Azure Front Door - Firewall - Custom Rule

Question

I'm working on setting up a custom rule to block some requests. Everything I read online is that i should be able to create this rule as follows:

However it doesn't work unless i fully qualify it..

Looking for someone to confirm that we have to fully qualify to match on requesturi?

Answer 1

Hi @Nick Capito

As per our understanding Azure Front Door WAF custom rules evaluate the RequestUri match variable, which comprehensively includes the full URI: scheme, FQDN, port, path, and any query string parameters.

A FQDN is required for matching, or if partial paths are sufficient, is resolved by understanding the pivotal role of match operators.

• The FQDN is always present in the RequestUri string that the WAF engine evaluates.
• However, the match_values specified in a custom rule do not need to contain the FQDN if an appropriate operator supporting partial or substring matching is utilized. These operators allow for effective matching on partial paths or other URI segments.
• Conversely, if the Equals operator is used, the match values must precisely mirror the entire RequestUri, including the FQDN, scheme, path, and query string, for a match to occur.

Carefully choose the match operator (Equals, Contains, BeginsWith, EndsWith, Regex) that precisely reflects the intended matching logic for the specific part of the URI being targeted.

Be aware of any string transforms (Lowercase, Urldecode) applied to the RequestUri variable, as they alter the string before matching occurs. Ensure match values are consistent with the transformed string.

Understand and meticulously plan rule priorities, especially when Allow and Block actions for overlapping URI patterns are involved, as rule processing order and termination are critical.

Always test new or modified rules in Detection mode before enabling Prevention mode to avoid unintended consequences on legitimate traffic.

Leverage Azure Front Door WAF logs, particularly the requestUris field, to verify rule behavior and troubleshoot any discrepancies.

NOTE: Please try to give the operator as "Equals" and give the match value as "https://malicous.com/testblock" and repro the issue once.

Please refer the below documents for more information:

1. Match variable
2. Custom rules for Azure Web Application Firewall on Azure Front Door
3. Azure Web Application Firewall monitoring and logging

---

Kindly let us know if the above helps or you need further assistance on this issue.