WAF with Application Gateway in Azure - Step-by-Step Execution

Process Flow - WAF with Application Gateway

Client sends HTTP request

↓

Application Gateway receives request

↓

WAF inspects request

↓

Threat?

↓

Block/Alert

↓

Backend processes request

↓

Response sent back to Client

The Application Gateway receives client requests, the WAF inspects them for threats, blocks or alerts if threats are found, otherwise forwards to backend servers.

Execution Sample

Azure

1. Client sends HTTP request
2. Application Gateway with WAF inspects request
3. If threat detected, block request
4. Else, forward request to backend
5. Backend sends response

This flow shows how a request passes through the Application Gateway with WAF inspecting and deciding to block or forward.

Process Table

Step	Action	Request Content	WAF Decision	Result
1	Receive request	Normal HTTP GET /home	No threat detected	Forward to backend
2	Backend processes	Request forwarded	N/A	Response generated
3	Send response	Response from backend	N/A	Response sent to client
4	Receive request	HTTP POST with SQL injection	Threat detected	Request blocked
5	Block request	Blocked by WAF	N/A	Client receives block message

💡 Execution stops when request is either forwarded to backend or blocked by WAF.

Status Tracker

Variable	Start	After Step 1	After Step 4	Final
Request Content	None	Normal HTTP GET /home	HTTP POST with SQL injection	Blocked or forwarded
WAF Decision	None	No threat detected	Threat detected	Block or forward
Result	None	Forward to backend	Request blocked	Response sent or block message

Key Moments - 2 Insights

Why does the WAF block some requests but not others?

The WAF inspects the request content for threats like SQL injection. If it detects a threat (see execution_table step 4), it blocks the request; otherwise, it forwards it (step 1).

What happens to the request after the WAF forwards it?

After forwarding, the backend processes the request and generates a response (execution_table step 2), which is then sent back to the client (step 3).

Visual Quiz - 3 Questions

Look at the execution table, what is the WAF decision at step 1?

A Threat detected

B Request blocked

C No threat detected

D Response generated

💡 Hint

Check the 'WAF Decision' column for step 1 in the execution_table.

At which step does the WAF block the request?

A Step 3

B Step 4

C Step 2

D Step 1

💡 Hint

Look for 'Threat detected' and 'Request blocked' in the execution_table rows.

If the request content changes to a safe GET request, how does the WAF decision change?

A It forwards the request

B It blocks the request

C It alerts but forwards

D It ignores the request

💡 Hint

Refer to the WAF decision for normal HTTP GET in the execution_table step 1.

Concept Snapshot

WAF with Application Gateway inspects incoming web requests.
If a threat is detected, it blocks or alerts.
Safe requests are forwarded to backend servers.
This protects web apps from attacks like SQL injection.
WAF runs as part of the Application Gateway service.

Full Transcript

This visual execution shows how an Application Gateway with WAF works. When a client sends a web request, the Application Gateway receives it. The WAF inspects the request content for threats. If it finds a threat, like SQL injection, it blocks the request and sends a block message to the client. If no threat is found, the request is forwarded to the backend server. The backend processes the request and sends a response back through the gateway to the client. This protects web applications by filtering harmful requests before they reach the backend.

Practice

1. What is the main purpose of enabling WAF (Web Application Firewall) on an Azure Application Gateway?

easy

A. To provide a database backup solution

B. To protect web applications from common web attacks like SQL injection and cross-site scripting

C. To increase the speed of the web application by caching content

D. To monitor network traffic at the virtual network level

Solution

1. Step 1: Understand WAF's role

   WAF is designed to protect web apps by filtering and monitoring HTTP traffic to block common attacks.

2. Step 2: Compare options

   Only To protect web applications from common web attacks like SQL injection and cross-site scripting describes protection from web attacks, which is the core function of WAF.

3. Final Answer:

   To protect web applications from common web attacks like SQL injection and cross-site scripting -> Option B

4. Quick Check:

   WAF protects web apps = C [OK]

Hint: WAF blocks web attacks, not speeds or backups [OK]

Common Mistakes:

• Confusing WAF with caching or backup services
• Thinking WAF monitors network traffic broadly
• Assuming WAF improves app speed

2. Which of the following is the correct way to enable WAF on an Azure Application Gateway using ARM template syntax?

easy

A. "sku": { "name": "WAF_v2" }, "wafConfiguration": { "enabled": true, "firewallMode": "Prevention" }

B. "sku": { "name": "Standard_v2" }, "wafConfiguration": { "enabled": true }

C. "sku": { "name": "Basic" }, "wafConfiguration": { "enabled": false }

D. "sku": { "name": "WAF_v1" }, "wafConfiguration": { "enabled": false, "firewallMode": "Detection" }

Solution

1. Step 1: Identify correct SKU for WAF

   WAF requires SKU like "WAF_v2" or "WAF_v1"; Standard_v2 or Basic do not enable WAF.

2. Step 2: Check WAF configuration

   WAF must be enabled with "enabled": true and a valid firewallMode like "Prevention" or "Detection".

3. Final Answer:

   "sku": { "name": "WAF_v2" }, "wafConfiguration": { "enabled": true, "firewallMode": "Prevention" } -> Option A

4. Quick Check:

   WAF SKU + enabled true + mode = A [OK]

Hint: WAF needs WAF SKU and enabled true [OK]

Common Mistakes:

• Using Standard or Basic SKU without WAF
• Setting enabled to false when enabling WAF
• Omitting firewallMode or using invalid values

3. Given this snippet of ARM template for Application Gateway WAF configuration:

{
  "sku": { "name": "WAF_v2" },
  "wafConfiguration": {
    "enabled": true,
    "firewallMode": "Detection"
  }
}

What will be the behavior of the Application Gateway regarding detected threats?

medium

A. It will log detected threats but allow traffic to pass through

B. It will block detected threats and return an error to clients

C. It will ignore detected threats and not log them

D. It will shut down the Application Gateway on threat detection

Solution

1. Step 1: Understand firewallMode 'Detection'

   Detection mode means WAF monitors and logs threats but does not block traffic.

2. Step 2: Compare options with behavior

   Only It will log detected threats but allow traffic to pass through matches detection mode behavior: logging threats but allowing traffic.

3. Final Answer:

   It will log detected threats but allow traffic to pass through -> Option A

4. Quick Check:

   Detection mode = log only, no block = B [OK]

Hint: Detection mode logs but does not block [OK]

Common Mistakes:

• Confusing Detection with Prevention mode
• Assuming threats are blocked in Detection mode
• Thinking Application Gateway shuts down on threats

4. You configured WAF on Application Gateway with this snippet:

{
  "sku": { "name": "WAF_v2" },
  "wafConfiguration": {
    "enabled": true,
    "firewallMode": "Prevention"
  }
}

But the WAF is not blocking malicious requests. What is the most likely cause?

medium

A. The Application Gateway is missing a listener configuration

B. The SKU name "WAF_v2" does not support prevention mode

C. The WAF policy is not associated with the Application Gateway

D. The firewallMode should be set to Detection to block requests

Solution

1. Step 1: Check WAF policy association

   Even if WAF is enabled, it must have a WAF policy linked to enforce rules and block threats.

2. Step 2: Validate other options

   Listener is required but unrelated to blocking; prevention mode blocks; WAF_v2 supports prevention mode.

3. Final Answer:

   The WAF policy is not associated with the Application Gateway -> Option C

4. Quick Check:

   WAF policy association needed to block = D [OK]

Hint: WAF needs policy linked to block threats [OK]

Common Mistakes:

• Confusing detection and prevention modes
• Forgetting to associate WAF policy
• Assuming SKU limits prevention mode

5. You want to protect your web app with Azure Application Gateway WAF in prevention mode but also need to monitor false positives before blocking. What is the best approach to achieve this?

hard

A. Use Basic SKU Application Gateway with WAF enabled

B. Enable WAF in prevention mode immediately and block all detected threats

C. Disable WAF and rely on network security groups for protection

D. Enable WAF in detection mode first, review logs, then switch to prevention mode

Solution

1. Step 1: Understand prevention vs detection modes

   Prevention mode blocks threats immediately; detection mode only logs them for review.

2. Step 2: Plan safe deployment

   Start with detection mode to identify false positives, then switch to prevention to block real threats safely.

3. Final Answer:

   Enable WAF in detection mode first, review logs, then switch to prevention mode -> Option D

4. Quick Check:

   Detect first, then prevent = A [OK]

Hint: Detect first, then switch to prevention mode [OK]

Common Mistakes:

• Blocking immediately without monitoring false positives
• Disabling WAF and relying on unrelated protections
• Using Basic SKU which does not support WAF