Application Gateway WAF v2 only allow specfic IP Traffic

William Tang 0 Reputation points
2024-05-09T14:14:58.09+00:00

Hi Team,

I have setup a custom rule in WAF previously to only allow few IP to access AGW. However the same rule doesn't works today. Current outcome by setting different combination like either Blocking or Allowing ALL traffic, instead of specific IP.

customrule:

"IP Address"

"Does Not Contain"

"Deny Traffic"

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,001 questions
Azure Web Application Firewall
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 24,231 Reputation points Microsoft Employee
    2024-05-10T03:00:16.28+00:00

    @William Tang

    Thank you for reaching out.

    As the old custom rule is no longer working this may happen when a custom rule with higher priority is allowing the traffic to pass through. As documented here

    "Custom rules allow you to create your own rules that are evaluated for each request that passes through the WAF. These rules hold a higher priority than the rest of the rules in the managed rule sets. The custom rules contain a rule name, rule priority, and an array of matching conditions. If these conditions are met, an action is taken (to allow, block, or log). If a custom rule is triggered, and an allow or block action is taken, no further custom or managed rules are evaluated."

    To test this theory, you can enable diagnostic logging for App Gateway and check the firewall log to see if any particular rule is matching the traffic.

    Thank you!

    0 comments