Skip to content

Commit 7396048

Browse files
v-ccolinv-ccolin
authored
Merge pull request #208235 from johndowns/waf-front-door-pivot
Front Door WAF - Add pivots for standard/premium changes
2 parents f18c4c5 + 85fb39c commit 7396048

File tree

5 files changed

+265
-32
lines changed

5 files changed

+265
-32
lines changed

‎articles/web-application-firewall/afds/afds-overview.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: web-application-firewall
55
author: vhorne
66
ms.service: web-application-firewall
77
ms.topic: conceptual
8-
ms.date: 05/06/2022
8+
ms.date: 08/16/2022
99
ms.author: victorh
1010
---
1111

@@ -104,7 +104,7 @@ Unknown bots are classified via published user agents without additional validat
104104

105105
![Bot Protection Rule Set](../media/afds-overview/botprotect2.png)
106106

107-
If bot protection is enabled, incoming requests that match bot rules are logged at the FrontdoorWebApplicationFirewallLog log. You may access WAF logs from a storage account, event hub, or log analytics.
107+
If bot protection is enabled, incoming requests that match bot rules are logged. You may access WAF logs from a storage account, event hub, or log analytics.
108108

109109
## Configuration
110110

‎articles/web-application-firewall/afds/waf-front-door-configure-custom-response-code.md

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ services: web-application-firewall
55
author: vhorne
66
ms.service: web-application-firewall
77
ms.topic: article
8-
ms.date: 06/10/2020
8+
ms.date: 08/16/2022
99
ms.author: victorh
1010
ms.custom: devx-track-azurepowershell
11-
11+
zone_pivot_groups: front-door-tiers
1212
---
1313

1414
# Configure a custom response for Azure Web Application Firewall (WAF)
@@ -25,8 +25,17 @@ In the above example, we kept the response code as 403, and configured a short "
2525

2626
:::image type="content" source="../media/waf-front-door-configure-custom-response-code/custom-response.png" alt-text="Custom response example":::
2727

28-
"{{azure-ref}}" inserts the unique reference string in the response body. The value matches the TrackingReference field in the `FrontdoorAccessLog` and
29-
`FrontdoorWebApplicationFirewallLog` logs.
28+
::: zone pivot="front-door-standard-premium"
29+
30+
"{{azure-ref}}" inserts the unique reference string in the response body. The value matches the TrackingReference field in the `FrontDoorAccessLog` and `FrontDoorWebApplicationFirewallLog` logs.
31+
32+
::: zone-end
33+
34+
::: zone pivot="front-door-classic"
35+
36+
"{{azure-ref}}" inserts the unique reference string in the response body. The value matches the TrackingReference field in the `FrontdoorAccessLog` and `FrontdoorWebApplicationFirewallLog` logs.
37+
38+
::: zone-end
3039

3140
## Configure custom response status code and message use PowerShell
3241

‎articles/web-application-firewall/afds/waf-front-door-monitor.md

Lines changed: 83 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: vhorne
55
ms.service: web-application-firewall
66
ms.topic: article
77
services: web-application-firewall
8-
ms.date: 05/11/2022
8+
ms.date: 08/16/2022
99
ms.author: victorh
1010
zone_pivot_groups: front-door-tiers
1111
---
@@ -52,6 +52,7 @@ The following example query returns the access log entries:
5252
AzureDiagnostics
5353
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog"
5454
```
55+
5556
::: zone-end
5657

5758
::: zone pivot="front-door-classic"
@@ -65,6 +66,42 @@ AzureDiagnostics
6566

6667
The following shows an example log entry:
6768

69+
::: zone pivot="front-door-standard-premium"
70+
71+
```json
72+
{
73+
"time": "2020-06-09T22:32:17.8383427Z",
74+
"category": "FrontDoorAccessLog",
75+
"operationName": "Microsoft.Cdn/Profiles/AccessLog/Write",
76+
"properties": {
77+
"trackingReference": "08Q3gXgAAAAAe0s71BET/QYwmqtpHO7uAU0pDRURHRTA1MDgANjMxNTAwZDAtOTRiNS00YzIwLTljY2YtNjFhNzMyOWQyYTgy",
78+
"httpMethod": "GET",
79+
"httpVersion": "2.0",
80+
"requestUri": "https://wafdemofrontdoorwebapp.azurefd.net:443/?q=%27%20or%201=1",
81+
"requestBytes": "715",
82+
"responseBytes": "380",
83+
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4157.0 Safari/537.36 Edg/85.0.531.1",
84+
"clientIp": "xxx.xxx.xxx.xxx",
85+
"socketIp": "xxx.xxx.xxx.xxx",
86+
"clientPort": "52097",
87+
"timeTaken": "0.003",
88+
"securityProtocol": "TLS 1.2",
89+
"routingRuleName": "WAFdemoWebAppRouting",
90+
"rulesEngineMatchNames": [],
91+
"backendHostname": "wafdemowebappuscentral.azurewebsites.net:443",
92+
"sentToOriginShield": false,
93+
"httpStatusCode": "403",
94+
"httpStatusDetails": "403",
95+
"pop": "SJC",
96+
"cacheStatus": "CONFIG_NOCACHE"
97+
}
98+
}
99+
```
100+
101+
::: zone-end
102+
103+
::: zone pivot="front-door-classic"
104+
68105
```json
69106
{
70107
"time": "2020-06-09T22:32:17.8383427Z",
@@ -95,6 +132,8 @@ The following shows an example log entry:
95132
}
96133
```
97134

135+
::: zone-end
136+
98137
### WAF logs
99138

100139
::: zone pivot="front-door-standard-premium"
@@ -114,19 +153,29 @@ The following table shows the values logged for each request:
114153
| Property | Description |
115154
| ------------- | ------------- |
116155
| Action |Action taken on the request. Logs include requests with all actions. Metrics include requests with all actions except *Log*.|
117-
| ClientIp | The IP address of the client that made the request. If there was an `X-Forwarded-For` header in the request, the client IP address is taken from that header field instead. |
156+
| ClientIP | The IP address of the client that made the request. If there was an `X-Forwarded-For` header in the request, the client IP address is taken from that header field instead. |
118157
| ClientPort | The IP port of the client that made the request. |
119158
| Details | Additional details on the request, including any threats that were detected. <br />matchVariableName: HTTP parameter name of the request matched, for example, header names (up to 100 characters maximum).<br /> matchVariableValue: Values that triggered the match (up to 100 characters maximum). |
120159
| Host | The `Host` header of the request. |
121160
| Policy | The name of the WAF policy that processed the request. |
122161
| PolicyMode | Operations mode of the WAF policy. Possible values are `Prevention` and `Detection`. |
123162
| RequestUri | Full URI of the request. |
124163
| RuleName | The name of the WAF rule that the request matched. |
125-
| SocketIp | The source IP address seen by WAF. This IP address is based on the TCP session, and does not consider any request headers. |
164+
| SocketIP | The source IP address seen by WAF. This IP address is based on the TCP session, and does not consider any request headers. |
126165
| TrackingReference | The unique reference string that identifies a request served by Front Door. This value is sent to the client in the `X-Azure-Ref` response header. Use this field when searching for a specific request in the log. |
127166

128167
The following example query shows the requests that were blocked by the Front Door WAF:
129168

169+
::: zone pivot="front-door-standard-premium"
170+
171+
```kusto
172+
AzureDiagnostics
173+
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
174+
| where action_s == "Block"
175+
```
176+
177+
::: zone-end
178+
130179
::: zone pivot="front-door-classic"
131180

132181
```kusto
@@ -137,17 +186,41 @@ AzureDiagnostics
137186

138187
::: zone-end
139188

189+
The following shows an example log entry, including the reason that the request was blocked:
190+
140191
::: zone pivot="front-door-standard-premium"
141192

142-
```kusto
143-
AzureDiagnostics
144-
| where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorWebApplicationFirewallLog"
145-
| where action_s == "Block"
193+
```json
194+
{
195+
"time": "2020-06-09T22:32:17.8376810Z",
196+
"category": "FrontdoorWebApplicationFirewallLog",
197+
"operationName": "Microsoft.Cdn/Profiles/Write",
198+
"properties": {
199+
"clientIP": "xxx.xxx.xxx.xxx",
200+
"clientPort": "52097",
201+
"socketIP": "xxx.xxx.xxx.xxx",
202+
"requestUri": "https://wafdemofrontdoorwebapp.azurefd.net:443/?q=%27%20or%201=1",
203+
"ruleName": "Microsoft_DefaultRuleSet-1.1-SQLI-942100",
204+
"policy": "WafDemoCustomPolicy",
205+
"action": "Block",
206+
"host": "wafdemofrontdoorwebapp.azurefd.net",
207+
"trackingReference": "08Q3gXgAAAAAe0s71BET/QYwmqtpHO7uAU0pDRURHRTA1MDgANjMxNTAwZDAtOTRiNS00YzIwLTljY2YtNjFhNzMyOWQyYTgy",
208+
"policyMode": "prevention",
209+
"details": {
210+
"matches": [
211+
{
212+
"matchVariableName": "QueryParamValue:q",
213+
"matchVariableValue": "' or 1=1"
214+
}
215+
]
216+
}
217+
}
218+
}
146219
```
147220

148221
::: zone-end
149222

150-
The following shows an example log entry, including the reason that the request was blocked:
223+
::: zone pivot="front-door-classic"
151224

152225
```json
153226
{
@@ -177,6 +250,8 @@ The following shows an example log entry, including the reason that the request
177250
}
178251
```
179252

253+
::: zone-end
254+
180255
## Next steps
181256

182257
- Learn more about [Front Door](../../frontdoor/front-door-overview.md).

0 commit comments

Comments
 (0)