Hi Team, We are using WAFV2 with CRS 3.2 for our Azure App Gateway. We are seeing there is a file upload/download restriction when the file size is greater than 750 MB https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#application-gateway-limits Even though as per the documentation it is mentioned that if we use WAFV2 with CRS 3.2 for our Azure App Gateway we will have file upload limit upto 4 GB. But it is mentioned that Must define the value via WAF Policy for Application Gateway. Can someone help me how to define the value in WAF Policy for Application Gateway.

Hello @Arul Jothi , Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. I understand that you are using WAFV2 with CRS 3.2 for your Azure App Gateway but you see that there is a file upload/download restriction when the file size is greater than 750 MB. As per the documentation it is mentioned that if you use WAFV2 with CRS 3.2 for your Azure App Gateway you will have file upload limit up to 4 GB. And would like to know how to define this value in your existing WAF Policy for Application Gateway. To define the "Max file upload size" to 4 GB in your existing WAF policy for Application gateway, you can follow the below steps: Go to the Application Gateway WAF policy in Azure Portal. Expand the settings pane and go to Policy Settings. In the Max file upload size (MB) option, change the value to 4000. Click Save. This will make your Max file upload size limit to 4 GB. Kindly let us know if the above helps or you need further assistance on this issue. Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

Azure WAF V2 restricting file upload above 750 MB

Accepted answer

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2023-07-26T16:09:31.17+00:00
Hello @Arul Jothi ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are using WAFV2 with CRS 3.2 for your Azure App Gateway but you see that there is a file upload/download restriction when the file size is greater than 750 MB. As per the documentation it is mentioned that if you use WAFV2 with CRS 3.2 for your Azure App Gateway you will have file upload limit up to 4 GB. And would like to know how to define this value in your existing WAF Policy for Application Gateway.

To define the "Max file upload size" to 4 GB in your existing WAF policy for Application gateway, you can follow the below steps:

Go to the Application Gateway WAF policy in Azure Portal.

Expand the settings pane and go to Policy Settings.

In the Max file upload size (MB) option, change the value to 4000.

Click Save. This will make your Max file upload size limit to 4 GB.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Arul Jothi 20 Reputation points

2023-07-26T16:56:18.5566667+00:00

Hi @GitaraniSharma-MSFT

Thanks for your prompt reply.

I initially tried this option but when i tried to enable Inspect Request Body.
Our application fails to load.

Is there any way to increase the file size upload limit without enabling inspect request body.

Also we need to have WAF V2 and CRS 3.2 enabled due to the cybersecurity reason.

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2023-07-27T15:07:33.12+00:00

Hello @Arul Jothi ,

It is not possible to increase the file size upload limit without enabling inspect request body.

Web Application Firewall allows you to configure request size limits within lower and upper bounds.

The following two size limits configurations are available:

The maximum request body size field, specified in KB.

The maximum file upload limit field, specified in MB.

The default value for request body size is 128 KB. But for CRS 3.2 (on the WAF_v2 SKU) and newer, you can set a 2 MB request body size limit.

And if the request body inspection is turned off, then maximum request body size field isn't applicable and can't be set. Same goes for max file upload limit field.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits

Not inspecting the body of a request introduces extra risk because any attack that is passed via the body will not be caught by WAF. It is recommended to inspect the entire request whenever possible.

One workaround in your case would be to have a global WAF policy with Request body inspection set to ON and max limits of 2 MB request body and 4 GB file upload, applied to the entire Application gateway, but then setup a specific WAF policy (which disables body inspection) that only applies when the client request hits a specific listener, or a specific URI, which fails to load.

Azure Web Application Firewall (WAF) policy can be associated to an application gateway (global), a listener (per-site), or a path-based rule (per-URI) for them to take effect. It can be associated with any combination of application gateways, listeners, and path-based rules. So, there are 3 types of WAF policy associations:

Global WAF policy: When you associate a WAF policy globally, every site behind your Application Gateway WAF is protected with the same managed rules, custom rules, exclusions, and any other configured settings.

Per-site WAF policy: With per-site WAF policies, you can protect multiple sites with differing security needs behind a single WAF by using per-site policies.

Per-URI policy: For even more customization down to the URI level, you can associate a WAF policy with a path-based rule.

By default, with WAF policies, more specific policies override less-specific ones. This means a per-URI policy on a URL path map overrides any per-site or global WAF policy above it. If there's a global policy, and a per-site policy (a WAF policy associated with a listener), then the per-site policy overrides the global WAF policy for that listener. Other listeners without their own policies will only be affected by the global WAF policy.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies#apply-a-per-uri-policy-preview

Kindly let us know if the above helps or you need further assistance on this issue.

Regards, Gita

Arul Jothi 20 Reputation points

2023-07-27T15:14:25.5433333+00:00

Thanks @GitaraniSharma-MSFT for your detailed explanation.

We will discuss with our cyberteam and see how we can adopt your recommendations

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2023-07-27T15:56:48.5933333+00:00

@Arul Jothi , happy to help!

If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

And, if you have any further query do let us know.

Regards, Gita

Arul Jothi 20 Reputation points

2023-08-15T18:02:44.9966667+00:00

@GitaraniSharma-MSFT
Hi Gita,
Our Upload issue is resolved and we are able to upload files which are greater than 2 GB.

Now we are facing similar issue in file download. We are able to download files upto 1 GB only exactly.
After downloading 1 GB connection is broken. If the file size is less than 1 GB we dont have any issues in downloading.

We have followed your instructions and enabled the inspect request body and set the body header as 2000 and max file upload to 4000

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2023-08-21T12:04:39.3833333+00:00

@Arul Jothi , apologies for the delay in response.

I checked internally and found that disabling ResponseBuffering on Application gateway mostly resolves the download issue.

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/proxy-buffers

But in the above document, there is a limitation mentioned as below:

Request and Response Buffers can only be disabled for the WAF v2 SKU if request body checking is disabled. Otherwise, Request and Response Buffers cannot be disabled for the WAF v2 SKU.

So, please allow me some time to discuss this with the Azure Application gateway Product Group team and get back to you with an update.

Regards,

Gita

Arul Jothi 20 Reputation points

2023-08-21T12:44:59.1833333+00:00

@GitaraniSharma-MSFT Sure take your time i can wait

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2023-08-23T17:26:49.4866667+00:00

@Arul Jothi , I discussed this issue with the Azure WAF Product Group team, and they mentioned that if we disable ResponseBuffering, the WAF will cease to function. Request buffering is required so that the WAF has the full request available before it starts applying its rules.

So, the above resolution that I shared mostly applies to Standard_v2 SKU Application gateways only.

Now, coming to your issue of more than 1 GB download failing, we will need a specialized 1:1 session, where a support engineer can collect the logs to pinpoint the issue. So, if you have a support plan, I request you file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

In case you need help with a one-time free technical support, please send an email with subject line "ATTN gishar | Azure WAF V2 restricting file download above 1 GB" to AzCommunity[at]Microsoft[dot]com with the following details, I will follow-up with you.

Reference this Q&A thread

Your Azure Subscription ID

Note: Do not share any PII data as a public comment.

Regards,

Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure WAF V2 restricting file upload above 750 MB

0 additional answers

Your answer