362 questions with Azure Web Application Firewall tags

Sort by: Updated
1 answer One of the answers was accepted by the question author.

During WAF creation Default Ruleset 2.1 showing as in preview

While creating a new WAF policy for Regional WAF (Application Gateway), moving to the Managed rules tab to select the default ruleset, Microsoft_DefaultRuleSet_2.1 is showing (preview). I thought this was GA already? See below image. Thanks.

Azure Web Application Firewall
asked 2025-03-21T17:26:48.99+00:00
Russ Crosbie 40 Reputation points
accepted 2025-03-26T10:50:06.2366667+00:00
Russ Crosbie 40 Reputation points
1 answer One of the answers was accepted by the question author.

Updates to WAF OWASP 3.2 signatures

We are using OWASP 3.2 and we've been noticing a number of false positives occurring where they have not happened in the past, but we have not made changes to our application. This article states "These rule sets, managed by Azure, receive updates…

Azure Web Application Firewall
asked 2025-03-21T22:08:32.4866667+00:00
Russ Crosbie 40 Reputation points
accepted 2025-03-26T10:49:22.6733333+00:00
Russ Crosbie 40 Reputation points
1 answer One of the answers was accepted by the question author.

Azure Application Gateway WAF blocking some requests with OpenID Connect nonce cookies

The default rules of Azure Web Application firewall sometimes block requests containing a cookie set by Microsoft.AspNetCore.Authentication.OpenIdConnect During challenge redirect the AuthenticationHandler sets a cookie named:…

Developer technologies | ASP.NET | ASP.NET Core
Azure Web Application Firewall
asked 2021-11-10T08:41:43.057+00:00
Niklas Nielsen 31 Reputation points
commented 2025-03-24T14:21:07.7233333+00:00
Verhaeghe Jan 15 Reputation points
1 answer

Azure Web Application Firewall country mapping sudden increase in ZZs

I have a case on which our main metrics suddenly started to present an abnormal number of requests coming trough our WAF of ZZ requests, when these usually were a tiny percentage. The Geo location rules we use have been effective, but of course if all…

Azure Web Application Firewall
asked 2025-03-23T09:19:46.1133333+00:00
Adonis Briceno 51 Reputation points
answered 2025-03-24T07:54:02.8233333+00:00
G Sree Vidya 2,360 Reputation points Microsoft External Staff Moderator
0 answers

Repetitive GET request qurey in requestUri_s field of ApplicationGatewayFirewallLog

Hi, I am currently facing a strage behavior with Azure Application Gateway and WAF. We have a web application running in AKS connected to Application Gateway connected with AGIC. The application serves 2 hosts, let's say HostA and HostB. We found that…

Azure Web Application Firewall
asked 2025-03-17T07:32:11.2433333+00:00
Kit Shing Kwong 25 Reputation points
commented 2025-03-24T05:43:00.0433333+00:00
Venkat V 2,545 Reputation points Microsoft External Staff Moderator
1 answer

Azure WAF bot protection ruleset. Meaning of log ID 300700

I have enabled bot protection ruleset for a waf policy. The DRS ruleset normally has a detailed message in the logs but for the bot protection I am finding it hard to identify the reason for a match for 300700 id Other bots (group Unknownbots). We have…

Azure Web Application Firewall
asked 2025-03-12T14:29:21.1666667+00:00
eenchev 0 Reputation points
edited a comment 2025-03-20T11:21:07.07+00:00
Venkat V 2,545 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

How would TLS inspection work with WAF enabled App Gateway and Azure Firewall?

Hi, I have been struggling with this from a while now. Our design has WAF enabled App gateway for incoming HTTP / HTTPS traffic from internet and then have Azure Firewall behind it. Have couple of queries for which I need assistance: 1: Does WAF has…

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
781 questions
Azure Web Application Firewall
asked 2024-09-18T23:33:09.83+00:00
Rakesh Singh 395 Reputation points
commented 2025-03-12T09:54:19.4866667+00:00
Jørgen Woortman 0 Reputation points
1 answer One of the answers was accepted by the question author.

How to send different tenant's Azure WAF log to tenant with Sentinel Configured?

Hello, I have 2 tenants. A tenant : WAF configured (Sentinel x) B tenant : Sentinel configured( WAF x) I would like to analyze A's logs in tenant B's sentinel. How can I configure? I think I should configure Azure lighthouse, is it right? If not,…

Azure Lighthouse
Azure Lighthouse
An Azure service that provides secure managed services and access control for partners and customers.
92 questions
Azure Web Application Firewall
Microsoft Security | Microsoft Sentinel
asked 2023-06-02T07:38:39.8566667+00:00
mara7 166 Reputation points
commented 2025-03-05T14:14:41.5766667+00:00
KateGokul-3672 0 Reputation points
1 answer

Azure Front Door WAF

We have an Azure Front Door instance with an attached Web Application Firewall (WAF)

Azure Web Application Firewall
asked 2025-03-03T18:50:41.03+00:00
Nikhil 0 Reputation points
answered 2025-03-03T20:49:51.2933333+00:00
Abiola Akinbade 29,490 Reputation points Volunteer Moderator
1 answer One of the answers was accepted by the question author.

Request URI Not Parsed in AGWFirewallLogs Query

When using a WAF, I tried to check the request URI before applying an exception because there were many detected logs. When querying AGWFirewallLogs, I extended the query using extend parseUrl = parse_url(RequestUri), but parseUrl appears empty. How can…

Azure Web Application Firewall
asked 2025-02-25T04:03:54.7566667+00:00
iuiu 40 Reputation points
accepted 2025-02-27T03:59:41.62+00:00
iuiu 40 Reputation points
2 answers

Azure Web Application Firewall- Microsoft_BotManagerRuleSet_1.0

This post is regarding the azure WAF unknown bots and its rules at the moment for us rule id 300700 'other bots' is being logging with errors for various API'S, i didn't see any information can anyone has more inputs on the existing issue will be…

Azure Web Application Firewall
asked 2023-11-08T07:31:22.3733333+00:00
rohith v 0 Reputation points
answered 2025-02-21T06:41:05.4233333+00:00
Matthew Mckenzie 20 Reputation points
1 answer

Adding firewall in front of web apps in Hub-and-Spoke architecture

Hi, I am shifting towards hub & spoke model in my Azure subscription so that all the traffic coming into my subscription goes through the firewall. I have multiple types of resources but I am more concerned about web apps and function apps. How can…

Azure Front Door
Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
858 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
781 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,775 questions
Azure Web Application Firewall
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
8,971 questions
asked 2025-01-29T15:55:53.49+00:00
Najam ul Saqib 400 Reputation points
commented 2025-02-10T13:42:32.9166667+00:00
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator
9 answers

When to use Azure WAF or Azure Firewall ?

Hi Folks, Can anyone here please share some thoughts and comments of when to use Azure WAF or Azure Firewall? I have already existing Azure ExpressRoute so my Azure VMs can ping my OnPremise servers, and vice versa. My purpose here is to be able to…

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
781 questions
Azure Web Application Firewall
Azure Firewall Manager
Azure Firewall Manager
An Azure service that provides central network security policy and route management for globally distributed, software-defined perimeters.
97 questions
asked 2020-11-15T13:17:27.597+00:00
EnterpriseArchitect 6,041 Reputation points
answered 2025-02-06T06:38:53.57+00:00
VIVEK DWIVEDI 185 Reputation points Microsoft Employee
1 answer

Clarification Needed on Azure WAF Ruleset Upgrade Notification for Non-Configured WAF Policy

I have recently received a notification from Azure urging me to upgrade to the latest Azure Web Application Firewall (WAF) ruleset version, specifically CRS 3.2 or DRS 2.1, by January 26, 2026. This is due to the deprecation of the older CRS 3.0 ruleset…

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions
Azure Web Application Firewall
asked 2025-01-31T07:09:42.1233333+00:00
Anji Muduthanapally 5 Reputation points
commented 2025-02-06T06:02:54.43+00:00
rvinnakota 4,760 Reputation points Moderator
1 answer One of the answers was accepted by the question author.

Integrate storage, database, webapp, and databricks into one VNET

We are hardening our ML platform in Azure. Basically, we want to put all the Azure services ( ADLS, PostgreSQL DB, Web App, and Databricks cluster) in one virtural network so all the traffic will be inside the Azure network whenever possible (except the…

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,775 questions
Azure Databricks
Azure Databricks
An Apache Spark-based analytics platform optimized for Azure.
2,534 questions
Azure Web Application Firewall
Azure Database for PostgreSQL
asked 2024-11-22T17:43:49.06+00:00
P, John 240 Reputation points
accepted 2025-01-17T01:04:35.9166667+00:00
P, John 240 Reputation points
1 answer

Best Approach to Block Incoming Traffic During Initial Cache Loading in Azure VMSS

I am setting up a VMSS (Virtual Machine Scale Set) for a web application, and I need to perform an initial load of objects into the cache. To achieve this, I would like to open a web page on localhost to load the objects into the cache, but I don't want…

Azure Web Application Firewall
Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
506 questions
Windows for business | Windows Server | User experience | PowerShell
asked 2024-12-22T15:42:48.31+00:00
ShlomiDror-7850 0 Reputation points
edited the question 2025-01-07T13:19:18.1666667+00:00
Anonymous
1 answer One of the answers was accepted by the question author.

My app gateway web application firewall policy deployment fails with this message "Region is not enabled for Exception feature". How do I enable the feature?

I have a bicep template defining App Gateway Web Application Firewall policy with exceptions. I am using api-version 2024-03-01…

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions
Azure Web Application Firewall
asked 2024-12-16T16:31:43.5+00:00
jesseve 20 Reputation points
accepted 2025-01-07T07:47:01.7433333+00:00
jesseve 20 Reputation points
1 answer One of the answers was accepted by the question author.

How to Relax or Remove the “LocalRequestPartnerRateLimit” Rule in Azure Front Door?

We are hosting a web app on Azure App Service, with traffic routed through Azure Front Door. Most of the time, everything works smoothly. However, we occasionally get a 429 Too Many Requests error, and upon investigation, it appears that a rule named…

Azure Front Door
Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
858 questions
Azure Web Application Firewall
Azure | Azure Startups
asked 2025-01-05T05:01:36.7833333+00:00
西村和海 25 Reputation points
commented 2025-01-07T02:00:52.3333333+00:00
rvinnakota 4,760 Reputation points Moderator
2 answers

Managing 200 Websites with Application Gateway and WAF Protection

Hello, I have a single server that is currently hosting over 200 websites. Is it possible to manage all these websites using an application gateway and protect them with a WAF?

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions
Azure Web Application Firewall
asked 2024-05-29T07:27:34.4466667+00:00
Nitin Arora 25 Reputation points
edited a comment 2024-12-20T13:04:42.0666667+00:00
Walid Farakh 0 Reputation points
1 answer One of the answers was accepted by the question author.

Azure WAF Training

I have been working with a user who continually gets locked out of their acct, they state they have a script running thats "training the WAF" I was under the impression that a WAF is policy based and cant be trained like you would train an AI.…

Azure Web Application Firewall
asked 2024-11-26T14:42:58.3066667+00:00
Steven 20 Reputation points
accepted 2024-12-11T13:10:09.9666667+00:00
Steven 20 Reputation points