How to add Azure WAF firewall rules to Localhost applications

Gadepalli Aditya 6 Reputation points
2021-10-19T08:11:10.753+00:00

As per the Azure Firewall documentation, when a Firewall is added to application gateway and the firewall whether is in Protection / Detection mode the firewall rules will be applied and the requests which are failing to satisfy the conditions will eventually fail entering the application.

So these requests which failed will be stored as Firewall logs in Storage Accounts.

My question is, Is there any way to apply these rules in local debugging and so that I can fix all the code related issues and push to my cloud server.

If not Azure WAF, atleast anyway to apply the OWASP 3.2 rules to my local machine, Verify the requests, fix the code and deploy.

Thank you in advance.

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
579 questions
Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
965 questions
Azure Firewall Manager
Azure Firewall Manager
An Azure service that provides central network security policy and route management for globally distributed, software-defined perimeters.
86 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee
    2021-10-20T18:34:52.313+00:00

    Hello @Gadepalli Aditya ,

    I checked with the Azure WAF PG team and they mentioned that you’ll still have to go rule by rule, which you can do with our logs currently. If you have some handcrafted requests that you want to pass through WAF and not be blocked and modify the requests if they are blocked so they would pass, you might as well have WAF in detection mode and look at logs for what the decision would be from WAF and modify your requests accordingly.

    Coming to the part of applying the OWASP 3.2 rules to your local machine, I am not sure what you are referring to when you say local machine but you could take a look into the below articles which explains how to download/install OWASP ModSecurity Core Rule Set but this requires you to have a web server with ModSecurity:
    https://coreruleset.org/installation/
    https://owasp.org/www-project-modsecurity-core-rule-set/

    Kindly let us know if the above helps or you need further assistance on this issue.

    ----------------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.