question

GadepalliAditya-5594 avatar image
0 Votes"
GadepalliAditya-5594 asked GitaraniSharmaMSFT-4262 commented

How to add Azure WAF firewall rules to Localhost applications

As per the Azure Firewall documentation, when a Firewall is added to application gateway and the firewall whether is in Protection / Detection mode the firewall rules will be applied and the requests which are failing to satisfy the conditions will eventually fail entering the application.

So these requests which failed will be stored as Firewall logs in Storage Accounts.

My question is, Is there any way to apply these rules in local debugging and so that I can fix all the code related issues and push to my cloud server.

If not Azure WAF, atleast anyway to apply the OWASP 3.2 rules to my local machine, Verify the requests, fix the code and deploy.

Thank you in advance.

azure-application-gatewayazure-firewallazure-firewall-manager
· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @GadepalliAditya-5594 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Could you please provide the documentation link which you mentioned in your post?

Regards,
Gita

0 Votes 0 ·
GadepalliAditya-5594 avatar image GadepalliAditya-5594 GitaraniSharmaMSFT-4262 ·

Hey @GitaraniSharmaMSFT-4262
Here is the link for the documentation / resource I have gone through:

https://docs.microsoft.com/en-us/azure/firewall/firewall-diagnostics

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot


Now.my doubt is these work when I deploy my web application into the cloud service / server. But is it possible by anyway to debug these rules and figure out which one are failing and fix them in local debug and deploy at once instead of deploying them, testing them and fixing in local and redeploying.

Thanks in advance...

0 Votes 0 ·

Thank you for the information @GadepalliAditya-5594. I'm checking internally on this and will get back to you as soon as I find anything.

0 Votes 0 ·
Show more comments

1 Answer

GitaraniSharmaMSFT-4262 avatar image
0 Votes"
GitaraniSharmaMSFT-4262 answered GitaraniSharmaMSFT-4262 commented

Hello @GadepalliAditya-5594 ,

I checked with the Azure WAF PG team and they mentioned that you’ll still have to go rule by rule, which you can do with our logs currently. If you have some handcrafted requests that you want to pass through WAF and not be blocked and modify the requests if they are blocked so they would pass, you might as well have WAF in detection mode and look at logs for what the decision would be from WAF and modify your requests accordingly.

Coming to the part of applying the OWASP 3.2 rules to your local machine, I am not sure what you are referring to when you say local machine but you could take a look into the below articles which explains how to download/install OWASP ModSecurity Core Rule Set but this requires you to have a web server with ModSecurity:
https://coreruleset.org/installation/
https://owasp.org/www-project-modsecurity-core-rule-set/

Kindly let us know if the above helps or you need further assistance on this issue.


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you @GitaraniSharmaMSFT-4262 for the help. Will try out the solution you mentioned.

1 Vote 1 ·

Hello @GadepalliAditya-5594 , I'm following up to check if you have any updates on this issue from your end.

0 Votes 0 ·

Hello @GadepalliAditya-5594 , any updates on this post?

0 Votes 0 ·