Hey everyone, I have trouble with app-gw and WAF. The problem is that we implement a websocket and in the app-gw log comes this one: error_info_s: ERRORINFO_UPSTREAM_TIMED_OUT WAFMode_s: Prevention Have another app-gw without WAF and the same config, there are no problems. Can anyone help me? Thanks, Regards, Nasimjon

@Nasimjon Tohirov , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. May I ask how you are confirming this is an issue with WAF? I see, the error info you shared is from Access Logs and not WAF Logs. And from the description of the error, it appears this is related to the time out value configured between the App Gateway and the Backend Pool. Further WAF related errors are mostly 4XX, However, I believe you would have faced a 5XX error. Can you please share the exact error code? As next steps, Please change the WAF to Detection mode and try to replicate the issue. If the same error occurs, we can confirm this is not related to WAF. Can you please share the entire error message JSON from the logs? Please configure the Request timeout value to match the response time from the actual backend pool. P.S : See : Web Socket Support in App Gw With such scenarios, WAF does not even perform any inspection to give any error. Cheers, Kapil

WAF azure websocket problem

Accepted answer

KapilAnanth-MSFT 47,196 Reputation points Microsoft Employee

2024-04-05T12:38:31.58+00:00
@Nasimjon Tohirov ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

May I ask how you are confirming this is an issue with WAF?

I see, the error info you shared is from Access Logs and not WAF Logs.

And from the description of the error, it appears this is related to the time out value configured between the App Gateway and the Backend Pool.

Further WAF related errors are mostly 4XX, However, I believe you would have faced a 5XX error. Can you please share the exact error code?

As next steps,

Please change the WAF to Detection mode and try to replicate the issue.

If the same error occurs, we can confirm this is not related to WAF.

Can you please share the entire error message JSON from the logs?

Please configure the Request timeout value to match the response time from the actual backend pool.

P.S :

See : Web Socket Support in App Gw

With such scenarios, WAF does not even perform any inspection to give any error.

Cheers,

Kapil
Please sign in to rate this answer.

1 person found this answer helpful.
Nasimjon Tohirov 231 Reputation points

2024-04-05T12:54:41.7566667+00:00

Hey Kapil,

Thanks a lot for explaining resourcefully, but it’s very strange that on another app-gw everything works perfectly, these are the same settings the only difference is the inclusion of WAF. That's why I'm surprised :)

Regards,

Nasimjon.

KapilAnanth-MSFT 47,196 Reputation points Microsoft Employee

2024-04-05T13:28:20.2566667+00:00

@Nasimjon Tohirov ,

You are welcome.

Can you share the above requested logs ?

And try the action plan suggested?

Set WAF in Detection Mode

Configure the Request timeout value to match the response time from the actual backend pool.

Cheers,

Kapil

Nasimjon Tohirov 231 Reputation points

2024-04-07T20:19:44.33+00:00

I did (detection mode) what you wrote above, and the same error occurred. The request changed from 30 seconds to 120 seconds in backend settings (Request time-out (seconds)), but get the same error. I don't know what could be the reason.

Regards,

Nasimjon

KapilAnanth-MSFT 47,196 Reputation points Microsoft Employee

2024-04-08T08:51:00.7+00:00

@Nasimjon Tohirov ,

Thanks for the info.

Could you please share the entire Access log?

I believe this is because the time taken could be more than 120 seconds. You can try setting this value further up, like 5-10 minutes and see what exactly is the error message and log you are getting.

Can you confirm the set up works if you remove/bypass the application gateway? i.e., by directly accessing the backend

It is important that you share the access logs, especially, "serverRouted" and "serverStatus" values.

Cheers,

Kapil

Nasimjon Tohirov 231 Reputation points

2024-04-12T08:04:31.9933333+00:00

Hi Kapil,

I changed it to 120 seconds and just a small editing web socket config, so everything is fine now. Thanks again.

Have a nice day,

Regards,

Nasimjon.

KapilAnanth-MSFT 47,196 Reputation points Microsoft Employee

2024-04-12T08:09:38.6233333+00:00

Hi @Nasimjon Tohirov ,

You are most welcome.

Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I have summarized our discussion and posted it as a new answer.

I would highly appreciate if you could Accept this answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

WAF azure websocket problem

0 additional answers

Your answer