What is the request body size limitation of azure application gateway without WAF?

Question

What is the request body size limitation of azure application gateway without WAF?

Pulin Gupta 0

Oliver Gulich 21 Reputation points

2023-05-22T08:47:32.58+00:00
The request body size limitation of Azure Application Gateway without Web Application Firewall (WAF) depends on the SKU (Standard_v2 or WAF_v2) and the deployment model (v1 or v2) you are using. Here are the request body size limitations for each combination:

Standard_v2 SKU:

v1 deployment model: The maximum file upload size limit is 2 GB.

v2 deployment model: The maximum file upload size limit is 4 GB.

WAF_v2 SKU:

v1 deployment model: The maximum request body size is 128 KB.

v2 deployment model: The maximum request body size is 2 MB.
Pulin Gupta 0 Reputation points

2023-05-23T06:37:25.9866667+00:00

Can you please confirm if application gateway can be configured with and without waf at the same time based on request headers?
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-24T11:35:22.8133333+00:00

@Pulin Gupta , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-29T08:51:13.9133333+00:00

Hello @Pulin Gupta , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

1 answer

Your answer

Oliver Gulich 21 Reputation points

2023-05-22T08:47:32.58+00:00

The request body size limitation of Azure Application Gateway without Web Application Firewall (WAF) depends on the SKU (Standard_v2 or WAF_v2) and the deployment model (v1 or v2) you are using. Here are the request body size limitations for each combination:

Standard_v2 SKU:

v1 deployment model: The maximum file upload size limit is 2 GB.

v2 deployment model: The maximum file upload size limit is 4 GB.

WAF_v2 SKU:

v1 deployment model: The maximum request body size is 128 KB.

v2 deployment model: The maximum request body size is 2 MB.
Pulin Gupta 0 Reputation points

2023-05-23T06:37:25.9866667+00:00

Can you please confirm if application gateway can be configured with and without waf at the same time based on request headers?
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-24T11:35:22.8133333+00:00

@Pulin Gupta , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-29T08:51:13.9133333+00:00

Hello @Pulin Gupta , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

Answer 1

GitaraniSharma-MSFT 50,207 Microsoft Employee Moderator

Hello @Pulin Gupta ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know the request body size limitation of azure application gateway without WAF.

Let us first understand how Azure Application gateway works with WAF and without WAF:

With WAF:

When WAF is enabled, every request has to be buffered by the Application Gateway until it fully arrives and check if the request matches with any rule violation in its core rule set and then forward the packet to the backend instances, this is also the case with large file uploads, and results in a latency that can be significant.

Maximum file upload size (WAF SKU): If you support file uploads then the value has to be as large as the largest file you are willing to accept. Limits are different for both SKUs (refer screenshot below).

WAF body size limit (without files): Refers to the size of data, with files excluded. You want to keep that value as low as practical. Limits are different depending upon the WAF engine used (refer screenshot below).

Without WAF:

Without WAF, there is no buffering done by the Application gateway for every request, so the default file upload size limit is applied for both body size with files and without files. The type of request does not matter, can be a upload/non-upload request. Limits are as below:

Standard SKU V2 - 4 GB
Standard SKU V1 - 2 GB

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#application-gateway-limits

enter image description here

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Pulin Gupta 0 Reputation points

2023-05-23T06:35:19.49+00:00
What do you recommend to use with following

Soap request with body size greater than 4MB - required for load balancing with https

Rest Request with less than 2 MB - with LB and https

Can I use WAF for the rest request and exclude the soap requests for large body requests?
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-23T11:13:10.55+00:00
Hello @Pulin Gupta ,

You can use Web Application Firewall Policies which contain all the WAF settings and configurations. This includes exclusions, custom rules, managed rules, and so on. These policies are then associated to an application gateway (global), a listener (per-site), or a path-based rule (per-URI) for them to take effect.

NOTE: WAF policy associations are only supported for the Application Gateway WAF_v2 sku.

Azure Web Application Firewall (WAF) policy can be associated with any combination of application gateways, listeners, and path-based rules. So there are 3 types of WAF policy associations:

Global WAF policy : When you associate a WAF policy globally, every site behind your Application Gateway WAF is protected with the same managed rules, custom rules, exclusions, and any other configured settings.

Per-site WAF policy : With per-site WAF policies, you can protect multiple sites with differing security needs behind a single WAF by using per-site policies.

Per-URI policy : For even more customization down to the URI level, you can associate a WAF policy with a path-based rule.

By default, with WAF policies, more specific policies override less specific ones. This means a per-URI policy on a URL path map overrides any per-site or global WAF policy above it. If there's a global policy, and a per-site policy (a WAF policy associated with a listener), then the per-site policy overrides the global WAF policy for that listener. Other listeners without their own policies will only be affected by the global WAF policy.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies

For CRS 3.2 (on the WAF_v2 SKU) and newer, below limits are applied when using a WAF policy for Application Gateway:

2 MB request body size limit

4 GB file upload limit

Only requests with Content-Type of multipart/form-data are considered for file uploads. For content to be considered as a file upload, it has to be a part of a multipart form with a filename header. For all other content types, the request body size limit applies.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#limits

Answering your questions below:

Soap request with body size greater than 4MB - required for load balancing with https:

Today we don’t have SOAP support for file uploads greater than 2MB and do not support multipart/related for file uploads.

To temporarily unblock this issue, you can create a separate WAF policy for this specific URL and set it to detection mode.

Please note this is not a final solution and we will consider adding MTOM and/or multipart/related option in the future.

Rest Request with less than 2 MB - with LB and https:

You can either use a separate WAF policy for this URL with the limits or it can use the Global WAF policy (associated to Application gateway), if there is one available.

For more information on this, please refer the below Q&A thread discussion:

https://learn.microsoft.com/en-us/answers/questions/1168339/how-to-handle-file-upload-in-soap-service-with-waf

Regards, Gita
Pulin Gupta 0 Reputation points

2023-05-24T18:57:32.2733333+00:00

Hi Gita,

So I can use CRS Waf 3.2 sku with detaction mode for my soap request with body size greated than 4MB? please confirm?

Note: My soap requests are not multipart file uploads, they are big payload request with >4MB data.

/Pulin
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-25T13:46:11.82+00:00
Hello @Pulin Gupta , yes, you can use CRS 3.2 WAF policy with detection mode for your soap request with body size greater than 4MB. But like I mentioned this is just a temporary workaround and not a final solution.

When your WAF receives a request that's over the size limit, the behavior depends on the mode of your WAF and the version of the managed ruleset you use.

When your WAF policy is in prevention mode, WAF logs and blocks requests that are over the size limit.

When your WAF policy is in detection mode, WAF inspects the body up to the limit specified and ignores the rest. If the Content-Length header is present and is greater than the file upload limit, WAF ignores the entire body and logs the request.

Refer: Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection

Hope this clarifies!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Pulin Gupta 0 Reputation points

2023-05-30T11:43:13.8566667+00:00

Thanks for clarifications.
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-30T14:45:36.6066667+00:00

My pleasure, @Pulin Gupta . Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-05-31T15:20:00.22+00:00

Hello @Pulin Gupta , Just checking in to see if you had a chance to see the above answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.
Arul Jothi 20 Reputation points

2023-07-26T14:45:14.12+00:00

Hi @GitaraniSharma-MSFT
We are using WAF V2 with CRS 3.2

We are facing file upload/download issue when the file size is greater than 750 MB

In the Article which you have attached. I could see the WAF V2 and CRS 3.2 we can upload files upto 4 GB. But it is mentioned that

Must define the value via WAF Policy for Application Gateway.

How to perform the above mentioned step. Kindly advise pls
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-07-26T16:31:19.52+00:00

Hello @Arul Jothi , I've provided an answer on your other thread: https://learn.microsoft.com/en-us/answers/questions/1337447/azure-waf-v2-restricting-file-upload-above-750-mb
Pabloo 0 Reputation points

2023-09-26T16:17:37.5166667+00:00

Hello @GitaraniSharma-MSFT can I ask one more question about the body limit? If WAF Config is used, how can I set WAF to skip evaluation for a request with a specific path? I would like to keep prevention mode for all my requests and omit the evaluation for this one specific path where the request body is over the body limit?
GitaraniSharma-MSFT 50,207 Reputation points Microsoft Employee Moderator

2023-09-27T07:56:26.9566667+00:00

@Pabloo , there is no attribute called request path in either WAF exclusions or custom rules.

Custom rules have a match variable "Request URI" and you can use that along with the path to exclude the URI from WAF evaluation.

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview#match-variable-required

If the path that you want to exclude is added as a path-based rule to the Application gateway, then you can create a separate WAF policy and associate that to the path-based rule and set it to detection mode.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview#per-uri-policy

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies#apply-a-per-uri-policy

Regards,

Gita