Web Application Firewall (WAF) Policies

Azure Web Application Firewall (WAF) is a cloud-native, centralized protection service that filters and monitors HTTP/HTTPS traffic to web applications. It defends against the OWASP Top 10 web vulnerabilities, including SQL injection, cross-site scripting (XSS), and remote file inclusion. Unlike a network firewall (which operates at Layers 3-4), WAF operates at Layer 7 (application layer), inspecting the content of HTTP requests and responses. It exists because traditional network security cannot detect malicious payloads hidden in HTTP headers, cookies, or request bodies.

WAF policies are applied at the edge (Azure Front Door) or at the regional gateway (Application Gateway). When a request arrives:

Using Azure CLI to create a WAF policy for Application Gateway:

az network application-gateway waf-policy create \
  --name MyWAFPolicy \
  --resource-group MyRG \
  --location eastus \
  --type OWASP \
  --version 3.2

To enable Prevention mode:

az network application-gateway waf-policy update \
  --name MyWAFPolicy \
  --resource-group MyRG \
  --state Enabled \
  --mode Prevention

To add a custom rule blocking requests from a specific IP:

az network application-gateway waf-policy custom-rule create \
  --policy-name MyWAFPolicy \
  --resource-group MyRG \
  --name BlockBadIP \
  --priority 100 \
  --rule-type MatchRule \
  --action Block \
  --match-condition "IPAddress 192.168.1.0/24"

Verification:

az network application-gateway waf-policy show \
  --name MyWAFPolicy \
  --resource-group MyRG

For Azure Front Door, use:

az network front-door waf-policy create \
  --name MyFrontDoorWAF \
  --resource-group MyRG \
  --sku Premium_AzureFrontDoor \
  --mode Prevention

Rules are evaluated in this order: 1. Custom rules (by priority, ascending) 2. Managed rule sets (by priority within the set) 3. Bot protection rules (if enabled)

You can define exclusions to skip certain rules for specific request attributes (e.g., exclude a rule that flags 'SELECT' in the body for a specific URI). Exclusions are applied before rule evaluation.

WAF adds latency (typically 1-5 ms per request). In high-throughput scenarios, ensure the Application Gateway or Front Door SKU is appropriately sized. For Application Gateway, WAF_v2 supports autoscaling. For Front Door, WAF is always at the edge with minimal overhead.

A large e-commerce company uses Azure Front Door with WAF to protect its web application from SQL injection and DDoS attacks. The platform serves users worldwide, so Front Door provides global load balancing and SSL offloading. The WAF policy is set to Prevention mode with the DefaultRuleSet 2.1. They also enable the Bot Manager rule set to allow search engine bots but block known bad bots. Rate limiting is configured to 500 requests per minute per IP to mitigate brute-force login attacks. The security team monitors WAF logs in Log Analytics, setting alerts for anomaly score spikes. A common misconfiguration is forgetting to exclude the login endpoint from rate limiting, which blocks legitimate users. The solution is to create a custom rule with higher priority to allow traffic to /login with a higher rate limit.

A company hosts an HR application on Azure Application Gateway in a single region. They enable WAF_v2 in Prevention mode. They use geofiltering custom rules to block traffic from countries where the company has no employees. They also create custom rules to block requests with suspicious user-agent strings. The application uses WebSockets for real-time notifications, and WAF supports that natively. Performance is a concern: each request adds ~2 ms latency, which is acceptable. The team uses Azure Policy to enforce that all Application Gateways have WAF enabled. A common issue is false positives from the managed rules (e.g., blocking a legitimate search feature that uses SQL-like syntax). They resolve this by creating exclusions for specific rules on the search endpoint.