You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/frontdoor/best-practices.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ ms.service: frontdoor
8
8
ms.topic: article
9
9
ms.tgt_pltfrm: na
10
10
ms.workload: infrastructure-services
11
-
ms.date: 07/10/2022
11
+
ms.date: 10/25/2022
12
12
ms.author: jodowns
13
13
---
14
14
@@ -28,6 +28,10 @@ If you combine both Front Door and Traffic Manager together, it's unlikely that
28
28
29
29
If you need content caching and delivery (CDN), TLS termination, advanced routing capabilities, or a web application firewall (WAF), consider using Front Door. For simple global load balancing with direct connections from your client to your endpoints, consider using Traffic Manager. For more information about selecting a load balancing option, see [Load-balancing options](/azure/architecture/guide/technology-choices/load-balancing-overview).
30
30
31
+
### Restrict traffic to your origins
32
+
33
+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. For more information, see [Secure traffic to Azure Front Door origins](origin-security.md).
34
+
31
35
### Use the latest API version and SDK version
32
36
33
37
When you work with Front Door by using APIs, ARM templates, Bicep, or Azure SDKs, it's important to use the latest available API or SDK version. API and SDK updates occur when new functionality is available, and also contain important security patches and bug fixes.
Copy file name to clipboardExpand all lines: articles/frontdoor/front-door-faq.yml
+15-63Lines changed: 15 additions & 63 deletions
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ metadata:
7
7
ms.service: frontdoor
8
8
ms.topic: faq
9
9
ms.workload: infrastructure-services
10
-
ms.date: 09/14/2021
10
+
ms.date: 10/25/2022
11
11
title: Frequently asked questions for Azure Front Door
12
12
summary: |
13
13
This article answers common questions about Azure Front Door features and functionality. If you don't see the answer to your question, you can contact us through the following channels (in escalating order):
@@ -95,65 +95,7 @@ sections:
95
95
- question: |
96
96
How do I lock down the access to my backend to only Azure Front Door?
97
97
answer: |
98
-
> [!NOTE]
99
-
> New SKU Front Door Premium provides a more recommended way to lock down your application via Private Endpoint. [Learn more about Private Endpoint](private-link.md)
100
-
101
-
To lock down your application to accept traffic only from your specific Front Door, you can set up IP ACLs for your backend or restrict the traffic on your backend to the specific value of the header 'X-Azure-FDID' sent by Front Door. These steps are detailed out as below:
102
-
103
-
- Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only. Refer the IP details below for ACLing your backend:
104
-
105
-
- Refer *AzureFrontDoor.Backend* section in [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) for Front Door's backend IP address range or you can also use the service tag *AzureFrontDoor.Backend* in your [network security groups](../virtual-network/network-security-groups-overview.md#security-rules).
106
-
- Azure's [basic infrastructure services](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) through virtualized host IP addresses: `168.63.129.16` and `169.254.169.254`
107
-
108
-
> [!WARNING]
109
-
> Front Door's backend IP space may change later, however, we will ensure that before that happens, that we would have integrated with [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519). We recommend that you subscribe to [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) for any changes or updates.
110
-
111
-
- Look for the `Front Door ID` value under the Overview section from Front Door portal page. You can then filter on the incoming header '**X-Azure-FDID**' sent by Front Door to your backend with that value to ensure only your own specific Front Door instance is allowed (because the IP ranges above are shared with other Front Door instances of other customers).
112
-
113
-
- Apply rule filtering in your backend web server to restrict traffic based on the resulting 'X-Azure-FDID' header value. Note that some services like Azure App Service provide this [header based filtering](../app-service/app-service-ip-restrictions.md#restrict-access-to-a-specific-azure-front-door-instance) capability without needing to change your application or host.
114
-
115
-
Here's an example for [Microsoft Internet Information Services (IIS)](https://www.iis.net/):
SecRule REQUEST_HEADERS:X-Azure-FDID "!@eq xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "log,deny,id:107,status:403,msg:\'Traffic incoming from a different Frontdoor\'"
150
-
spec:
151
-
#section omitted on purpose
152
-
```
153
-
154
-
- Azure Front Door also supports the *AzureFrontDoor.Frontend* service tag, which provides the list of IP addresses that clients use when connecting to Front Door. You can use the *AzureFrontDoor.Frontend* service tag when you’re controlling the outbound traffic that should be allowed to connect to services deployed behind Azure Front Door. Azure Front Door also supports an additional service tag, *AzureFrontDoor.FirstParty*, to integrate internally with other Azure services. See [available service tags](../virtual-network/service-tags-overview.md#available-service-tags) for more details on Azure Front Door service tags use cases.
155
-
156
-
If using Application Gateway as a backend to Azure Front Door, then the check on the `X-Azure-FDID` header can be done in a custom WAF rule. For more information, see [Create and use Web Application Firewall v2 custom rules on Application Gateway](../web-application-firewall/ag/create-custom-waf-rules.md#example-7).
98
+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. For more information, see [Secure traffic to Azure Front Door origins](origin-security.md).
157
99
158
100
- question: |
159
101
Can the anycast IP change over the lifetime of my Front Door?
@@ -203,7 +145,17 @@ sections:
203
145
- question: |
204
146
Can I configure Azure CDN behind my Front Door profile or vice versa?
205
147
answer: |
206
-
Azure Front Door and Azure CDN can't be configured together because both services utilizes the same Azure edge sites when responding to requests.
148
+
Azure Front Door and Azure CDN can't be configured together because both services utilize the same Azure edge sites when responding to requests.
149
+
150
+
- question: |
151
+
Which network service tags does Front Door support?
152
+
answer: |
153
+
Azure Front Door supports three service tags:
154
+
- The *AzureFrontDoor.Backend* service tag provides the list of IP addresses that Front Door uses to connect to your origins. You can use this service tag when you [secure traffic to your origins](origin-security.md).
155
+
- The *AzureFrontDoor.Frontend* service tag provides the list of IP addresses that clients use when connecting to Front Door. You can use the *AzureFrontDoor.Frontend* service tag when you’re controlling the outbound traffic that should be allowed to connect to services deployed behind Azure Front Door.
156
+
- The *AzureFrontDoor.FirstParty* service tag is used internally within Azure.
157
+
158
+
See [available service tags](../virtual-network/service-tags-overview.md#available-service-tags) for more details on Azure Front Door service tags use cases.
207
159
208
160
- name: Performance
209
161
questions:
@@ -218,7 +170,7 @@ sections:
218
170
- question: |
219
171
How does Front Door handle ‘domain fronting’ behavior?
220
172
answer: |
221
-
As of April 29, 2022, Microsoft has made a change to the behavior of Azure Front Door Standard/Premium/(classic) and Azure CDN from Microsoft (classic) in alignment with its commitment to stop allowing domain fronting behavior on its platform. Once blocking domain fronting is enabled, AFD and CDN resources will block any HTTP request that exhibit this behavior.
173
+
As of April 29, 2022, Microsoft has made a change to the behavior of Azure Front Door Standard/Premium/(classic) and Azure CDN from Microsoft (classic) in alignment with its commitment to stop allowing domain fronting behavior on its platform. Once blocking domain fronting is enabled, AFD and CDN resources will block any HTTP request that exhibits this behavior.
222
174
If this behavior is enabled for your resource, requests where Host header in HTTP/HTTPS requests doesn't match the original TLS SNI extension used during the TLS negotiation, will be blocked.
223
175
224
176
If you wish to block domain fronting for any existing Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources or for new Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources, please create a support request and provide your subscription and
@@ -252,7 +204,7 @@ sections:
252
204
- question: |
253
205
What is the retention policy on the diagnostics logs?
254
206
answer: |
255
-
Diagnostic logs flow to the customers storage account and customers can set the retention policy based on their preference. Diagnostic logs can also be sent to an Event Hub or Azure Monitor logs. For more information, see [Azure Front Door Diagnostics](front-door-diagnostics.md).
207
+
Diagnostic logs flow to the customers storage account and customers can set the retention policy based on their preference. Diagnostic logs can also be sent to an Event Hubs or Azure Monitor logs. For more information, see [Azure Front Door Diagnostics](front-door-diagnostics.md).
title: Secure traffic to origins - Azure Front Door
3
+
description: This article explains how to restrict traffic to your origins to ensure it's been processed by Azure Front Door.
4
+
services: front-door
5
+
author: johndowns
6
+
ms.service: frontdoor
7
+
ms.topic: conceptual
8
+
ms.workload: infrastructure-services
9
+
ms.date: 10/25/2022
10
+
ms.author: jodowns
11
+
zone_pivot_groups: front-door-tiers
12
+
---
13
+
14
+
# Secure traffic to Azure Front Door origins
15
+
16
+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. Otherwise, traffic might bypass Front Door's web application firewall, DDoS protection, and other security features.
17
+
18
+
::: zone pivot="front-door-classic"
19
+
20
+
> [!NOTE]
21
+
> *Origin* and *origin group* in this article refers to the backend and backend pool of the Azure Front Door (classic) configuration.
22
+
23
+
::: zone-end
24
+
25
+
::: zone pivot="front-door-standard-premium"
26
+
27
+
Front Door provides several approaches that you can use to restrict your origin traffic.
28
+
29
+
## Private Link origins
30
+
31
+
When you use the premium SKU of Front Door, you can use Private Link to send traffic to your origin. [Learn more about Private Link origins.](private-link.md)
32
+
33
+
You should configure your origin to disallow traffic that doesn't come through Private Link. The way that you restrict traffic depends on the type of Private Link origin you use:
34
+
35
+
- Azure App Service and Azure Functions automatically disable access through public internet endpoints when you use Private Link. For more information, see [Using Private Endpoints for Azure Web App](../app-service/networking/private-endpoint.md).
36
+
- Azure Storage provides a firewall, which you can use to deny traffic from the internet. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md).
37
+
- Internal load balancers with Azure Private Link service aren't publicly routable. You can also configure network security groups to ensure that you disallow access to your virtual network from the internet.
38
+
39
+
::: zone-end
40
+
41
+
## Public IP address-based origins
42
+
43
+
When you use public IP address-based origins, there are two approaches you should use together to ensure that traffic flows through your Front Door instance:
44
+
45
+
- Configure IP address filtering to ensure that requests to your origin are only accepted from the Front Door IP address ranges.
46
+
- Configure your application to verify the `X-Azure-FDID` header value, which Front Door attaches to all requests to the origin, and ensure that its value matches your Front Door's identifier.
47
+
48
+
### IP address filtering
49
+
50
+
Configure IP address filtering for your origins to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.
51
+
52
+
The *AzureFrontDoor.Backend* service tag provides a list of the IP addresses that Front Door uses to connect to your origins. You can use this service tag within your [network security group rules](../virtual-network/network-security-groups-overview.md#security-rules). You can also download the [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) data set, which is updated regularly with the latest IP addresses.
53
+
54
+
You should also allow traffic from Azure's [basic infrastructure services](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) through the virtualized host IP addresses `168.63.129.16` and `169.254.169.254`.
55
+
56
+
> [!WARNING]
57
+
> Front Door's IP address space changes regularly. Ensure that you use the *AzureFrontDoor.Backend* service tag instead of hard-coding IP addresses.
58
+
59
+
### Front Door identifier
60
+
61
+
IP address filtering alone isn't sufficient to secure traffic to your origin, because other Azure customers use the same IP addresses. You should also configure your origin to ensure that traffic has originated from *your* Front Door profile.
62
+
63
+
Azure generates a unique identifier for each Front Door profile. You can find the identifier in the Azure portal, by looking for the *Front Door ID* value in the Overview page of your profile.
64
+
65
+
When Front Door makes a request to your origin, it adds the `X-Azure-FDID` request header. Your origin should inspect the header on incoming requests, and reject requests where the value doesn't match your Front Door profile's identifier.
66
+
67
+
### Example configuration
68
+
69
+
The following examples show how you can secure different types of origins.
70
+
71
+
# [App Service and Functions](#tab/app-service-functions)
72
+
73
+
You can use [App Service access restrictions](../app-service/app-service-ip-restrictions.md#restrict-access-to-a-specific-azure-front-door-instance) to perform IP address filtering as well as header filtering. The capability is provided by the platform, and you don't need to change your application or host.
74
+
75
+
# [Application Gateway](#tab/application-gateway)
76
+
77
+
Application Gateway is deployed into your virtual network. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
78
+
79
+
Use a custom WAF rule to check the `X-Azure-FDID` header value. For more information, see [Create and use Web Application Firewall v2 custom rules on Application Gateway](../web-application-firewall/ag/create-custom-waf-rules.md#example-7).
80
+
81
+
# [IIS](#tab/iis)
82
+
83
+
When you run [Microsoft Internet Information Services (IIS)](https://www.iis.net/) on an Azure-hosted virtual machine, you should create a network security group in the virtual network that hosts the virtual machine. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
84
+
85
+
Use an IIS configuration file like in the following example to inspect the `X-Azure-FDID` header on your incoming requests:
When you run [AKS with an NGINX ingress controller](../aks/ingress-basic.md), you should create a network security group in the virtual network that hosts the AKS cluster. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
109
+
110
+
Use a Kubernetes ingress configuration file like in the following example to inspect the `X-Azure-FDID` header on your incoming requests:
SecRule REQUEST_HEADERS:X-Azure-FDID "!@eq xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "log,deny,id:107,status:403,msg:\'Traffic incoming from a different Frontdoor\'"
124
+
spec:
125
+
#section omitted on purpose
126
+
```
127
+
128
+
---
129
+
130
+
## Next steps
131
+
132
+
- Learn how to configure a [WAF profile on Front Door](front-door-waf.md).
133
+
- Learn how to [create a Front Door](quickstart-create-front-door.md).
134
+
- Learn [how Front Door works](front-door-routing-architecture.md).
0 commit comments