Is Application gateway with WAF send outbound traffic to internet?

Question

Is Application gateway with WAF send outbound traffic to internet?

Omkar Pasalkar 91

In a specific scenario where both an Application Gateway with Web Application Firewall (WAF) and Azure Firewall are deployed in parallel, handling incoming HTTP and HTTPS traffic, there's a question regarding the capability of the Application Gateway and WAF to send outbound traffic to the internet.

The inquiry pertains to whether this combined setup, which primarily focuses on processing incoming traffic, possesses the functionality to handle and manage outbound traffic destined for the internet.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

GitaraniSharma-MSFT 50,171 Microsoft Employee Moderator

Hello @Omkar Pasalkar ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if the combined setup of Application Gateway with WAF and Azure Firewall deployed in parallel, possesses the functionality to handle and manage outbound traffic destined for the internet.

As described in the below doc:

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#firewall-and-application-gateway-in-parallel

User's image

The Azure Firewall will cover outbound flows from both workload types.

All outbound flows from Azure VMs will be forwarded to the Azure Firewall by UDRs.

enter image description here

So, when Application Gateway with WAF and Azure Firewall are deployed in parallel, Azure WAF in Azure Application Gateway protects inbound traffic to the web workloads, and the Azure Firewall inspects inbound traffic for the other applications. And the outbound flows from both workload types are handled by the Azure Firewall.

Since, you've tagged AKS, I'm adding information regarding AKS egress traffic functionality using this setup below:

To limit egress traffic from an Azure Kubernetes Services cluster using this combined setup, please refer:

https://learn.microsoft.com/en-us/azure/aks/limit-egress-traffic

Outbound requests start from agent nodes to the Azure Firewall internal IP using a user-defined route (UDR)

Requests from AKS agent nodes follow a UDR that has been placed on the subnet the AKS cluster was deployed into.
Azure Firewall egresses out of the virtual network from a public IP frontend.
Access to the public internet or other Azure services flows to and from the firewall frontend IP address.
Access to the AKS control plane can be protected by API server authorized IP ranges, including the firewall public frontend IP address.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Omkar Pasalkar 91 Reputation points

2023-11-09T15:09:42.0633333+00:00

Hi @GitaraniSharma-MSFT

Thank you for your quick response.

After reviewing the documentation, it appears that the setup of an Application Gateway with Web Application Firewall (WAF) lacks the inherent capability to handle outbound traffic to the internet. Instead, all outbound traffic is expected to be routed through the Azure Firewall.

Hence, it can be concluded that in this configuration, an asymmetric routing scenario arises, where incoming traffic is processed by the Application Gateway and WAF, while outbound traffic follows a separate path via the Azure Firewall to reach the internet.

Thank You
GitaraniSharma-MSFT 50,171 Reputation points Microsoft Employee Moderator

2023-11-09T15:37:28.62+00:00

Hello @Omkar Pasalkar ,

Azure Application gateway is a web traffic (OSI layer 7) load balancer that enables you to manage traffic to your web applications. It doesn't have the functionality to handle Outbound traffic.

Azure Firewall and Azure Application Gateway use different technologies, and they support securitization of different flows:

So, no matter where you deploy the Azure Application gateway (in parallel or before or after Azure Firewall), it will only help you with the inbound traffic. Azure Firewall is used in conjunction to this setup for added inspection of inbound traffic and to handle the outbound traffic flows.

The asymmetric routing scenario is already explained in the below doc where Azure Firewall is used with a setup of Public load balancer and internal load balancer:

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#asymmetric-routing

In case of Application gateway, traffic asymmetry isn't a concern.

More info: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha#using-l7-load-balancers

For workloads running on an AKS cluster, it's best to use the parallel design option of Application Gateway WAF and Azure Firewall to protect an AKS cluster. The Application Gateway with WAF processes inbound connection requests to web applications in the cluster. Azure Firewall permits only explicitly allowed outbound connections.

Please refer the below doc which shows a baseline architecture for an Azure Kubernetes Service (AKS) cluster for an example of the parallel design option.

https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks/baseline-aks

As explained in this doc, if you use a public load balancer as your public point for ingress traffic and egress through Azure Firewall using UDRs, you might see an asymmetric routing situation. This architecture uses internal load balancers in a dedicated ingress subnet behind the Application Gateway. This design choice not only enhances security, but also eliminates asymmetric routing concerns.

Refer: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks/baseline-aks#egress-traffic-flow

Regards,

Gita
Omkar Pasalkar 91 Reputation points

2023-11-09T16:06:05.44+00:00

Hi @GitaraniSharma-MSFT

Thanks for the reply.

Its clear now.

Share via

Is Application gateway with WAF send outbound traffic to internet?

0 additional answers

Your answer