Skip to content

Use WAF prevention mode#

Security · Application Gateway · Rule · 2020_06 · Critical

Internet exposed Application Gateways should use prevention mode to protect backend resources.

Description#

Application Gateways with Web Application Firewall (WAF) enabled support two modes of operation:

  • Detection - Monitors and logs all threat alerts. In this mode, the WAF doesn't block incoming requests that are potentially malicious.
  • Protection - Blocks potentially malicious attack patterns that the rules detect.

Recommendation#

Consider switching Internet exposed Application Gateways to use prevention mode to protect backend resources.

Examples#

Configure with Azure template#

To deploy Application Gateways that pass this rule:

  • Set the properties.webApplicationFirewallConfiguration.firewallMode property to Prevention.

For example:

Azure Template snippet
{
    "type": "Microsoft.Network/applicationGateways",
    "apiVersion": "2020-11-01",
    "name": "appGw-001",
    "location": "[resourceGroup().location]",
    "properties": {
        "sku": {
            "name": "WAF_v2",
            "tier": "WAF_v2"
        },
        "webApplicationFirewallConfiguration": {
            "enabled": true,
            "firewallMode": "Prevention",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.2",
            "disabledRuleGroups": [],
            "requestBodyCheck": true,
            "maxRequestBodySizeInKb": 128,
            "fileUploadLimitInMb": 100
        }
    }
}

Configure with Bicep#

To deploy Application Gateways that pass this rule:

  • Set the properties.webApplicationFirewallConfiguration.firewallMode property to Prevention.

For example:

Azure Bicep snippet
resource name_resource 'Microsoft.Network/applicationGateways@2019-09-01' = {
  name: 'appGw-001'
  location: location
  properties: {
    sku: {
      name: 'WAF_v2'
      tier: 'WAF_v2'
    }
    webApplicationFirewallConfiguration: {
      enabled: true
      firewallMode: 'Prevention'
      ruleSetType: 'OWASP'
      ruleSetVersion: '3.2'
      disabledRuleGroups: []
      requestBodyCheck: true
      maxRequestBodySizeInKb: 128
      fileUploadLimitInMb: 100
    }
  }
}

Configure with Azure CLI#

Azure CLI snippet
az network application-gateway waf-config set --enabled true --firewall-mode Prevention -n '<name>' -g '<resource_group>'

Configure with Azure PowerShell#

Azure PowerShell snippet
$AppGw = Get-AzApplicationGateway -Name '<name>' -ResourceGroupName '<resource_group>'
Set-AzApplicationGatewayWebApplicationFirewallConfiguration -ApplicationGateway $AppGw -Enabled $True -FirewallMode 'Prevention'

Comments