Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,001 questions
Hi Mohsen Akhavan,
Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are facing issues with the Patch Requests on Application Gateway WAF in detection mode.
Kindly note Azure Application Gateway by default does not limit or block "Patch" requests in detection mode. However, there are a few things that could potentially cause the issue you're experiencing:
Request Size Limits: Azure Application Gateway's Web Application Firewall allows you to configure request size limits,
If you patch request exceeded these limits, your application gateway could result in a 400 Bad Request Error.
You may refer the application gateway diagnostics logs to know if one of these limits are causing the Bad Request Error. You may use the below query under the Logs tab of application Gateway on Azure Portal
AzureDiagnostics | where Category == "ApplicationGatewayAccessLog" | sort by TimeGenerated
Once you know the policy definition limits which is causing the issue, you may follow the further steps to modify it.
Refer the below link to know these limits
The request body size field and the file upload size limit are both configurable within the Web Application Firewall. The maximum request body size field is specified in kilobytes and controls overall request size limit excluding any file uploads. The file upload limit field is specified in megabytes, and it governs the maximum allowed file upload size.
To know about your current policy limits you may use the below PowerShell command.
$plcy = Get-AzApplicationGatewayFirewallPolicy -Name <policy-name> -ResourceGroupName <resourcegroup-name>
$plcy.PolicySettings
You may modify the Request size limits using the below PowerShell commands, for example to set RequestBodyEnforcement to false. This setting controls if your Web Application Firewall will enforce a max size limit on request bodies; when turned off it will not reject any requests for being too large.
$plcy = Get-AzApplicationGatewayFirewallPolicy -Name <policy-name> -ResourceGroupName <resourcegroup-name> $plcy.PolicySettings.RequestBodyEnforcement=false Set-AzApplicationGatewayFirewallPolicy -InputObject $plcy
Once you identify which settings is causing issue for your patch requests using the Application Gateway diagnostic logs you may modify the same setting. Refer the below page for same -
If the below answer addressed your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Thanks,
Ujjawal Tyagi