Azure Application Gateway Client Requests Routing

Question

For Azure Application Gateway with WAF enabled, does client requests filtered on WAF or NSG first?

Answer 1

Hi @Sathish Mugite  

NSGs operate at Layers 3 and 4 of the OSI model. They control network traffic based on IP addresses and ports. Therefore, NSGs filter traffic first. They determine whether network traffic is allowed to reach the Application Gateway's subnet in the first place. Please refer the document.

The WAF operates at Layer 7. It inspects the HTTP/HTTPS traffic for web application vulnerabilities. Therefore, the WAF processes traffic after it has been allowed by the NSGs. The WAF examines the content of the web requests.

NSGs act as the first line of defense, controlling network access and the WAF then provides deeper application-level inspection, protecting against web-based attacks. Please refer the document.

when an Azure Application Gateway has both the WAF and a NSG enabled, client requests are first filtered by the NSG associated with the Application Gateway's subnet, and subsequently by the WAF.

This order of processing is fundamental to how security is enforced for web applications deployed on Azure. The NSG acts as a network-level firewall, controlling access based on IP addresses, ports, and protocols, while the WAF provides application-level protection by inspecting the content of HTTP/HTTPS requests for common web exploits and vulnerabilities.

---

If the above has been helpful, please take a moment to click 'Accept answer'

If you still have questions, please let us know what is needed in the comments so the question can be answered.