Is Application gateway with WAF send outbound traffic to internet?

Hi @GitaraniSharma-MSFT

Thank you for your quick response.

After reviewing the documentation, it appears that the setup of an Application Gateway with Web Application Firewall (WAF) lacks the inherent capability to handle outbound traffic to the internet. Instead, all outbound traffic is expected to be routed through the Azure Firewall.

Hence, it can be concluded that in this configuration, an asymmetric routing scenario arises, where incoming traffic is processed by the Application Gateway and WAF, while outbound traffic follows a separate path via the Azure Firewall to reach the internet.

Thank You

Hello @Omkar Pasalkar ,

Azure Application gateway is a web traffic (OSI layer 7) load balancer that enables you to manage traffic to your web applications. It doesn't have the functionality to handle Outbound traffic.

Azure Firewall and Azure Application Gateway use different technologies, and they support securitization of different flows:

So, no matter where you deploy the Azure Application gateway (in parallel or before or after Azure Firewall), it will only help you with the inbound traffic. Azure Firewall is used in conjunction to this setup for added inspection of inbound traffic and to handle the outbound traffic flows.

The asymmetric routing scenario is already explained in the below doc where Azure Firewall is used with a setup of Public load balancer and internal load balancer:

https://video2.skills-academy.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#asymmetric-routing

In case of Application gateway, traffic asymmetry isn't a concern.

More info: https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha#using-l7-load-balancers

For workloads running on an AKS cluster, it's best to use the parallel design option of Application Gateway WAF and Azure Firewall to protect an AKS cluster. The Application Gateway with WAF processes inbound connection requests to web applications in the cluster. Azure Firewall permits only explicitly allowed outbound connections.

Please refer the below doc which shows a baseline architecture for an Azure Kubernetes Service (AKS) cluster for an example of the parallel design option.

https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/containers/aks/baseline-aks

As explained in this doc, if you use a public load balancer as your public point for ingress traffic and egress through Azure Firewall using UDRs, you might see an asymmetric routing situation. This architecture uses internal load balancers in a dedicated ingress subnet behind the Application Gateway. This design choice not only enhances security, but also eliminates asymmetric routing concerns.

Refer: https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/containers/aks/baseline-aks#egress-traffic-flow

Regards,

Gita