Share via

WAF in AZURE Environment

Muhd Azhar 45 Reputation points
2024-01-18T01:40:20.22+00:00

Hi,

I am currently exploring the implementation of Web Application Firewall (WAF) in my existing Azure VM setup and would appreciate your guidance on the following aspects.

To provide you with a brief overview of my current configuration, I have a three-layered VM setup: WEB VM: This VM serves as the public-facing component, wherein I have established a reverse proxy to direct HTTPS connections from the internet to multiple APP VMs. APP VM: Dedicated to hosting my application. DB VM: Primarily focused on housing the SQL installation.

All VMs are interconnected within the same Virtual Network, each assigned different subnets, and are managed by separate Network Security Groups (NSG). In my research on WAF, I have come across deployment options such as Application Gateway, Azure Front Door, and Azure Content Delivery Network (CDN). My inclination is towards utilizing Application Gateway due to its compatibility with my current setup. However, I am seeking clarification on whether deploying Application Gateway duplicates the functionality of my existing reverse proxy on the WEB VM. Kindly correct me if my understanding is inaccurate. Given the specifics of my setup, I would appreciate your expert advice on whether proceeding with Application Gateway aligns with best practices. Thank you for your time and expertise. I look forward to your valuable insights.

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
982 questions
Azure Web Application Firewall

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dr. S. Gomathi 650 Reputation points MVP
    2024-01-18T03:00:11.41+00:00

    Hi Muhd Azhar,

    Deploying a Web Application Firewall (WAF) in Azure is an excellent way to enhance the security posture of your environment. Azure provides several options for WAF deployment, including Azure Application Gateway, Azure Front Door, and Azure CDN. Each option serves different use cases and offers WAF capabilities.

    Given your current three-tier architecture with separate VMs for the web, application, and database layers, using Azure Application Gateway as a WAF makes a lot of sense. Here's how it would fit into your architecture: Azure Application Gateway:

    • Acts as a load balancer offering Layer 7 load balancing capabilities, SSL termination, and WAF features.
    • Can be integrated into your setup by placing it in front of your WEB VM.
    • It would indeed replicate some functionalities of your reverse proxy since Application Gateway itself can act as a reverse proxy, handling incoming HTTPS connections and routing them to your APP VMs.
    • Offers a WAF that can be configured to protect your web applications from common web vulnerabilities and exploits as defined by OWASP rules.

    Concerning the reverse proxy on your WEB VM:

    • If you introduce Application Gateway with WAF, you may not need to maintain a reverse proxy on your WEB VM, as Application Gateway can handle these responsibilities.
    • You could potentially simplify your architecture by removing the reverse proxy from your WEB VM and allowing Application Gateway to direct traffic directly to your APP VMs.
    • This not only reduces management overhead but also reduces the attack surface since you'd be relying on a managed security service.

    Best Practices:

    • Centralized WAF Management: Using Application Gateway with WAF allows you to manage security policies centrally, which is often easier and more effective than managing configurations on individual VMs.
    • SSL Termination: Application Gateway can terminate SSL connections, allowing you to inspect incoming traffic and take advantage of WAF protection.
    • Scaling: Application Gateway can automatically scale to meet traffic demands, which may be more efficient compared to scaling at the VM level.
    • Protection: With WAF, you get protection against common web vulnerabilities and can customize rules to meet the specific security requirements of your application.

    Deployment Considerations:

    • Downtime: Transitioning to Application Gateway may require downtime or a carefully planned migration to avoid service disruption.
    • Cost: Introducing Application Gateway will have cost implications that should be weighed against the security and management benefits.
    • Complexity: While Application Gateway can reduce complexity in some areas, it also introduces new elements into your architecture that you'll need to manage.

    If the answer helped, or pointed you in the right direction, please click accept answer or please share more information to help you better.

    Have a great day.

    0 comments