the Azure waf blocks the launch of an .exe which I need

Morsi MASMOUDI 46

Hello,

I have a very special setup, so I hope you can help me :)

I have set up an Azure Front Door to use WAF, and I have added my Windows virtual machine behind the firewall. It's important to understand that my web application uses a special web server that encapsulates a desktop-type application within a browser.

So when I launch my URL in the browser, an executable (.exe) runs on the VM.

Locally (127.0.0.1:999), my application works fine, and I can see in the taskbar that my .exe launches and runs, allowing me to access the application in the browser.

Now, if I access my web application (the encapsulated desktop application) from outside, going through the WAF, the .exe doesn't launch, and I experience an infinite loading loop in my browser.

My question is, is it possible to allow the launch of a .exe on the VM through the WAF?

I cant find something on exclusion list.

Thank you for your assistance.

GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-10-27T10:35:32.84+00:00

Hello @Morsi MASMOUDI ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that Azure WAF is blocking the launch of an .exe file on your backend VM.

Could you please share the Azure WAF log that is logged for this block?

Regards,

Gita
GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-10-30T12:37:44.19+00:00

@Morsi MASMOUDI , could you please share an update on this post and share the requested detail for further discussion?
Morsi MASMOUDI 46 Reputation points

2023-10-30T14:24:22.7933333+00:00

Hi @GitaraniSharma-MSFT and thank you for your comment.

Your analysis is correct.

For the log, i noticed that there is a "log" section under "Monitoring," but when I connect, I need to execute queries. If I choose any query, I receive an error message.

Can you assist me in providing the correct log?
Morsi MASMOUDI 46 Reputation points

2023-10-30T15:21:29.37+00:00

Just for your information, when I remove the columns causing errors, I no longer encounter any errors. However, do I need to execute a specific query to obtain a log related to my issue?
GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-10-31T11:25:19.5833333+00:00
@Morsi MASMOUDI , if you are using Azure Front Door WAF, then you should have enabled diagnostics on your Azure Front Door to send the logs to Log analytics first.

https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor?pivots=front-door-standard-premium#logs-and-diagnostics

After you enable diagnostics, you can run the below query to pull the WAF logs:

AzureDiagnostics | where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog" | where action_s == "Block"

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor?pivots=front-door-standard-premium#waf-logs

The query will be a little different depending on your Azure Front Door SKU.

If you are using Azure Front Door Standard/Premium SKU, you can use the above query.

If you are using Azure Front Door Classic SKU, then you can use the below query:

AzureDiagnostics | where ResourceType == "FRONTDOORS" and Category == "FrontdoorWebApplicationFirewallLog" | where action_s == "Block"

Regards,

Gita
Morsi MASMOUDI 46 Reputation points

2023-10-31T13:24:18.6633333+00:00

Thanks @GitaraniSharma-MSFT for your support.

This is the result of the log query, i think it'a an issue with "Microsoft_DefaultRuleSet-2.1-BLOCKING-EVALUATION-949110" :
GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-10-31T13:45:09.0766667+00:00

Thank you for the update, @Morsi MASMOUDI .

No, this is not the rule which shows the actual file or extension block.

Rule 949110 is a generic rule which is logged for anomaly scoring.

You can find this documented in the below doc:

https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs?tabs=drs21#drs99001-21

When you review your WAF's logs, you might see rule ID 949110. The description of the rule might include Inbound Anomaly Score Exceeded. This rule indicates that the total anomaly score for the request exceeded the maximum allowable score. For more information, see Anomaly scoring. When you tune your WAF policies, you need to investigate the other rules that were triggered by the request so that you can adjust your WAF's configuration. For more information, see Tuning Azure Web Application Firewall for Azure Front Door.

Please check your WAF logs again and maybe try to filter it using the request URI and time to find the exact log which blocked the launch of the .exe file.

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning?pivots=front-door-standard-premium#understand-waf-logs

Regards,

Gita
GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-11-06T15:04:26.0433333+00:00

@Morsi MASMOUDI , could you please provide an update on this post?
Morsi MASMOUDI 46 Reputation points

2023-11-06T17:04:28.61+00:00

I apologize, but I understood the issue I had. My application uses a WebSocket, and the WAF (Web Application Firewall) on the Front Door does not support WebSockets. I will change the WAF to an Application Gateway.

1 answer

GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-11-07T16:25:41.37+00:00

Hello @Morsi MASMOUDI ,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.

Issue:

Your Azure Front Door WAF was blocking the launch of an .exe file on your backend VM.

Solution:

You found that your application uses WebSocket, however Azure Front Door does not support WebSocket protocol.

Refer: https://video2.skills-academy.com/en-us/azure/frontdoor/front-door-faq#what-protocols-does-azure-front-door-support-

So, you will change to Application Gateway WAF to fix your issue.

Refer: https://video2.skills-academy.com/en-us/azure/application-gateway/application-gateway-websocket

If you wish you may upvote the feedback in the below forum requesting WebSocket support in Azure Front Door. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

https://feedback.azure.com/d365community/idea/c8b1d257-8a26-ec11-b6e6-000d3a4f0789

If you have any other questions or are still running into more issues, please let me know.

Thank you again for your time and patience throughout this issue.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

the Azure waf blocks the launch of an .exe which I need

1 answer