|
2 | 2 | title: Rules Engine for Azure Front Door architecture and terminology |
3 | 3 | description: This article provides an overview of the Azure Front Door Rules Engine feature. |
4 | 4 | services: frontdoor |
5 | | -documentationcenter: '' |
6 | 5 | author: duongau |
7 | | -editor: '' |
8 | 6 | ms.service: frontdoor |
9 | 7 | ms.topic: article |
10 | | -ms.tgt_pltfrm: na |
11 | 8 | ms.workload: infrastructure-services |
12 | | -ms.date: 9/29/2020 |
| 9 | +ms.date: 03/07/2022 |
13 | 10 | ms.author: duau |
14 | | -# Customer intent: As an IT admin, I want to learn about Front Door and what the Rules Engine feature does. |
| 11 | +zone_pivot_groups: front-door-tiers |
15 | 12 | --- |
16 | 13 |
|
17 | 14 | # What is Rules Engine for Azure Front Door? |
18 | 15 |
|
| 16 | +::: zone pivot="front-door-standard-premium" |
| 17 | + |
| 18 | +A Rule Set is a customized rule engine that groups a combination of rules into a single set. You can associate a Rule Set with multiple routes. The Rule Set allows you to customize how requests get processed at the edge, and how Azure Front Door handles those requests. |
| 19 | + |
| 20 | +> [!IMPORTANT] |
| 21 | +> Azure Front Door Standard/Premium (Preview) is currently in public preview. |
| 22 | +> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. |
| 23 | +> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). |
| 24 | +
|
| 25 | +## Common supported scenarios |
| 26 | + |
| 27 | +* Implementing security headers to prevent browser-based vulnerabilities like HTTP Strict-Transport-Security (HSTS), X-XSS-Protection, Content-Security-Policy, X-Frame-Options, and Access-Control-Allow-Origin headers for Cross-Origin Resource Sharing (CORS) scenarios. Security-based attributes can also be defined with cookies. |
| 28 | + |
| 29 | +* Route requests to mobile or desktop versions of your application based on the client device type. |
| 30 | + |
| 31 | +* Using redirect capabilities to return 301, 302, 307, and 308 redirects to the client to direct them to new hostnames, paths, query strings, or protocols. |
| 32 | + |
| 33 | +* Dynamically modify the caching configuration of your route based on the incoming requests. |
| 34 | + |
| 35 | +* Rewrite the request URL path and forwards the request to the appropriate origin in your configured origin group. |
| 36 | + |
| 37 | +* Add, modify, or remove request/response header to hide sensitive information or capture important information through headers. |
| 38 | + |
| 39 | +* Support server variables to dynamically change the request/response headers or URL rewrite paths/query strings, for example, when a new page load or when a form is posted. Server variable is currently supported on **[Rule Set actions](front-door-rules-engine-actions.md)** only. |
| 40 | + |
| 41 | +## Architecture |
| 42 | + |
| 43 | +Rule Set handles requests at the edge. When a request arrives at your Azure Front Door Standard/Premium endpoint, WAF is executed first, followed by the settings configured in Route. Those settings include the Rule Set associated to the Route. Rule Sets are processed from top to bottom in the Route. The same applies to rules within a Rule Set. In order for all the actions in each rule to get executed, all the match conditions within a rule has to be satisfied. If a request doesn't match any of the conditions in your Rule Set configuration, then only configurations in Route will be executed. |
| 44 | + |
| 45 | +If **Stop evaluating remaining rules** gets checked, then all of the remaining Rule Sets associated with the Route aren't executed. |
| 46 | + |
| 47 | +### Example |
| 48 | + |
| 49 | +In the following diagram, WAF policies get executed first. A Rule Set gets configured to append a response header. Then the header changes the max-age of the cache control if the match condition gets met. |
| 50 | + |
| 51 | +:::image type="content" source="./media/front-door-rules-engine/front-door-rule-set-architecture-1.png" alt-text="Diagram that shows architecture of Rule Set." lightbox="./media/front-door-rules-engine/front-door-rule-set-architecture-1-expanded.png"::: |
| 52 | + |
| 53 | +## Terminology |
| 54 | + |
| 55 | +With Azure Front Door Rule Set, you can create a combination of Rules Set configuration, each composed of a set of rules. The following out lines some helpful terminologies you'll come across when configuring your Rule Set. |
| 56 | + |
| 57 | +For more quota limit, refer to [Azure subscription and service limits, quotas and constraints](../azure-resource-manager/management/azure-subscription-service-limits.md). |
| 58 | + |
| 59 | +* *Rule Set*: A set of rules that gets associated to one or multiple [routes](standard-premium/concept-route.md). |
| 60 | + |
| 61 | +* *Rule Set rule*: A rule composed of up to 10 match conditions and 5 actions. Rules are local to a Rule Set and cannot be exported to use across Rule Sets. Users can create the same rule in multiple Rule Sets. |
| 62 | + |
| 63 | +* *Match condition*: There are many match conditions that can be utilized to parse your incoming requests. A rule can contain up to 10 match conditions. Match conditions are evaluated with an **AND** operator. *Regular expression is supported in conditions*. A full list of match conditions can be found in [Rule Set match conditions](rules-match-conditions.md). |
| 64 | + |
| 65 | +* *Action*: Actions dictate how AFD handles the incoming requests based on the matching conditions. You can modify caching behaviors, modify request headers/response headers, do URL rewrite and URL redirection. *Server variables are supported on Action*. A rule can contain up to 10 match conditions. A full list of actions can be found [Rule Set actions](front-door-rules-engine-actions.md). |
| 66 | + |
| 67 | +## ARM template support |
| 68 | + |
| 69 | +Rule Sets can be configured using Azure Resource Manager templates. [See an example template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.cdn/front-door-standard-premium-rule-set). You can customize the behavior by using the JSON or Bicep snippets included in the documentation examples for [match conditions](rules-match-conditions.md) and [actions](front-door-rules-engine-actions.md). |
| 70 | + |
| 71 | +## Next steps |
| 72 | + |
| 73 | +* Learn how to [create a Front Door Standard/Premium](standard-premium/create-front-door-portal.md). |
| 74 | +* Learn how to configure your first [Rule Set](standard-premium/how-to-configure-rule-set.md). |
| 75 | + |
| 76 | +::: zone-end |
| 77 | + |
| 78 | +::: zone pivot="front-door-classic" |
| 79 | + |
19 | 80 | Rules Engine allows you to customize how HTTP requests gets handled at the edge and provides a more controlled behavior to your web application. Rules Engine for Azure Front Door has several key features, including: |
20 | 81 |
|
21 | 82 | * Enforces HTTPS to ensure all your end users interact with your content over a secure connection. |
@@ -54,3 +115,5 @@ With AFD Rules Engine, you can create a combination of Rules Engine configuratio |
54 | 115 | - Learn how to configure your first [Rules Engine configuration](front-door-tutorial-rules-engine.md). |
55 | 116 | - Learn how to [create a Front Door](quickstart-create-front-door.md). |
56 | 117 | - Learn [how Front Door works](front-door-routing-architecture.md). |
| 118 | + |
| 119 | +::: zone-end |
0 commit comments