Skip to content

Commit 102c3c5

Browse files
teresayaoteresayao
committed
Add Doc for WAF with CDN preview
1 parent cc47efd commit 102c3c5

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎articles/web-application-firewall/cdn/cdn-overview.md

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
title: What is Azure web application firewall on Azure CDN?
3+
description: Learn how Azure web application firewall on Azure CDN service protects your web applications from malicious attacks.
4+
services: web-application-firewall
5+
author: vhorne
6+
ms.service: web-application-firewall
7+
ms.topic: overview
8+
ms.date: 03/09/2020
9+
ms.author: victorh
10+
---
11+
12+
# Azure Web Application Firewall with Azure CDN from Microsoft
13+
14+
Azure Web Application Firewall (WAF) with CDN provides centralized protection for your web contents. WAF defends your web services against common exploits and vulnerabilities. It keeps your service highly available for your users and helps you meet compliance requirements.
15+
16+
WAF on Azure CDN from Microsoft is a global and centralized solution. It's deployed on Azure network edge locations around the globe. WAF stops malicious attacks close to the attack sources, before they reach your origin. You get global protection at scale without sacrificing performance.
17+
18+
A WAF policy easily links to any CDN endpoint in your subscription. New rules can be deployed within minutes, so you can respond quickly to changing threat patterns.
19+
20+
![Azure web application firewall](../media/cdn-overview/waf-cdn-overview.png)
21+
22+
## WAF policy and rules
23+
24+
You can configure a WAF policy and associate that policy to one or more CDN endpoints for protection. A WAF policy consists of two types of security rules:
25+
26+
- custom rules that are authored by the customer.
27+
28+
- managed rule sets that are a collection of Azure-managed pre-configured set of rules.
29+
30+
When both are present, custom rules are processed before processing the rules in a managed rule set. A rule is made of a match condition, a priority, and an action. Action types supported are: ALLOW, BLOCK, LOG, and REDIRECT. You can create a fully customized policy that meets your specific application protection requirements by combining managed and custom rules.
31+
32+
Rules within a policy are processed in a priority order. Priority is a unique integer that defines the order of rules to process. Smaller integer value denotes a higher priority and those rules are evaluated before rules with a higher integer value. Once a rule is matched, the corresponding action that was defined in the rule is applied to the request. Once such a match is processed, rules with lower priorities aren't processed further.
33+
34+
A web application hosted on Azure CDN can have only one WAF policy associated with it at a time. However, you can have a CDN endpoint without any WAF policies associated with it. If a WAF policy is present, it's replicated to all of our edge locations to ensure consistent security policies across the world.
35+
36+
## WAF modes
37+
38+
WAF policy can be configured to run in the following two modes:
39+
40+
- **Detection mode:** When run in detection mode, WAF doesn't take any other actions other than monitors and logs the request and its matched WAF rule to WAF logs. You can turn on logging diagnostics for Front Door. When you use the portal, go to the **Diagnostics** section.
41+
42+
- **Prevention mode:** In prevention mode, WAF takes the specified action if a request matches a rule. If a match is found, no further rules with lower priority are evaluated. Any matched requests are also logged in the WAF logs.
43+
44+
## WAF actions
45+
46+
WAF customers can choose to run from one of the actions when a request matches a rule's conditions:
47+
48+
- **Allow:** Request passes through the WAF and is forwarded to back-end. No further lower priority rules can block this request.
49+
- **Block:** The request is blocked and WAF sends a response to the client without forwarding the request to the back-end.
50+
- **Log:** Request is logged in the WAF logs and WAF continues evaluating lower priority rules.
51+
- **Redirect:** WAF redirects the request to the specified URI. The URI specified is a policy level setting. Once configured, all requests that match the **Redirect** action will be sent to that URI.
52+
53+
## WAF rules
54+
55+
A WAF policy can consist of two types of security rules - custom rules, authored by the customer and managed rule sets, Azure-managed pre-configured set of rules.
56+
57+
### Custom authored rules
58+
59+
Custom rules may consist of match rules and rate control rules.
60+
You can configure custom match rules as follows:
61+
62+
- **IP allow list and block list:** You can control access to your web applications based on a list of client IP addresses or IP address ranges. Both IPv4 and IPv6 address types are supported. This list can be configured to either block or allow those requests where the source IP matches an IP in the list.
63+
64+
- **Geographic based access control:** You can control access to your web applications based on the country code that's associated with a client's IP address.
65+
66+
- **HTTP parameters-based access control:** You can base rules on string matches in HTTP/HTTPS request parameters. For example, query strings, POST args, Request URI, Request Header, and Request Body.
67+
68+
- **Request method-based access control:** You based rules on the HTTP request method of the request. For example, GET, PUT, or HEAD.
69+
70+
- **Size constraint:** You can base rules on the lengths of specific parts of a request such as query string, Uri, or request body.
71+
72+
A rate control rule is to limit abnormal high traffic from any client IP.
73+
74+
- **Rate limiting rules:** You may configure a threshold on the number of web requests allowed from a client IP during a one-minute duration. This rule is distinct from an IP list-based allow/block custom rule that either allows all or blocks all request from a client IP. Rate limits can be combined with additional match conditions such as HTTP(S) parameter matches for granular rate control.
75+
76+
### Azure-managed rule sets
77+
78+
Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats. Since such rulesets are managed by Azure, the rules are updated as needed to protect against new attack signatures. Azure-managed Default Rule Set includes rules against the following threat categories:
79+
80+
- Cross-site scripting
81+
- Java attacks
82+
- Local file inclusion
83+
- PHP injection attacks
84+
- Remote command execution
85+
- Remote file inclusion
86+
- Session fixation
87+
- SQL injection protection
88+
- Protocol attackers
89+
90+
The version number of the Default Rule Set increments when new attack signatures are added to the rule set.
91+
Default Rule Set is enabled by default in Detection mode in your WAF policies. You can disable or enable individual rules within the Default Rule Set to meet your application requirements. You can also set specific actions (ALLOW/BLOCK/REDIRECT/LOG) per rule. Default action for managed Default RuleSet is **Block".
92+
93+
Custom rules are always applied before rules in the Default Rule Set are evaluated. If a request matches a custom rule, the corresponding rule action is applied. The request is either blocked or passed through to the back-end. No other custom rules or the rules in the Default Rule Set are processed. You can also remove the Default Rule Set from your WAF policies.
94+
95+
> [!IMPORTANT]
96+
> WAF with Azure CDN is currently in public preview and is provided with a preview service level agreement. Certain features may not be supported or may have constrained capabilities. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for details.
97+
98+
99+
## Configuration
100+
101+
You can configure and deploy all WAF rule types using the Azure portal, REST APIs, Azure Resource Manager templates, and Azure PowerShell.
102+
103+
## Monitoring
104+
105+
Monitoring for WAF with CDN is integrated with Azure Monitor to track alerts and easily monitor traffic trends.
106+
107+
## Next steps
108+
109+
- Learn about [Web Application Firewall on Azure Front Door](../afds/afds-overview.md)

‎articles/web-application-firewall/cdn/waf-cdn-create-portal.md

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
title: 'Tutorial: Create WAF policy for Azure CDN - Azure portal'
3+
description: In this tutorial, you learn how to create a Web Application Firewall (WAF) policy by using the Azure portal.
4+
author: vhorne
5+
ms.service: web-application-firewall
6+
services: web-application-firewall
7+
ms.topic: tutorial
8+
ms.date: 03/09/2020
9+
ms.author: victorh
10+
---
11+
12+
# Tutorial: Create a Web Application Firewall policy with Azure CDN using the Azure portal
13+
14+
This tutorial show you how to create a basic Azure Web Application Firewall (WAF) policy and apply it to a endpoint at Azure CDN.
15+
16+
In this tutorial, you learn how to:
17+
18+
> [!div class="checklist"]
19+
> * Create a WAF policy
20+
> * Associate it with a CDN endpoint
21+
> * Configure WAF rules
22+
23+
## Prerequisites
24+
25+
Create a Front Door profile by following the instructions described in [Quickstart: Create a Front Door profile](../../cdn/cdn-create-new-endpoint.md).
26+
27+
## Create a Web Application Firewall policy
28+
29+
First, create a basic WAF policy with managed Default Rule Set (DRS) by using the portal.
30+
31+
1. On the top left-hand side of the screen, select **Create a resource**>search for **WAF**>select **Web application firewall** > select **Create**.
32+
2. In the **Basics** tab of the **Create a WAF policy** page, enter or select the following information, accept the defaults for the remaining settings, and then select **Review + create**:
33+
34+
| Setting | Value |
35+
| --- | --- |
36+
| Policy For |Select Azure CDN (Preview).|
37+
| Subscription |Select your Front Door subscription name.|
38+
| Resource group |Select your Front Door resource group name.|
39+
| Policy name |Enter a unique name for your WAF policy.|
40+
41+
![Create a WAF policy](../media/waf-cdn-create-portal/basic.png)
42+
43+
3. In the **Association** tab of the **Create a WAF policy** page, select **Add CDN Endpoint**, enter the following settings, and then select **Add**:
44+
45+
| Setting | Value |
46+
| --- | --- |
47+
| CDN Profile | Select your CDN profile name.|
48+
| Endpoint | Select the name of your endpoint, then select **Add**.|
49+
50+
> [!NOTE]
51+
> If the endpoint is associated to a WAF policy, it is shown as grayed out. You must first remove the Endpoint from the associated policy, and then re-associate the endpoint to a new WAF policy.
52+
1. Select **Review + create**, then select **Create**.
53+
54+
## Configure Web Application Firewall policy (optional)
55+
56+
### Change mode
57+
58+
When you create a WAF policy, by the default WAF policy is in **Detection** mode. In **Detection** mode, WAF does not block any requests, instead, requests matching the WAF rules are logged at WAF logs.
59+
To see WAF in action, you can change the mode settings from **Detection** to **Prevention**. In **Prevention** mode, requests that match rules that are defined in Default Rule Set (DRS) are blocked and logged at WAF logs.
60+
61+
![Change WAF policy mode](../media/waf-cdn-create-portal/policy.png)
62+
63+
### Custom rules
64+
65+
You can create a custom rule by selecting **Add custom rule** under the **Custom rules** section. This launches the custom rule configuration page. There are two types of custom rules, **match rule** and **rate limit** rule.
66+
Below is an example of configuring a custom match rule to block a request if the query string contains **blockme**.
67+
68+
![Change WAF policy mode](../media/waf-cdn-create-portal/custommatch.png)
69+
70+
Rate limit rule requires two additional fields: Rate limit duration and threshold as shown in below example:
71+
72+
![Change WAF policy mode](../media/waf-cdn-create-portal/customrate.png)
73+
74+
### Default Rule Set (DRS)
75+
76+
Azure-managed Default Rule Set is enabled by default. To disable an individual rule within a rule group, expand the rules within that rule group, select the **check box** in front of the rule number, and select **Disable** on the tab above. To change actions types for individual rules within the rule set, select the check box in front of the rule number, and then select the **Change action** tab above.
77+
78+
![Change WAF Rule Set](../media/waf-cdn-create-portal/managed2.png)
79+
80+
## Next steps
81+
82+
> [!div class="nextstepaction"]
83+
> [Learn about Azure Web Application Firewall](../overview.md)
84+
> [Learn more about Azure Front Door](../../frontdoor/front-door-overview.md)

0 commit comments

Comments
 (0)