You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Web application firewall exclusion lists in Azure Front Door
3
-
description: This article provides information on exclusion lists configuration in Azure Front Door.
3
+
description: This article provides information on exclusion list configuration in Azure Front Door.
4
4
services: web-application-firewall
5
5
author: vhorne
6
6
ms.service: web-application-firewall
@@ -9,67 +9,67 @@ ms.author: victorh
9
9
ms.topic: conceptual
10
10
---
11
11
12
-
# Web Application Firewall (WAF) with Front Door exclusion lists
12
+
# Web Application Firewall with Azure Front Door exclusion lists
13
13
14
-
Sometimes the Front Door Web Application Firewall (WAF) might block a legitimate request. As part of tuning your WAF, you can configure the WAF to allow the request for your application. WAF exclusion lists allow you to omit specific request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
14
+
Sometimes Azure Web Application Firewall in Azure Front Door might block a legitimate request. As part of tuning your web application firewall (WAF), you can configure the WAF to allow the request for your application. WAF exclusion lists allow you to omit specific request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
15
15
16
-
For example, Azure Active Directory provides tokens that are used for authentication. When used in a request header, these tokens can contain special characters that might trigger a false positive detection by one or more WAF rules. You can add the header to an exclusion list, which tells the WAF to ignore the header. The WAF still inspects the rest of the request for suspicious content.
16
+
For example, Azure Active Directory provides tokens that are used for authentication. When these tokens are used in a request header, they can contain special characters that might trigger a false positive detection by one or more WAF rules. You can add the header to an exclusion list, which tells the WAF to ignore the header. The WAF still inspects the rest of the request for suspicious content.
17
17
18
18
## Exclusion scopes
19
19
20
20
You can create exclusions at the following scopes:
21
21
22
-
-**Rule set** exclusions apply to all rules within a rule set.
23
-
-**Rule group**exclusions apply to all of the rules of a particular category within a rule set. For example, you can configure an exclusion that applies to all of the SQL injection rules.
24
-
-**Rule** exclusions apply to a single rule.
22
+
-**Rule set**: These exclusions apply to all rules within a rule set.
23
+
-**Rule group**: These exclusions apply to all the rules of a particular category within a rule set. For example, you can configure an exclusion that applies to all the SQL injection rules.
24
+
-**Rule**: These exclusions apply to a single rule.
25
25
26
26
## Exclusion selectors
27
27
28
-
Exclusion selectors identify the parts of requests that the exclusion applies to. The WAF ignores any detections that it finds in the specified parts of the request. You can specify multiple exclusion selectors in a single exclusion.
28
+
Exclusion selectors identify the parts of requests to which the exclusion applies. The WAF ignores any detections that it finds in the specified parts of the request. You can specify multiple exclusion selectors in a single exclusion.
29
29
30
30
Each exclusion selector specified a match variable, an operator, and a selector.
31
31
32
32
### Match variables
33
33
34
-
The following request attributes can be added to an exclusion:
34
+
You can add the following request attributes to an exclusion:
35
35
36
36
* Request header name
37
37
* Request cookie name
38
38
* Query string args name
39
39
* Request body POST args name
40
40
* Request body JSON args name *(supported on DRS 2.0 or greater)*
41
41
42
-
The values of the fields you use aren't evaluated against WAF rules, but their names are evaluated. The exclusion lists disable inspection of the field's value. However, the field names are still evaluated. For more information, see [Excluding other request attributes](#exclude-other-request-attributes).
42
+
The values of the fields you use aren't evaluated against WAF rules, but their names are evaluated. The exclusion lists disable inspection of the field's value. However, the field names are still evaluated. For more information, see [Exclude other request attributes](#exclude-other-request-attributes).
43
43
44
44
### Operators
45
45
46
-
You can specify an exact request header, body, cookie, or query string attribute to match. Or, you can optionally specify partial matches. The following operators are supported for match criteria:
46
+
You can specify an exact request header, body, cookie, or query string attribute to match. Or you can optionally specify partial matches. The following operators are supported for match criteria:
47
47
48
-
-**Equals**: Match all request fields that exactly match the specified selector value. For example, to select a header named **bearerToken**, use the *Equals* operator with the selector set to **bearerToken**.
48
+
-**Equals**: Match all request fields that exactly match the specified selector value. For example, to select a header named **bearerToken**, use the `Equals` operator with the selector set to **bearerToken**.
49
49
-**Starts with**: Match all request fields that start with the specified selector value.
50
-
-**Ends with**: Match all request fields that end with the specified selector value.
50
+
-**Ends with**: Match all request fields that end with the specified selector value.
51
51
-**Contains**: Match all request fields that contain the specified selector value.
52
-
-**Equals any**: Match all request fields. When you use the *Equals any* operator, the selector value is automatically set to _*_. For example, you can use the *Equals any* operator to configure an exclusion that applies to all request headers.
52
+
-**Equals any**: Match all request fields. When you use the `Equals any` operator, the selector value is automatically set to `*`. For example, you can use the `Equals any` operator to configure an exclusion that applies to all request headers.
53
53
54
54
### Case sensitivity
55
55
56
56
Header and cookie names are case insensitive. Query strings, POST arguments, and JSON arguments are case sensitive.
57
57
58
58
### Body contents inspection
59
59
60
-
Some of the managed rules evaluate the raw payload of the request body, before it's parsed into POST arguments or JSON arguments. So, in some situations you might see log entries with a matchVariableName of `InitialBodyContents` or `DecodedInitialBodyContents`.
60
+
Some of the managed rules evaluate the raw payload of the request body before it's parsed into POST arguments or JSON arguments. So in some situations, you might see log entries with a `matchVariableName` value of `InitialBodyContents` or `DecodedInitialBodyContents`.
61
61
62
-
For example, suppose you create an exclusion with a match variable of *Request body POST args* and a selector to identify and ignore POST arguments named *FOO*. You'll no longer see any log entries with a matchVariableNameof `PostParamValue:FOO`. However, if a POST argument named *FOO* contains text that triggers a rule, the log might show the detection in the initial body contents. You can't currently create exclusions for initial body contents.
62
+
For example, suppose you create an exclusion with a match variable of `Request body POST args` and a selector to identify and ignore POST arguments named `FOO`. You no longer see any log entries with a `matchVariableName` value of `PostParamValue:FOO`. However, if a POST argument named `FOO` contains text that triggers a rule, the log might show the detection in the initial body contents. You can't currently create exclusions for initial body contents.
63
63
64
-
## <aname="define-exclusion-based-on-web-application-firewall-logs"></a> Define exclusion rules based on Web Application Firewall logs
64
+
## <aname="define-exclusion-based-on-web-application-firewall-logs"></a> Define exclusion rules based on Azure Web Application Firewall logs
65
65
66
-
[Azure Web Application Firewall monitoring and logging](waf-front-door-monitor.md) describes how you can use logs to view the details of a blocked request, including the parts of the request that triggered the rule.
66
+
You can use logs to view the details of a blocked request, including the parts of the request that triggered the rule. For more information, see [Azure Web Application Firewall monitoring and logging](waf-front-door-monitor.md).
67
67
68
68
Sometimes a specific WAF rule produces false positive detections from the values included in a request header, cookie, POST argument, query string argument, or JSON field in a request body. If these false positive detections happen, you can configure the rule to exclude the relevant part of the request from its evaluation.
69
69
70
70
The following table shows example values from WAF logs and the corresponding exclusion selectors that you could create.
71
71
72
-
| matchVariableName from WAF logs | Rule exclusion in Portal|
72
+
| matchVariableName from WAF logs | Rule exclusion in portal|
73
73
|-|-|
74
74
| CookieValue:SOME_NAME| Request cookie name Equals SOME_NAME |
75
75
| HeaderValue:SOME_NAME| Request header name Equals SOME_NAME |
@@ -98,20 +98,20 @@ From DRS version 2.0, JSON request bodies are inspected by the WAF. For example,
98
98
99
99
The request includes a SQL comment character sequence, which the WAF detects as a potential SQL injection attack.
100
100
101
-
If you determine that the request is legitimate, you could create an exclusion with a match variable of *Request body JSON args name*, an operator of *Equals*, and a selector of *posts.comment*.
101
+
If you determine that the request is legitimate, you could create an exclusion with a match variable of `Request body JSON args name`, an operator of `Equals`, and a selector of `posts.comment`.
102
102
103
103
## Exclude other request attributes
104
104
105
-
If your WAF log entry shows a matchVariableNamethat isn't in the table above, you can't create an exclusion. For example, you can't currently create exclusions for cookie names, header names, POST parameter names, or query parameter names.
105
+
If your WAF log entry shows a `matchVariableName` value that isn't in the preceding table, you can't create an exclusion. For example, you can't currently create exclusions for cookie names, header names, POST parameter names, or query parameter names.
106
106
107
107
Instead, consider taking one of the following actions:
108
108
109
109
- Disable the rules that give false positives.
110
110
- Create a custom rule that explicitly allows those requests. The requests bypass all WAF inspection.
111
111
112
-
In particular, when the matchVariableNameis `CookieName`, `HeaderName`, `PostParamName`, or `QueryParamName`, it means the name of the field, rather than its value, has triggered the rule. Rule exclusion has no support for these matchVariableNames at this time.
112
+
In particular, when the `matchVariableName` value is `CookieName`, `HeaderName`, `PostParamName`, or `QueryParamName`, it means the name of the field, rather than its value, has triggered the rule. Rule exclusion has no support for these `matchVariableName` values at this time.
113
113
114
114
## Next steps
115
115
116
-
-[Configure exclusion lists on your Front Door WAF](waf-front-door-exclusion-configure.md)
117
-
- After you configure your WAF settings, learn how to view your WAF logs. For more information, see [Front Door diagnostics](../afds/waf-front-door-monitor.md).
116
+
-[Configure exclusion lists on your Azure Front Door WAF](waf-front-door-exclusion-configure.md).
117
+
- After you configure your WAF settings, learn how to view your WAF logs. For more information, see [Azure Front Door diagnostics](../afds/waf-front-door-monitor.md).
Copy file name to clipboardExpand all lines: articles/web-application-firewall/afds/waf-front-door-geo-filtering.md
+14-13Lines changed: 14 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Geo-filtering on a domain for Azure Front Door Service
3
-
description: In this article, you learn about geo-filtering policy for Azure Front Door Service
2
+
title: Geo-filtering on a domain for Azure Front Door
3
+
description: In this article, you learn about the geo-filtering policy for Azure Front Door.
4
4
services: web-application-firewall
5
5
author: vhorne
6
6
ms.service: web-application-firewall
@@ -9,17 +9,20 @@ ms.date: 08/31/2021
9
9
ms.author: victorh
10
10
---
11
11
12
-
# What is geo-filtering on a domain for Azure Front Door Service?
12
+
# What is geo-filtering on a domain for Azure Front Door?
13
13
14
-
By default, Azure Front Door will respond to all user requests regardless of the location where the request is coming from. In some scenarios, you may want to restrict the access to your web application by countries/regions. The Web application firewall (WAF) service in Front Door enables you to define a policy using custom access rules for a specific path on your endpoint to either allow or block access from specified countries/regions.
14
+
By default, Azure Front Door responds to all user requests regardless of the location where the request comes from. In some scenarios, you might want to restrict access to your web application by countries or regions. You can use Azure Web Application Firewall in Azure Front Door to define a policy by using custom access rules for a specific path on your endpoint to allow or block access from specified countries or regions.
15
15
16
-
A WAF policy contains a set of custom rules. The rule consists of match conditions, an action, and a priority. In a match condition, you define a match variable, operator, and match value. For a geo filtering rule, a match variable is either RemoteAddr or SocketAddr. RemoteAddr is the original client IP that is usually sent via X-Forwarded-For request header. SocketAddr is the source IP address WAF sees. If your user is behind a proxy, SocketAddr is often the proxy server address.
17
-
The operator in the case of this geo filtering rule is GeoMatch, and the value is a two letter country/region code of interest. "ZZ" country code or "Unknown" country captures IP addresses that are not yet mapped to a country in our dataset. You may add ZZ to your match condition to avoid false positives. You can combine a GeoMatch condition and a REQUEST_URI string match condition to create a path-based geo-filtering rule.
16
+
A web application firewall (WAF) policy contains a set of custom rules. The rule consists of match conditions, an action, and a priority. In a match condition, you define a match variable, operator, and match value.
18
17
19
-
You can configure a geo-filtering policy for your Front Door by using [Azure PowerShell](../../frontdoor/front-door-tutorial-geo-filtering.md) or by using a [quickstart template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.network/front-door-geo-filtering).
18
+
For a geo-filtering rule, the match variable is either `RemoteAddr` or `SocketAddr`. The `RemoteAddr` variable is the original client IP that's usually sent via the `X-Forwarded-For` request header. `SocketAddr` is the source IP address WAF sees. If your user is behind a proxy, the `SocketAddr` variable is usually the IP address of the proxy server.
19
+
20
+
The operator for this geo-filtering rule is `GeoMatch`. The value is a two-letter country or region code of interest. The `ZZ` country code or `Unknown` country captures IP addresses that aren't yet mapped to a country in our dataset. You can add `ZZ` to your match condition to avoid false positives. You can combine a `GeoMatch` condition and a `REQUEST_URI` string match condition to create a path-based geo-filtering rule.
21
+
22
+
You can configure a geo-filtering policy for your Azure Front Door instance by using [Azure PowerShell](../../frontdoor/front-door-tutorial-geo-filtering.md) or a [Bicep file or Azure Resource Manager template](https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.cdn/front-door-standard-premium-geo-filtering/).
20
23
21
24
> [!IMPORTANT]
22
-
> Include the country code **ZZ** whenever you use geo-filtering. The **ZZ** country code (or *Unknown* country) captures IP addresses that are not yet mapped to a country in our dataset. This avoids false positives.
25
+
> Include the country code `ZZ` whenever you use geo-filtering. The `ZZ` country code (or `Unknown` country) captures IP addresses that aren't yet mapped to a country in our dataset. Use this code to avoid false positives.
23
26
24
27
## Country/Region code reference
25
28
@@ -54,7 +57,7 @@ You can configure a geo-filtering policy for your Front Door by using [Azure Pow
54
57
| BM | Bermuda|
55
58
| BN | Brunei|
56
59
| BO | Bolivia|
57
-
| BQ | Bonaire, Sint Eustatius and Saba|
60
+
| BQ | Bonaire, Sint Eustatius, and Saba|
58
61
| BR | Brazil|
59
62
| BS | Bahamas|
60
63
| BT | Bhutan|
@@ -276,7 +279,5 @@ You can configure a geo-filtering policy for your Front Door by using [Azure Pow
276
279
277
280
## Next steps
278
281
279
-
- Learn about [application layer security with Front Door](../../frontdoor/front-door-application-security.md).
280
-
- Learn how to [create a Front Door](../../frontdoor/quickstart-create-front-door.md).
281
-
282
-
282
+
- Learn about [application layer security with Azure Front Door](../../frontdoor/front-door-application-security.md).
283
+
- Learn how to [create an instance of Azure Front Door](../../frontdoor/quickstart-create-front-door.md).
0 commit comments