more than 12K or 18K URL under block for particular rule like SQLI or XSS how can we make false positive by custom or exculsion
Result of latest scan on application associated with AFD-WAF, we observed for reach rule blocked under SQLI and XSS are more than 12 K URLs, and all are under blockage because of just one or more char like ",: etc. which are must required part of…
![](https://techprofile.blob.core.windows.net/images/lvNaBJBqh0eurOu4q2bQSQ.png?8DA4E8)
Azure Application Gateway WAF blocking some requests with OpenID Connect nonce cookies
The default rules of Azure Web Application firewall sometimes block requests containing a cookie set by Microsoft.AspNetCore.Authentication.OpenIdConnect During challenge redirect the AuthenticationHandler sets a cookie named:…
Most cost effective way to secure 2 VMs running a webserver
Hey, I am conducting a project where I will have 2 VMs for redundancy, they will have the same configuration. The VMs will essentially be running docker, portainer and OpenCTI. What is the best way to secure these, there seems to be so many…
Trying to update an Azure Firewall policy
I'm trying to update the firewallpolicy by adding an new ipadres to block with a powershell script, but getting this error: "Specified api-version '2022-01-01' does not meet the minimum required api-version 2022-07-01 to enforce rate limiting on…
It is possible to integrate a multi-region high availability design into the diagram shown below, using the active-active strategy at capacity and automatic scaling
It is possible to integrate a multi-region high availability design into the diagram shown below, using the active-active strategy at capacity and automatic scaling.
![](https://techprofile.blob.core.windows.net/images/lvNaBJBqh0eurOu4q2bQSQ.png?8DA4E8)
Implementing Azure Firewall and Application Gateway in parallel
We have an existing Azure Application Gateway(AGW subnet) with WAF policies defined in our main VNET where host(host subnet) and proxy(proxy subnet) machines also reside. We have another VNET for SFTP servers(sftp subnet). Now we are implementing Azure…
Application Gateway needs Load Balancer?
Our infrastructure for our web application needs to be compliant with the following security requirement. For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against…
![](https://techprofile.blob.core.windows.net/images/lvNaBJBqh0eurOu4q2bQSQ.png?8DA4E8)
Client-side desync attacks
I was going through the documentation but i did not see any direct reference. Does Azure waf rulebase prevents from Client-side desync attacks (CSD). If yes which owasp ruleset and ruleID and rulegroup?
Setting up azure firewall premium policies
I am trying to implement Azure firewall premium for our existing infrastructure using terraform to enable the IDPS feature. But the main issue I am facing is the azure firewall policies(Dnat rules) which I created are not working or not getting attached…
WAF for Azure Application Gateway - Which ruleset is better -DRS 2.1 or OWASP 3.2
I am using a WAF to secure Application Gateway. Azure portal provide option to choose either of two default rule sets: Microsoft Default Rule Set 2.1 OWASP 3.2 Although documentation says that both rule sets are applied by default in detection mode.…
![](https://techprofile.blob.core.windows.net/images/IGYZVnS2WkC08pT7wt4LXw.png?8D903B)
How do I customize a unique response schema for 4xx and 5xx?
I'm working on the Application Gateway and tried Custom error pages for response customized. My purpose is to return a same json schema for different codes(4xx/5xx) which may due to WAF rules blocked request so I write a json data into the *.html. { …
How to have common rule enable for all Azure functions with ALLOW access
Azure functions are exposed to upstream through Azure Front Door. We will enable WAF at Front door to allow the access from all other upstream or other valid data center IP ranges including VPN. We need to restrict the access to the Azure functions only…
![](https://techprofile.blob.core.windows.net/images/j_hATN6lWUGQqy8lwG64fA.png?8D869F)
WAF Front Door as an IDS/IDP system
Can Web Application Firewall on Front Door function as an Intrusion Detection/Prevention System? The IDPS systems I've seen for Azure don't look like they will work with Front Door since it is an Edge system. Am I correct in that? Thanks, Eric…
WAF in AZURE Environment
Hi, I am currently exploring the implementation of Web Application Firewall (WAF) in my existing Azure VM setup and would appreciate your guidance on the following aspects. To provide you with a brief overview of my current configuration, I have a…
![](https://techprofile.blob.core.windows.net/images/lvNaBJBqh0eurOu4q2bQSQ.png?8DA4E8)
IIS Web Application stops connecting to sftp server after being put it behing Azure Web Application Firewall
Hi Community, Happy 2024! I have a Windows Machine with IIS Web Application which makes conections to SFTP Server from some customers. We implemented Azure WAF and put this application behind it. We also dettached the public ip address from the server…
How to configure web deploy when a .net application is behind azure waf?
Hi everyone, Before implementing Azure Waf, we used to open an inboud port 8172 in a NSG in our Windows Virtual Machine running IIS 10.o, to deploy our changes to our .net applications. After implementing WAF, I can´t do this anymore. Since my…
Azure application gateway web application firewall configuration doesn't show the new rule id updated for cve-2023-50164
Hello, Based on the update from Azure regarding the waf ruleset update for cve-2023-50164 (https://azure.microsoft.com/en-in/updates/general-availability-security-update-for-application-gateway-waf-cve202350164/), the rule id is not reflecting in my…
XSS Filter - Category 3: Attribute Vector
This error is coming in azure waf logs so it is false promise or correct promise how to identify. How to resolve this issue any idea
How to fix Failed to parse request body, Multipart request body failed strict validation
This error is coming in azure waf logs so it is false promise or correct promise how to identify. How to resolve this issue any idea
![](https://techprofile.blob.core.windows.net/images/Nd_pi7-IHkuDC3BVgl0RFQ.png?8D81F2)
Request Header Cookies Exclusion Causes 403
We need to exclude request cookies from evaluation for a number of OWASP rules as cookies often randomly generate threats that are false positives for legitimate users. There is no clear documentation on how to exclude REQUEST_COOKIES, so we tried adding…
![](https://techprofile.blob.core.windows.net/images/Nd_pi7-IHkuDC3BVgl0RFQ.png?8D81F2)