Skip to content

Commit 45d0088

Browse files
authored
Merge pull request #214215 from johndowns/front-door-origin-lockdown
Front Door - Update guidance about restricting origin traffic
2 parents c2ed168 + 3745395 commit 45d0088

File tree

4 files changed

+156
-64
lines changed

4 files changed

+156
-64
lines changed

articles/frontdoor/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,8 @@
213213
href: web-application-firewall.md
214214
- name: Geo-filtering
215215
href: ../web-application-firewall/afds/waf-front-door-geo-filtering.md?toc=/azure/frontdoor/toc.json
216+
- name: Secure traffic to origins
217+
href: origin-security.md
216218
- name: Protocol
217219
items:
218220
- name: HTTP/2

articles/frontdoor/best-practices.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: frontdoor
88
ms.topic: article
99
ms.tgt_pltfrm: na
1010
ms.workload: infrastructure-services
11-
ms.date: 07/10/2022
11+
ms.date: 10/25/2022
1212
ms.author: jodowns
1313
---
1414

@@ -28,6 +28,10 @@ If you combine both Front Door and Traffic Manager together, it's unlikely that
2828

2929
If you need content caching and delivery (CDN), TLS termination, advanced routing capabilities, or a web application firewall (WAF), consider using Front Door. For simple global load balancing with direct connections from your client to your endpoints, consider using Traffic Manager. For more information about selecting a load balancing option, see [Load-balancing options](/azure/architecture/guide/technology-choices/load-balancing-overview).
3030

31+
### Restrict traffic to your origins
32+
33+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. For more information, see [Secure traffic to Azure Front Door origins](origin-security.md).
34+
3135
### Use the latest API version and SDK version
3236

3337
When you work with Front Door by using APIs, ARM templates, Bicep, or Azure SDKs, it's important to use the latest available API or SDK version. API and SDK updates occur when new functionality is available, and also contain important security patches and bug fixes.

articles/frontdoor/front-door-faq.yml

Lines changed: 15 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ metadata:
77
ms.service: frontdoor
88
ms.topic: faq
99
ms.workload: infrastructure-services
10-
ms.date: 09/14/2021
10+
ms.date: 10/25/2022
1111
title: Frequently asked questions for Azure Front Door
1212
summary: |
1313
This article answers common questions about Azure Front Door features and functionality. If you don't see the answer to your question, you can contact us through the following channels (in escalating order):
@@ -95,65 +95,7 @@ sections:
9595
- question: |
9696
How do I lock down the access to my backend to only Azure Front Door?
9797
answer: |
98-
> [!NOTE]
99-
> New SKU Front Door Premium provides a more recommended way to lock down your application via Private Endpoint. [Learn more about Private Endpoint](private-link.md)
100-
101-
To lock down your application to accept traffic only from your specific Front Door, you can set up IP ACLs for your backend or restrict the traffic on your backend to the specific value of the header 'X-Azure-FDID' sent by Front Door. These steps are detailed out as below:
102-
103-
- Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only. Refer the IP details below for ACLing your backend:
104-
105-
- Refer *AzureFrontDoor.Backend* section in [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) for Front Door's backend IP address range or you can also use the service tag *AzureFrontDoor.Backend* in your [network security groups](../virtual-network/network-security-groups-overview.md#security-rules).
106-
- Azure's [basic infrastructure services](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) through virtualized host IP addresses: `168.63.129.16` and `169.254.169.254`
107-
108-
> [!WARNING]
109-
> Front Door's backend IP space may change later, however, we will ensure that before that happens, that we would have integrated with [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519). We recommend that you subscribe to [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) for any changes or updates.
110-
111-
- Look for the `Front Door ID` value under the Overview section from Front Door portal page. You can then filter on the incoming header '**X-Azure-FDID**' sent by Front Door to your backend with that value to ensure only your own specific Front Door instance is allowed (because the IP ranges above are shared with other Front Door instances of other customers).
112-
113-
- Apply rule filtering in your backend web server to restrict traffic based on the resulting 'X-Azure-FDID' header value. Note that some services like Azure App Service provide this [header based filtering](../app-service/app-service-ip-restrictions.md#restrict-access-to-a-specific-azure-front-door-instance) capability without needing to change your application or host.
114-
115-
Here's an example for [Microsoft Internet Information Services (IIS)](https://www.iis.net/):
116-
117-
```xml
118-
<?xml version="1.0" encoding="UTF-8"?>
119-
<configuration>
120-
<system.webServer>
121-
<rewrite>
122-
<rules>
123-
<rule name="Filter_X-Azure-FDID" patternSyntax="Wildcard" stopProcessing="true">
124-
<match url="*" />
125-
<conditions>
126-
<add input="{HTTP_X_AZURE_FDID}" pattern="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" negate="true" />
127-
</conditions>
128-
<action type="AbortRequest" />
129-
</rule>
130-
</rules>
131-
</rewrite>
132-
</system.webServer>
133-
</configuration>
134-
```
135-
136-
Here's an example for [AKS NGINX ingress controller](../aks/ingress-basic.md):
137-
138-
```yaml
139-
apiVersion: networking.k8s.io/v1
140-
kind: Ingress
141-
metadata:
142-
name: frontdoor-ingress
143-
annotations:
144-
kubernetes.io/ingress.class: nginx
145-
nginx.ingress.kubernetes.io/enable-modsecurity: "true"
146-
nginx.ingress.kubernetes.io/modsecurity-snippet: |
147-
SecRuleEngine On
148-
SecAuditLog /var/log/modsec_audit.log
149-
SecRule REQUEST_HEADERS:X-Azure-FDID "!@eq xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "log,deny,id:107,status:403,msg:\'Traffic incoming from a different Frontdoor\'"
150-
spec:
151-
#section omitted on purpose
152-
```
153-
154-
- Azure Front Door also supports the *AzureFrontDoor.Frontend* service tag, which provides the list of IP addresses that clients use when connecting to Front Door. You can use the *AzureFrontDoor.Frontend* service tag when you’re controlling the outbound traffic that should be allowed to connect to services deployed behind Azure Front Door. Azure Front Door also supports an additional service tag, *AzureFrontDoor.FirstParty*, to integrate internally with other Azure services. See [available service tags](../virtual-network/service-tags-overview.md#available-service-tags) for more details on Azure Front Door service tags use cases.
155-
156-
If using Application Gateway as a backend to Azure Front Door, then the check on the `X-Azure-FDID` header can be done in a custom WAF rule. For more information, see [Create and use Web Application Firewall v2 custom rules on Application Gateway](../web-application-firewall/ag/create-custom-waf-rules.md#example-7).
98+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. For more information, see [Secure traffic to Azure Front Door origins](origin-security.md).
15799
158100
- question: |
159101
Can the anycast IP change over the lifetime of my Front Door?
@@ -203,7 +145,17 @@ sections:
203145
- question: |
204146
Can I configure Azure CDN behind my Front Door profile or vice versa?
205147
answer: |
206-
Azure Front Door and Azure CDN can't be configured together because both services utilizes the same Azure edge sites when responding to requests.
148+
Azure Front Door and Azure CDN can't be configured together because both services utilize the same Azure edge sites when responding to requests.
149+
150+
- question: |
151+
Which network service tags does Front Door support?
152+
answer: |
153+
Azure Front Door supports three service tags:
154+
- The *AzureFrontDoor.Backend* service tag provides the list of IP addresses that Front Door uses to connect to your origins. You can use this service tag when you [secure traffic to your origins](origin-security.md).
155+
- The *AzureFrontDoor.Frontend* service tag provides the list of IP addresses that clients use when connecting to Front Door. You can use the *AzureFrontDoor.Frontend* service tag when you’re controlling the outbound traffic that should be allowed to connect to services deployed behind Azure Front Door.
156+
- The *AzureFrontDoor.FirstParty* service tag is used internally within Azure.
157+
158+
See [available service tags](../virtual-network/service-tags-overview.md#available-service-tags) for more details on Azure Front Door service tags use cases.
207159
208160
- name: Performance
209161
questions:
@@ -218,7 +170,7 @@ sections:
218170
- question: |
219171
How does Front Door handle ‘domain fronting’ behavior?
220172
answer: |
221-
As of April 29, 2022, Microsoft has made a change to the behavior of Azure Front Door Standard/Premium/(classic) and Azure CDN from Microsoft (classic) in alignment with its commitment to stop allowing domain fronting behavior on its platform. Once blocking domain fronting is enabled, AFD and CDN resources will block any HTTP request that exhibit this behavior.
173+
As of April 29, 2022, Microsoft has made a change to the behavior of Azure Front Door Standard/Premium/(classic) and Azure CDN from Microsoft (classic) in alignment with its commitment to stop allowing domain fronting behavior on its platform. Once blocking domain fronting is enabled, AFD and CDN resources will block any HTTP request that exhibits this behavior.
222174
If this behavior is enabled for your resource, requests where Host header in HTTP/HTTPS requests doesn't match the original TLS SNI extension used during the TLS negotiation, will be blocked.
223175
224176
If you wish to block domain fronting for any existing Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources or for new Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources, please create a support request and provide your subscription and
@@ -252,7 +204,7 @@ sections:
252204
- question: |
253205
What is the retention policy on the diagnostics logs?
254206
answer: |
255-
Diagnostic logs flow to the customers storage account and customers can set the retention policy based on their preference. Diagnostic logs can also be sent to an Event Hub or Azure Monitor logs. For more information, see [Azure Front Door Diagnostics](front-door-diagnostics.md).
207+
Diagnostic logs flow to the customers storage account and customers can set the retention policy based on their preference. Diagnostic logs can also be sent to an Event Hubs or Azure Monitor logs. For more information, see [Azure Front Door Diagnostics](front-door-diagnostics.md).
256208
257209
- question: |
258210
How do I get audit logs for Azure Front Door?

articles/frontdoor/origin-security.md

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
---
2+
title: Secure traffic to origins - Azure Front Door
3+
description: This article explains how to restrict traffic to your origins to ensure it's been processed by Azure Front Door.
4+
services: front-door
5+
author: johndowns
6+
ms.service: frontdoor
7+
ms.topic: conceptual
8+
ms.workload: infrastructure-services
9+
ms.date: 10/25/2022
10+
ms.author: jodowns
11+
zone_pivot_groups: front-door-tiers
12+
---
13+
14+
# Secure traffic to Azure Front Door origins
15+
16+
Front Door's features work best when traffic only flows through Front Door. You should configure your origin to block traffic that hasn't been sent through Front Door. Otherwise, traffic might bypass Front Door's web application firewall, DDoS protection, and other security features.
17+
18+
::: zone pivot="front-door-classic"
19+
20+
> [!NOTE]
21+
> *Origin* and *origin group* in this article refers to the backend and backend pool of the Azure Front Door (classic) configuration.
22+
23+
::: zone-end
24+
25+
::: zone pivot="front-door-standard-premium"
26+
27+
Front Door provides several approaches that you can use to restrict your origin traffic.
28+
29+
## Private Link origins
30+
31+
When you use the premium SKU of Front Door, you can use Private Link to send traffic to your origin. [Learn more about Private Link origins.](private-link.md)
32+
33+
You should configure your origin to disallow traffic that doesn't come through Private Link. The way that you restrict traffic depends on the type of Private Link origin you use:
34+
35+
- Azure App Service and Azure Functions automatically disable access through public internet endpoints when you use Private Link. For more information, see [Using Private Endpoints for Azure Web App](../app-service/networking/private-endpoint.md).
36+
- Azure Storage provides a firewall, which you can use to deny traffic from the internet. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md).
37+
- Internal load balancers with Azure Private Link service aren't publicly routable. You can also configure network security groups to ensure that you disallow access to your virtual network from the internet.
38+
39+
::: zone-end
40+
41+
## Public IP address-based origins
42+
43+
When you use public IP address-based origins, there are two approaches you should use together to ensure that traffic flows through your Front Door instance:
44+
45+
- Configure IP address filtering to ensure that requests to your origin are only accepted from the Front Door IP address ranges.
46+
- Configure your application to verify the `X-Azure-FDID` header value, which Front Door attaches to all requests to the origin, and ensure that its value matches your Front Door's identifier.
47+
48+
### IP address filtering
49+
50+
Configure IP address filtering for your origins to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.
51+
52+
The *AzureFrontDoor.Backend* service tag provides a list of the IP addresses that Front Door uses to connect to your origins. You can use this service tag within your [network security group rules](../virtual-network/network-security-groups-overview.md#security-rules). You can also download the [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) data set, which is updated regularly with the latest IP addresses.
53+
54+
You should also allow traffic from Azure's [basic infrastructure services](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) through the virtualized host IP addresses `168.63.129.16` and `169.254.169.254`.
55+
56+
> [!WARNING]
57+
> Front Door's IP address space changes regularly. Ensure that you use the *AzureFrontDoor.Backend* service tag instead of hard-coding IP addresses.
58+
59+
### Front Door identifier
60+
61+
IP address filtering alone isn't sufficient to secure traffic to your origin, because other Azure customers use the same IP addresses. You should also configure your origin to ensure that traffic has originated from *your* Front Door profile.
62+
63+
Azure generates a unique identifier for each Front Door profile. You can find the identifier in the Azure portal, by looking for the *Front Door ID* value in the Overview page of your profile.
64+
65+
When Front Door makes a request to your origin, it adds the `X-Azure-FDID` request header. Your origin should inspect the header on incoming requests, and reject requests where the value doesn't match your Front Door profile's identifier.
66+
67+
### Example configuration
68+
69+
The following examples show how you can secure different types of origins.
70+
71+
# [App Service and Functions](#tab/app-service-functions)
72+
73+
You can use [App Service access restrictions](../app-service/app-service-ip-restrictions.md#restrict-access-to-a-specific-azure-front-door-instance) to perform IP address filtering as well as header filtering. The capability is provided by the platform, and you don't need to change your application or host.
74+
75+
# [Application Gateway](#tab/application-gateway)
76+
77+
Application Gateway is deployed into your virtual network. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
78+
79+
Use a custom WAF rule to check the `X-Azure-FDID` header value. For more information, see [Create and use Web Application Firewall v2 custom rules on Application Gateway](../web-application-firewall/ag/create-custom-waf-rules.md#example-7).
80+
81+
# [IIS](#tab/iis)
82+
83+
When you run [Microsoft Internet Information Services (IIS)](https://www.iis.net/) on an Azure-hosted virtual machine, you should create a network security group in the virtual network that hosts the virtual machine. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
84+
85+
Use an IIS configuration file like in the following example to inspect the `X-Azure-FDID` header on your incoming requests:
86+
87+
```xml
88+
<?xml version="1.0" encoding="UTF-8"?>
89+
<configuration>
90+
<system.webServer>
91+
<rewrite>
92+
<rules>
93+
<rule name="Filter_X-Azure-FDID" patternSyntax="Wildcard" stopProcessing="true">
94+
<match url="*" />
95+
<conditions>
96+
<add input="{HTTP_X_AZURE_FDID}" pattern="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" negate="true" />
97+
</conditions>
98+
<action type="AbortRequest" />
99+
</rule>
100+
</rules>
101+
</rewrite>
102+
</system.webServer>
103+
</configuration>
104+
```
105+
106+
# [AKS NGINX controller](#tab/aks-nginx)
107+
108+
When you run [AKS with an NGINX ingress controller](../aks/ingress-basic.md), you should create a network security group in the virtual network that hosts the AKS cluster. Configure a network security group rule to allow inbound access on ports 80 and 443 from the *AzureFrontDoor.Backend* service tag, and disallow inbound traffic on ports 80 and 443 from the *Internet* service tag.
109+
110+
Use a Kubernetes ingress configuration file like in the following example to inspect the `X-Azure-FDID` header on your incoming requests:
111+
112+
```yaml
113+
apiVersion: networking.k8s.io/v1
114+
kind: Ingress
115+
metadata:
116+
name: frontdoor-ingress
117+
annotations:
118+
kubernetes.io/ingress.class: nginx
119+
nginx.ingress.kubernetes.io/enable-modsecurity: "true"
120+
nginx.ingress.kubernetes.io/modsecurity-snippet: |
121+
SecRuleEngine On
122+
SecAuditLog /var/log/modsec_audit.log
123+
SecRule REQUEST_HEADERS:X-Azure-FDID "!@eq xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "log,deny,id:107,status:403,msg:\'Traffic incoming from a different Frontdoor\'"
124+
spec:
125+
#section omitted on purpose
126+
```
127+
128+
---
129+
130+
## Next steps
131+
132+
- Learn how to configure a [WAF profile on Front Door](front-door-waf.md).
133+
- Learn how to [create a Front Door](quickstart-create-front-door.md).
134+
- Learn [how Front Door works](front-door-routing-architecture.md).

0 commit comments

Comments
 (0)