azure application gateway waf v2

Question

I have set a waf to protect the backend website. I want to allow only certain IPs to access the backend, but want the traffic to be 'scanned' by the managed rules too.

I used custom rules to allow the ip and block everything else. Then I found the traffic will be exempted from the managed rulesets too. Is there workaround?

Answer 1

@Shum Kenneth

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to allow a bunch of IPs and also let the Managed Rules process them.

This can be achieved by modifying your Custom Rules Implementation.

Rather than Allowing certain IPs , block the IPs that do not match this certain IPs.

Requirement:

1. if host header contains "website.example.com" -> allow
2. if ip contains 1.2.3.4 -> allow
3. if ip contains 1.3.4.5 -> allow
4. block everything else

Observation:

• You should combine Rule 2 and 3 into a single one.
• I don't think you can combine the requirement of having
  • host header with any IP for site 1
    • and only certain IPs for site2
      • and still make the rule be processed by Managed Rules.
• Instead you should consider having individual WAFs for individual sites, i.e, Listeners
• Refer : Per-site WAF policies

By applying WAF policies to a listener, you can configure WAF settings for individual sites without the changes affecting every site. The most specific policy takes precedent. If there's a global policy, and a per-site policy (a WAF policy associated with a listener), then the per-site policy overrides the global WAF policy for that listener. Other listeners without their own policies will only be affected by the global WAF policy.

Implementation:

• If does not Contain ------> DENY
  • This means, If contains ------> let it be processed by next rules and then Managed Rules
• This will DENY every IP that is not 1.2.3.4 or 1.3.4.5
• And for IPs 1.2.3.4 or 1.3.4.5, this Custom Rule will not interact with the request at all and let the Managed Rules process the request.

For Host Header,

• You should create a new WAF Policy and associate this to the site1 (which requires HOST Header Filtering)
• For Host header, the logic is same as above
• 

Hope this helps.

Thanks,

Kapil

---

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.