Create rate limiting custom rules for Application Gateway WAF v2
Rate limiting enables you to detect and block abnormally high levels of traffic destined for your application. Rate Limiting works by counting all traffic that matches the configured Rate Limit rule and performing the configured action for traffic matching that rule which exceeds the configured threshold. For more information, see Rate limiting overview.
Configure Rate Limit Custom Rules
Use the following information to configure Rate Limit Rules for Application Gateway WAFv2.
Scenario One - Create rule to rate-limit traffic by Client IP that exceed the configured threshold, matching all traffic.
- Open an existing Application Gateway WAF Policy
- Select Custom Rules
- Add Custom Rule
- Add Name for the Custom Rule
- Select the Rate limit Rule Type radio button
- Enter a Priority for the rule
- Choose 1 minute for Rate limit duration
- Enter 200 for Rate limit threshold (requests)
- Select Client address for Group rate limit traffic by
- Under Conditions, choose IP address for Match Type
- For Operation, select the Does not contain radio button
- For match condition, under IP address or range, enter 255.255.255.255/32
- Leave action setting to Deny traffic
- Select Add to add the custom rule to the policy
- Select Save to save the configuration and make the custom rule active for the WAF policy.
Scenario Two - Create Rate Limit Custom Rule to match all traffic except for traffic originating from the United States. Traffic will be grouped, counted and rate limited based on the GeoLocation of the Client Source IP address
- Open an existing Application Gateway WAF Policy
- Select Custom Rules
- Add Custom Rule
- Add Name for the Custom Rule
- Select the Rate limit Rule Type radio button
- Enter a Priority for the rule
- Choose 1 minute for Rate limit duration
- Enter 500 for Rate limit threshold (requests)
- Select Geo location for Group rate limit traffic by
- Under Conditions, choose Geo location for Match Type
- In the Match variables section, select RemoteAddr for Match variable
- Select the Is not radio button for operation
- Select United States for Country/Region
- Leave action setting to Deny traffic
- Select Add to add the custom rule to the policy
- Select Save to save the configuration and make the custom rule active for the WAF policy.
Scenario Three - Create Rate Limit Custom Rule matching all traffic for the login page, and using the GroupBy None variable. This will group and count all traffic which matches the rule as one, and apply the action across all traffic matching the rule (/login).
- Open an existing Application Gateway WAF Policy
- Select Custom Rules
- Add Custom Rule
- Add Name for the Custom Rule
- Select the Rate limit Rule Type radio button
- Enter a Priority for the rule
- Choose 1 minute for Rate limit duration
- Enter 100 for Rate limit threshold (requests)
- Select None for Group rate limit traffic by
- Under Conditions, choose String for Match Type
- In the Match variables section, select RequestUri for Match variable
- Select the Is not radio button for operation
- For Operator select contains
- Enter Login page path for match Value. In this example we use /login
- Leave action setting to Deny traffic
- Select Add to add the custom rule to the policy
- Select Save to save the configuration and make the custom rule active for the WAF policy.
Next steps
Tilbakemeldinger
https://aka.ms/ContentUserFeedback.
Kommer snart: Gjennom 2024 faser vi ut GitHub Issues som tilbakemeldingsmekanisme for innhold, og erstatter det med et nytt system for tilbakemeldinger. Hvis du vil ha mer informasjon, kan du se:Send inn og vis tilbakemelding for