azure.com"

That being said,

How are you making the URL southeastasia.1.in.applicationinsight.azure.com resolve to the Application gateway's IP?

How are the requests being forwarded to App gateway to begin with?

What rules in the WAF is actually blocking your requests? Did you get a chance to check it?

Did you follow any documentation or design guidelines from Microsoft on this configuration?

If so, sharing this could help us isolate the issue.

Cheers,

Kapil
Thirumal Rao D 1 Reputation point

2023-05-03T13:15:34.2233333+00:00

we do not have api links. we have configured with privatelinks
Thirumal Rao D 1 Reputation point

2023-05-03T13:17:24.7366667+00:00

for ex: test-dev.paye.azure.cgi.azure.net

then how to block this connection through appgw?
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-03T13:23:36.7833333+00:00
@Thirumal Rao D

Please provide more details on your architecture.

Share a hop-to-hop network diagram of your configuration.

So, you have the private endPoint as the backend of the App Gateway?

How are the requests being forwarded to App gateway ?

Are you using a custom URL?

or making the URL southeastasia.1.in.applicationinsight.azure.com resolve to the Application gateway's IP?

What rules in the WAF is actually blocking your requests? Did you get a chance to check it?

Azure WAF Logs - examine

Which Rule ID is blocking your requests?

Is traffic using HTTP (Port 80) or HTTPS(Port 443)

Also, any documentation or design guidelines from Microsoft you are following to achieve this?

Adding to it, is there a requirement to use App Gateway in front of App Insights?

If so, please elaborate.

Cheers,

Kapil
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-03T13:30:10.08+00:00

@Thirumal Rao D

If you want to block "test-dev.paye.azure.cgi.azure.net" through App gateway WAF

Can you try this,

Cheers,

Kapil
Thirumal Rao D 1 Reputation point

2023-05-03T13:30:31.3733333+00:00

its https.

I will give more info bit later.

Thanks for reply
Thirumal Rao D 1 Reputation point

2023-05-03T13:31:49.9766667+00:00

Exactly tried as above screenshot, but its not working

Thanks
Thirumal Rao D 1 Reputation point

2023-05-03T14:01:15.5666667+00:00

Its blocking with 403 error.

when we see the logs its not giving rule name and all details in logs.

i have another rule which is IP address and it shows in logs as below marked screenshot.
Thirumal Rao D 1 Reputation point

2023-05-03T14:09:13.6033333+00:00

Which I am blockign with IP Address and its giving proper logs like rule name ,action and message.

But when we have rule with custom header there is no such details as above.

Thanks!
Thirumal Rao D 1 Reputation point

2023-05-04T02:35:41.48+00:00

I have sucessfully able to apply custom rule as below settings.

Blocking with host and Regex and value is "shp" ,then I am trying to add EXCLUSION with request header value equals(specific value) as below second screen shot but its not excluding and still its blocking.

CUSTOM RULE:

C

EXCLUSION:
Thirumal Rao D 1 Reputation point

2023-05-04T05:17:33.7066667+00:00

Actually the below rule is blocking our AppInsight connection so we are trying to allow this, but we could't see this rule not listed in managed OWSAP rules.

Can you guide us how to allow AppInsight connection with below rule?

thank you in advance!
Thirumal Rao D 1 Reputation point

2023-05-04T06:25:46.6533333+00:00

AppInsight(southeastasia.1.in.applicationinsight.azure.com) is getting blocked when i enable WAF in Prevention mode , and log says Inbound Analomy score exceeded (Toral Score :9) but not able to see rule id 949110 to disable or add an execution. I sthere anyway to slove this?

Thanks!
KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2023-05-05T07:15:52.3966667+00:00

@Thirumal Rao D

You cannot disable 949110. This is triggered because the anomaly score increased, and not because of a single request-response.

Instead, you have to check the requests that are raising the anomaly score.

I do not have expertise over AppInsights and unless you explain how you have configured it behind App Gateway, I will not be able to make any comments.

At this time, I think we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.

If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Thanks,

Kapil.

2 answers

Konstantinos Passadis 19,251 Reputation points MVP

2023-05-06T12:31:25.89+00:00

Hello @Thirumal Rao D !

In addition to KapilAnanth-MSFT suggestions , i would change the tone by adding that it is odd to try to access Application Insights via a WAF, at least in my eyes!

App Insights have their own API , hosted on Azure , protected by Azure as a Managed Resource and of course you can access it by Private Endpoint for enhanced security !

Also maybe this thread kinda helps but you are getting blocked by Anomaly Score so something is going on with the requests.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/ip-addresses

Kindly mark the answer as Accepted and Upvote in case it helped or post your feedback to help !

Regards
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Thirumal Rao D 1 Reputation point

2023-05-15T14:41:17.54+00:00

We have raised MS support ticket.

Thanks
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure WAF policy exclusion for application insight connection

2 answers

Your answer