Application Gateway WAF policy and geo location mess

Ori Gil 6 Reputation points
2021-08-25T12:45:40.167+00:00

What a mess...

So I wanted to add an application gateway with WAF in front of my internal load balancer so it will be accessible from the internet via the app gw public IP and protected with WAF and accessible only from Israel via a geo location rule.

I created a test lab with an ILB (+3 VM backend pool), I created an application gateway and a WAF policy which I associated with the app gw. It is working just fine.
Now I added the geo location rule to block any traffic not coming from Israel.

126385-agwwaf-customrule.png

It doesn't work, it blocks all traffic from any IP address, I checked from 3 different addresses in Israel and 2 different location abroad via VPN.
Now on one hand this page gives and example of how to create the above rule with match variable RequestUri and Operator GeoMatch. However, this page says to use match variable RemoteAddr with operator GeoMatch which is not possible.

Now I wanted to start over and disassociate the WAF policy from the gateway and apparently it is impossible. I have to create a new policy and associate it to the app gw, I cannot remove the policy completely.

How do I fix that geo location rule to make it work? So much time wasted on this already :(

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
956 questions
Azure Web Application Firewall
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ori Gil 6 Reputation points
    2021-09-01T13:06:05.057+00:00

    So yes, I tried via PowerShell and apparently that did the trick.
    Via the portal the rule looks like it has no match variable, but it works...

    1 person found this answer helpful.
  2. SaiKishor-MSFT 17,186 Reputation points
    2021-08-31T12:19:18.637+00:00

    @Ori Gil Thank you for reaching out to Microsoft Q&A.

    I understand that the WAF Custom rule is not working for you. In the meanwhile, have you tried adding a rule using Powershell and see if that works?

    Here is an example rule added via Powershell for Geo-match:

    $variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RemoteAddr

    $condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable
    -Operator GeoMatch -MatchValue "US"
    -Transform Lowercase `
    -NegationCondition $False

    $rule = New-AzApplicationGatewayFirewallCustomRule -Name "allowUS"
    -Priority 2 -RuleType MatchRule
    -MatchCondition $condition `
    -Action Allow

    Please let me know, Thank you!

    0 comments