WebApplicationFirewallPolicy validation failed. Subscriptions without DeveloperPreview flag enabled cannot use Microsoft_DefaultRuleSet_2.2
Attempting to create or update WAF premium policy with DRS 2.2 and I get the error in title. I cannot find what feature to register either in the portal or in powershell/CLI - Nothing references DefaultRuleSet.
Azure Web Application Firewall
WAF not allowing above 128KB file Upload
Hello Team, We have some scenario where we need to send large volume of data from Web UI (Front End) to the backend APIs for processing. Often, due to the nature of the business transaction, the data crossed the default limit set in WAF rule, 128KB. That…
Azure Web Application Firewall
Azure FD Premium w/ WAF Custom Exclusion Rule Not Working
I have an Azure Front Door Premium instance with a WAF in Prevention Mode and Enabled. I created a simple exclusion rule to block traffic coming from my ip address but it is not blocking the traffic. I tried creating a support request but it just kept…
Azure Web Application Firewall
WAF policy custom rule, for each condition, the limitation of match values
WAF policy custom rule, for each condition, the limitation of match values is 10 according to the document, but I can update through AzPowershell the match values to more than 10, will the match values that exceed the limit take effect?
Azure Web Application Firewall
How do I reduce the cost of a WAF to 0 without deleting it?
We are hibernating assets in Azure. How can I reduce the cost of a WAF to 0 without deleting it?
Azure Web Application Firewall
Remove my IP from WAF default' blocklists
Hello, Since almost a month, it has become impossible for me to access a lot of different services that are behind WAF, including Netatmo's (smart home appliance manufacturer) servers. After reaching to Netatmo's customer supports, they told me that my…
Azure Web Application Firewall
Azure Web Application Firewall Bot Manager Rule set 1.1
Can we please have further information on the "Good Bots" detection with the rule set 1.1? Which AI crawlers would be identified as "Good Bots"? The main reason behind this is that we are managing a public facing website and are…
Azure Web Application Firewall
Azure WAF exclude specific content-type header
Hi community, I am trying to make an exclusion for a ruleid which is triggered for [REQUEST_HEADERS:Content-Type:application/scim+json; charset=UTF-8]}. It seems pretty straightforward: Match on RequestHeaderValues contains: scim+json However the rule…
Azure Web Application Firewall
Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement
Why WAF policy settings "Enforce maximum request body limit" setting is not the same as in WAF policy json property: properties.policySettings.requestBodyEnforcement
Azure Web Application Firewall
Azure WAF best practice for specific rules
Hi, Looking for some very specific help regarding Azure Web application rules. Some URI'S are hitting various WAF rules within the OWASP Ruleset (using version 3.2 currently) and I am looking to exclude these from those specific rules (2 in question…
Azure Web Application Firewall
Application gateway WAF can protect all attacks listed>
Hi all, May I confirm if WAF in Application gateway can protect from the attacks listed below? Buffer overflow SSI injection Directory Traversal I cannot find these in the document below. …
Azure Application Gateway
Azure Web Application Firewall
App Service cannot connect to Azure SQL Database despite firewall and VNet rules
We have an Azure App Service that is unable to connect to an Azure SQL Database. The following configuration steps have already been completed, but the issue persists: All App Service outbound IPs are added to the SQL Server Firewall and Virtual Networks…
Azure Web Application Firewall
Application Gateway with WAF performance degradation
We are very often experiencing crashes/performance degradation of our Application Gateway with associated WAF in detection mode. Throughput on the AGW is just about 100 req/s and it doesn't change much throughout the day (IoT devices requests, all across…
Azure Web Application Firewall
Local ISP - New /23 IP Block Restricted by Azure - How to fix?
We are a local ISP in SE Oklahoma. We have a new /23 of ip's that are all experiencing the same blocks from Azure, the one website that we are aware of is activeandfitdirect.com, yet i assume there are others. When accessing the website from any of the…
Azure Web Application Firewall
Rate limiting does not work
We are trying a custom rule: Rate 100 priority 100 hits 1 minute IP address range 0.0.00/255.255.255.255 The application goes rightaway into Forbidden 403 and never comes back
Azure Web Application Firewall
Rate Limit on Azure WAF Frontdoor Premium not working as expected
We have created an Azure Frontdoor Premim Tier with a Web Application Firewall associated with it and we are having some issues with a specific rule we created to apply rate limiting. The rule is looking for a specific URL and specifies a limit of 2 http…
Azure Front Door
Azure Web Application Firewall
Question on TLS 1.2 Enforcement Deadline (31-Aug) and Azure WAF Upgrade
Hi Community, We are currently preparing to upgrade our Azure Web Application Firewall (WAF) from V1 to V2 and transition all connections to TLS 1.2 in line with Microsoft’s enforcement deadline of 31 August. I would like to clarify a few points: What…
Azure Web Application Firewall
Clarification on Addition and Updates of Rules in Azure WAF Managed Rule Sets (OWASP CRS) and Impact on Exclusions
Hello Azure Support Team, We have some questions regarding the management and update process of Azure Web Application Firewall (WAF) managed rule sets, specifically around the OWASP Core Rule Set (CRS) versions: How are new rules added to the managed…
Azure Web Application Firewall
One of my home IP addresses can't access sites hosted in Azure
Hi, I have a slightly odd issue - traffic coming from my default home IP address (82.68.8.222) seems to be being dropped by some websites hosted on Azure (Microsoft learn, Nationwide Building Society). If I masquerade my laptops as coming from a…
Azure Web Application Firewall
How can I find the original client IP address of a log entry in my WAF?
When I go into the logs for our Application Gateway and run a KQL query to see what items were caught (based on OWASP rules), I can see that the request logs have a column clientIp_s that shows the IP address of the requestee. However, the IP addresses I…