TLS Inspection in WAF App Gateway and Firewall

Question

Hi,

WAF App Gateway does inbound TLS inspection only.
How could this be enabled? I don't see this setting in WAF App Gateway.

If I have App Gateway in front of Azure Firewall and there's HTTP(S) request happening, that means TLS inspection on the HTTP(S) request packets is only being done in WAF App Gateway, right?

And following up on the question above for the HTTP(S) response from the server, that means TLS inspection on the HTTP(S) response packets only happen on Azure firewall, right?

Thanks

Answer 1

Hello Tan
The WAF App Gateway automatically performs inbound TLS inspection for HTTP(S) traffic from clients as part of its functionality, without needing a specific setting to enable it. For HTTP(S) requests, the WAF App Gateway handles TLS inspection, while Azure Firewall focuses on outbound traffic and does not perform inbound TLS inspection.

Enabling Inbound TLS Inspection in WAF App Gateway:

• Please ensure the appropriate certificates are configured in the App Gateway for this inspection.
• There is no specific setting to enable this feature; it is automatically applied to incoming requests.
• The WAF App Gateway supports inbound TLS inspection for HTTP(S) traffic by default.
• After inspection, it can re-encrypt and forward the request to the backend (optional).

When the App Gateway in front of Azure Firewall:

• The WAF App Gateway handles TLS inspection for incoming client requests.
• The Azure Firewall manages TLS inspection for outgoing server responses, but it does not inspect inbound TLS traffic.

Design intent: Azure Firewall is designed primarily as a network-level security service that controls and inspects egress and internal traffic. Inbound web traffic typically goes through Application Gateway, which is designed to handle HTTP(S), TLS termination, routing, and WAF.

• Azure Firewall operates at L3–L7, but it doesn’t handle complex HTTP-level features like App Gateway.
• Handling TLS inspection for inbound traffic (from untrusted clients) typically involves managing certificates in a way that’s better suited to a reverse proxy or WAF

Refer the public document: https://learn.microsoft.com/en-us/azure/firewall/premium-features#tls-inspection

Azure Firewall with TLS Inspection shows in the below Diagram:

Check the relevant Q&A threads:

Refer: https://learn.microsoft.com/en-us/answers/questions/2275648/tls-inspection-in-waf-app-gateway-and-firewall

Refer: https://learn.microsoft.com/en-us/answers/questions/2073355/how-would-tls-inspection-work-with-waf-enabled-app

---

Hope the above answer helps! Please let us know do you have any further queries.
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution.