There are some best prractice recomended by Microsoft to avoid this problems by enable Detection Mode
and Prevention Mode
upon firewall at first intance. It's required
In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag#configure-waf-rules-optional
So, Resuming here the best practice to tune your waf on azure (https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/best-practices):
- Use WAF policies for managing your Application Gateway WAF.
- WAF Tunning: If you don’t tune your WAF, it might accidentally block requests that should be allowed. Tuning involve creating rule exclusions to reduce false positive detections. a. Use detection mode which logs requests and the actions the WAF would normally take. Consider that detection mode is useful for testing purposes but it provides no protection. It logs the traffic, but it doesn't take any actions such as allow or deny. b. Use prevention mode to ensure the WAF actually blocks requests that it detects as malicious.
- Define your WAF configuration as code defining your rule exclusions and other configurations as code to avoid manual reconfiguration.
Across this process is important to understand WAF Logs to improve yor operation(
Additional helpful documentation
- https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-tuning-for-web-applications/ba-p/3776133
- https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot
Let me know anything else.
Luis,
If the information helped address your question, please Accept the answer.