How to limit access to Web App with WAF (detection mode) and Azure Firewall?

Mohsen Akhavan 791

Based on this reference, I used Azure Application Gateway (WAF) before Azure Firewall. This is my scenario.

User's image

I need to limit access to the web app with specific IPs. I can do with "Custome Role" in WAF policy and my WAF should be "Prevent" mode.
Is there any way to allow access to the web app based on the client's IP without switching to the "Prevent" mod on WAF? with the Firewall or App Restriction?

Mohsen Akhavan 791 Reputation points

2023-06-09T09:31:55.1233333+00:00

@AirGordon Thanks for your reply. I used WAf before Firewall and have I client IP in the Azure Firewall? In the reference:
This design is appropriate for applications that need to know incoming client source IP addresses, for example to serve geolocation-specific content or for logging. Application Gateway in front of Azure Firewall captures the incoming packet's source IP address in the X-forwarded-for header, so the web server can see the original IP address in this header.

Is it possible to have access X-Forwarded-For header: ClientPIP in Azure Firewall?
KapilAnanth-MSFT 46,771 Reputation points Microsoft Employee

2023-06-09T10:01:45.5133333+00:00
@Mohsen Akhavan

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid your requirement is not clear to me.

You would like to keep the Firewall in Detection mode only, and not in Prevention mode - is this correct?

If so, I am not sure how that would benefit you.

Now, to block certain IPs,

I don't think so this would be feasible.

Because, as stated in the document, The source IP address will change to Application Gateway's Instance(s)' IP and the actual Client IP will be stored in X-Forwarded-For header.

You cannot create rules to block traffic using headers in Azure Firewall.

And AFAIK, same goes for a WebApp in Azure.

The recommended way here is to keep the App Gateway WAF in Prevention mode and create custom rules to block traffic.

Also, how is the connection established between Azure Firewall and WebApp?

Via Internet or via Private EndPoint?

Also, as per @AirGordon 's answer, you can create NSG on the App Gateway subnet and block the IPs while keeping the WAF in detection mode

Cheers,

Kapil
Mohsen Akhavan 791 Reputation points

2023-06-09T11:17:37.2233333+00:00

Hi @KapilAnanth-MSFT , Thansk.
The reason for the Detection mode on WAF is, in the current state with Prevent mode I have some issues that I should fix and it needs time (for example two months). So, I'm working on issues with Prevent mode in the development environment, and on another side, in the Stage environment the client tested the web app with WAF detection mode and I received logs.

Yes, I know the Client IP will be changed. I'm looking for a solution to limit.

For your information, direct access to the web app it's not possible and I close it with "Access Restriction" on the web app. Only Firewall and Application Gateway (WAF) can communicate with the web app. So, I think NSG doesn't work here. Is it right?
KapilAnanth-MSFT 46,771 Reputation points Microsoft Employee

2023-06-09T12:44:02.4133333+00:00
@Mohsen Akhavan

Understood.

Please note I never suggested direct access to the WebApp.

Instead, I was only curious as to how Azure Firewall and WebApp connectivity is established?

Was it using Private EndPoint?

Or internet connectivity?

In any case, NSGs should work.

Please note NSG is applied at the App Gateway Subnet. This means,

The Traffic will hit the NSG even before it hits the WAF

So, if you were to configure DENY rules in the NSG to block access from certain IPs, then they will be blocked.

Thing to Note here is that they will not be logged by the WAF (as they never make it to WAF).

Hope this helps.

Cheers,

Kapil
Mohsen Akhavan 791 Reputation points

2023-06-09T15:24:02.5466667+00:00
@KapilAnanth-MSFT , the connectivity is over the internet.
Let me explain more to clarify:

The client sent a request to Application Gateway (WAF)'s public IP.

After WAF the request deliver to the web app through Azure Firewall with a Route table

You mean, I create an NSG and applied it to the App Gateway subnet. Then I can deny traffic-specific IP. Is it right?
Mohsen Akhavan 791 Reputation points

2023-06-11T18:26:04.07+00:00

@KapilAnanth-MSFT, thanks I tested and it's working. One question, if I have two web apps, is there any way to assign this IP limitation to web app1 and web app2 open from anywhere?
KapilAnanth-MSFT 46,771 Reputation points Microsoft Employee

2023-06-12T04:03:01.66+00:00

@Mohsen Akhavan

For direct access to the WebApps, you can leverage Access Restrictions to open traffic to WebApp1 and WebApp2 from anywhere

Cheers,

Kapil
Mohsen Akhavan 791 Reputation points

2023-06-12T07:43:34.87+00:00

@KapilAnanth-MSFT , I mean traffic goes through WAF. Is there any way to add an inbound role for app1 and app2 on NSG?
I think when the location of two apps is the same, it's not possible. But, if the location of the two apps is different it's possible to use "Service Tag" as a destination in NSG.
The scenario is, I have two web apps in EastUS. I added NSG to the AppGw subnet. Now, I want to have only access from 217.10.11.12 to web app1 and web app2 have access from anywhere. Is it possible?
KapilAnanth-MSFT 46,771 Reputation points Microsoft Employee

2023-06-12T08:12:32.82+00:00
@Mohsen Akhavan

Wrt,

I have two web apps in EastUS. I added NSG to the AppGw subnet. Now, I want to have only access from 217.10.11.12 to web app1 and web app2 have access from anywhere. Is it possible?

No, this is not possible.

Because, you are accessing both the WebApps via a single App Gateway (App Gateway's IP).

This means, the destination is same for both the WebApps wrt NSG applied at App Gateway subnet.

The NSG will simply not know what the destination WebApp is (whether it's WebApp1 or WebApp2) and thus, you cannot fine tune your NSG rules per WebApp in this configuration

Hope this helps.

Cheers,

Kapil.

Accepted answer

AirGordon 7,125 Reputation points

2023-06-09T09:20:49.08+00:00

The simplest way is to leverage a Network Security Group on the Application Gateway subnet, create an inbound rule to specify the IP and another rule to deny other traffic.

As you have Azure Firewall in your architecture, you could also leverage this by creating a rule.
Please sign in to rate this answer.
Mohsen Akhavan 791 Reputation points

2023-06-11T18:25:21.0833333+00:00

@AirGordon , thanks I tested and it's working. One question, if I have two web apps, is there any way to assign this IP limitation to web app1 and web app2 open from anywhere?

AirGordon 7,125 Reputation points

2023-06-12T08:12:13.2466667+00:00

The IP limitation applies to the whole AppGw subnet, not the web apps - so no you couldn't differentiate.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to limit access to Web App with WAF (detection mode) and Azure Firewall?

0 additional answers

Your answer