Upgrade your legacy WAF configuration to WAF policies

jazzspeed 20

I have received "high impact" Advisor recommendations from azure to "Upgrade your legacy WAF configuration to WAF policies".

I have tried to follow as per suggested in the following URL:

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/upgrade-ag-waf-policy?tabs=portal

As of now, the app gateway is already in tier WAF V2.

However, when I follow In step-2 of "Upgrade WAF v2 with legacy WAF configuration to WAF policy" (from the above URL), i cannot seems to find where actually the option to "Upgrade from WAF configuration":

"Select Web Application Firewall from the left menu, then select Upgrade from WAF configuration"

Anyone know kindly share how this can be done please.

Thank you,

KapilAnanth-MSFT 37,646 Reputation points Microsoft Employee

2024-05-08T10:54:42.29+00:00
@jazzspeed ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to Upgrade WAF v2 with legacy WAF configuration to WAF policy.

As mentioned by Sina Salam , you can use the Portal or Powershell or Firewall Manager.

If the portal is not displaying the upgrade option,

Can you please try using the Firewall Manager?

Cheers,

Kapil
jazzspeed 20 Reputation points

2024-05-08T12:04:23.71+00:00

Dear @Sina Salam and @KapilAnanth-MSFT

Thank you for your suggestions.

I just looked this issue from Firewall Manager and follow the instruction as per Microsoft link: https://learn.microsoft.com/en-us/azure/web-application-firewall/shared/manage-policies.

But there is no indicator that the policy need to be upgraded in the WAF Policy column.

So, I'm not sure why no consistency between the alert vs Firewall Manager.

May be the only way is to try using PowerShell as suggested by @Sina Salam ?

Thank you & Best regards,
KapilAnanth-MSFT 37,646 Reputation points Microsoft Employee

2024-05-09T04:46:22.8+00:00
@jazzspeed ,

Since we can no longer create an App Gateway with legacy policy, I am unable to repo your environment.

As an alternative,

you can try using the preview portal : https://preview.portal.azure.com/

or if you are already using a preview portal, try using a regular portal : https://portal.azure.com/?preview=no

Make sure you have owner or contributor permissions on the App gateway

Make sure you have permissions to create resources in the Azure subscription.

Should the issue still persist, I believe you have to rely on Powershell only.

Please let us know how this goes.

Cheers,

Kapil

Accepted answer

Sina Salam 4,796 Reputation points

2024-05-06T10:27:43.64+00:00

Hi,

There are three options in the link you provided. Likewise, there are minimum of two ways to solve a problem in any system.

If you could not find what you're looking for via the Azure Portal, you can navigate through Azure Firewall Manager to Configure WAF policies using Azure Firewall Manager. Also, the third section described how you can do the same using PowerShell.

Goodluck.
Please sign in to rate this answer.
jazzspeed 20 Reputation points

2024-05-13T01:04:41.06+00:00

Dear All,

I finally manged to solve this issue by using PowerShell as initially suggested by @Sina Salam .

It is basically executing the script as provided by Microsoft in the following URL:

https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/migrate-policy

However, the process of executing the script not as smooth as I thought It would :-)

There was an error in 1 line of the script. It was at the time the script trying to get "$rg" (resourceGroup) and somehow the paramater was supplied with wrong value.

So, I read thru the whole script and tried to understand what the whole script were trying to do and then re-run the script line by line again ("Main" function only).

Each line I executed, I always verified to check if the variable was updated with the correct value.

The line where the error happened, I did modify with the correct parameter and I was able to execute it.

Once all the lines executed, I went back to WAF portal to re-configured again (enable it, policy mode, etc).

Last but not least, I checked the alert again, and re-run the query provided from the alert. Finally, the item is no longer appear in the query result!

And verified my web app still working as per normal!

Thank you & Best regards,
Sign in to comment

Share via

Upgrade your legacy WAF configuration to WAF policies

0 additional answers