Skip to content

Commit 8b079f2

Browse files
v-regandownerv-regandowner
authored
Merge pull request #301895 from JackStromberg/patch-4
AGC + WAF
2 parents f416066 + adfdd02 commit 8b079f2

File tree

10 files changed

+553
-11
lines changed

10 files changed

+553
-11
lines changed

‎articles/application-gateway/for-containers/application-gateway-for-containers-components.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: application-gateway
55
author: mbender-ms
66
ms.service: azure-appgw-for-containers
77
ms.topic: concept-article
8-
ms.date: 10/15/2024
8+
ms.date: 7/21/2025
99
ms.author: mbender
1010
# Customer intent: "As a cloud architect, I want to understand the components of Application Gateway for Containers, so that I can effectively configure and manage traffic routing to backend services in my cloud deployment."
1111
---
@@ -49,6 +49,14 @@ This article provides detailed descriptions and requirements for components of A
4949
- ALB Controller consists of two running pods.
5050
- alb-controller pod is responsible for orchestrating customer intent to Application Gateway for Containers load balancing configuration.
5151
- alb-controller-bootstrap pod is responsible for management of CRDs.
52+
53+
### Application Gateway for Containers security policy
54+
55+
- An Application Gateway for Containers security policy defines additional security configurations for the ALB Controller to consume.
56+
- Multiple security policies can be referred by a single Application Gateway for Containers resource.
57+
- At this time, the only security policy type offered is `waf` for web application firewall capabilities.
58+
- The `waf` security policy is a one-to-one mapping between the security policy resource and a Web Application Firewall policy.
59+
- Only one web application firewall policy may be referenced in any number of security policies for a defined Application Gateway for Containers resource.
5260

5361
## Azure / general concepts
5462

‎articles/application-gateway/for-containers/application-gateway-for-containers-metrics.md

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: application-gateway
55
author: mbender-ms
66
ms.service: azure-appgw-for-containers
77
ms.topic: concept-article
8-
ms.date: 02/27/2024
8+
ms.date: 7/21/2025
99
ms.author: mbender
1010

1111
# Customer intent: As an IT operations manager, I want to monitor performance metrics for Application Gateway for Containers, so that I can ensure optimal application performance and troubleshoot issues effectively.
@@ -18,13 +18,23 @@ Application Gateway for Containers publishes data points to [Azure Monitor](/azu
1818

1919
| Metric Name | Description | Aggregation Type | Dimensions |
2020
| ----------- | ----------- | ---------------- | ---------- |
21-
| Backend Connection Timeouts | Count of requests that timed out waiting for a response from the backend target (includes all retry requests initiated from Application Gateway for Containers to the backend target) | Total | Backend Service |
21+
| Backend Connection Timeouts | Count of requests that timed out waiting for a response from the backend target (includes all retry requests initiated from Application Gateway for Containers to the backend target) | Sum | Backend Service |
2222
| Backend Healthy Targets | Count of healthy backend targets | Avg | Backend Service |
23-
| Backend HTTP Response Status | HTTP response status returned by the backend target to Application Gateway for Containers | Total | Backend Service, HTTP Response Code |
24-
| Connection Timeouts | Count of connections closed due to timeout between clients and Application Gateway for Containers | Total | Frontend |
25-
| HTTP Response Status | HTTP response status returned by Application Gateway for Containers | Total | Frontend, HTTP Response Code |
26-
| Total Connection Idle Timeouts | Count of connections closed, between client and Application Gateway for Containers frontend, due to exceeding idle timeout | Total | Frontend |
27-
| Total Requests | Count of requests Application Gateway for Containers has served | Total | Frontend |
23+
| Backend HTTP Response Status | HTTP response status returned by the backend target to Application Gateway for Containers | Sum | Backend Service, HTTP Response Code |
24+
| Connection Timeouts | Count of connections closed due to timeout between clients and Application Gateway for Containers | Sum | Frontend |
25+
| HTTP Response Status | HTTP response status returned by Application Gateway for Containers | Sum | Frontend, HTTP Response Code |
26+
| Total Connection Idle Timeouts | Count of connections closed, between client and Application Gateway for Containers frontend, due to exceeding idle timeout | Sum | Frontend |
27+
| Total Requests | Count of requests Application Gateway for Containers has served | Sum | Frontend |
28+
29+
## WAF Metrics supported by Application Gateway for Containers
30+
31+
Metrics specific to requests processed by web application firewall functionality on Application Gateway for Containers.
32+
33+
| Metric Name | Description | Aggregation Type | Dimensions |
34+
| ----------- | ----------- | ---------------- | ---------- |
35+
| WAF Custom Rule Matches | Count of custom rule matches | Sum | Action, Country/Region, Mode, Policy Name, Policy Scope, Rule Name |
36+
| WAF Managed Rule Matches | Count of total managed rule matches | Sum | Action, Country/Region, Mode, Policy Name, Policy Scope, Rule Group, Rule ID, Rule Set Name |
37+
| WAF Total Requests | Count of successful requests that WAF engine has served | Sum | Action, Country/Region, Method, Mode, Policy Name, Policy Scope |
2838

2939
## View Application Gateway for Containers metrics
3040

‎articles/application-gateway/for-containers/diagnostics.md

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: application-gateway
55
author: mbender-ms
66
ms.service: azure-appgw-for-containers
77
ms.topic: concept-article
8-
ms.date: 9/16/2024
8+
ms.date: 7/21/2025
99
ms.author: mbender
1010
# Customer intent: As a cloud engineer, I want to enable and configure diagnostic logging for Application Gateway for Containers, so that I can monitor access patterns and troubleshoot performance issues effectively.
1111
---
@@ -26,6 +26,7 @@ You can use different types of logs in Azure to manage and troubleshoot Applicat
2626

2727
* **Activity log**: You can use [Azure activity logs](/azure/azure-monitor/essentials/activity-log) (formerly known as operational logs and audit logs) to view all operations that are submitted to your Azure subscription, and their status. Activity log entries are collected by default, and you can view them in the Azure portal.
2828
* **Access log**: You can use this log to view Application Gateway for Containers access patterns and analyze important information. This includes the caller's IP, requested URL, response latency, return code, and bytes in and out. An access log is collected every 60 seconds. The data may be stored in a storage account that is specified at time of enable logging.
29+
* **Firewall log**: You can use the Firewall log to view the requests that are logged through either detection or prevention mode of an application gateway for containers deployment that is configured with the web application firewall. Firewall logs are collected every 60 seconds.
2930

3031
### Configure access log
3132

@@ -146,3 +147,63 @@ Here an example of the access log emitted in JSON format to a storage account.
146147
"location": "northcentralus"
147148
}
148149
```
150+
151+
### Firewall log format
152+
153+
The firewall log is generated only if a security policy of type `WAF` is defined. Each firewall log entry in Application Gateway for Containers contains the following information.
154+
155+
| Value | Description |
156+
|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
157+
| TimeGenerated | Time (UTC) when the log was created. |
158+
| OperationName | Name of the operation. |
159+
| InstanceId | Application Gateway instance for which firewall data is being generated. For a multiple-instance application gateway, there is one row per instance. |
160+
| ClientIp | Originating IP for the request. |
161+
| ClientPort | Originating port for the request. |
162+
| Action | Action taken on the request. Available values are Blocked and Allowed (for custom rules), Matched (when a rule matches a part of the request), and Detected and Blocked (these are both for mandatory rules). |
163+
| Message | User-friendly message for the triggering event. More details are provided in the details section. |
164+
| DetailedMessage | Description of the rule for the triggered event. |
165+
| DetailedData | Specific data found in request that matched the rule for the triggered event. |
166+
| FileDetails | Configuration file that contained the rule for the triggered event. |
167+
| LineDetails | Line number in the configuration file that triggered the event. |
168+
| Hostname | Hostname or IP address of the Application Gateway. |
169+
| PolicyId | Resource ID of the web application firewall policy. |
170+
| PolicyScope | A named scope consisting of Kubernetes resource references the scope is applied to. |
171+
| PolicyScopeName | The name to the type of scope assignment the web application firewall policy is assigned to. |
172+
| RequestUri | URL of the received request. |
173+
| RuleSetType | Rule set type. The available value is Microsoft_DefaultRuleSet or Microsoft_BotManagerRuleSet. |
174+
| RuleSetVersion | Rule set version used for Microsoft_DefaultRuleSet or Microsoft_BotManagerRuleSet. |
175+
| RuleId | Rule ID of the triggering event. |
176+
| TrackingId | Generated guid by Application Gateway for Containers |
177+
178+
```json
179+
{
180+
"timeStamp": "2025-06-17T20:06:05+00:00",
181+
"resourceId": "/SUBSCRIPTIONS/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/RESOURCEGROUPS/YYYYYY/PROVIDERS/MICROSOFT.SERVICENETWORKING/TRAFFICCONTROLLERS/ZZZZZZZ",
182+
"operationName": "TrafficControllerFirewall",
183+
"category": "TrafficControllerFirewallLog",
184+
"properties": {
185+
"instanceId": "8a02ae47-8435-4f3d-84a5-6f5ded3763f5",
186+
"clientIp": "xxx.xxx.xxx.xxx",
187+
"requestUri": "\/?1=1=1",
188+
"ruleSetType": "Microsoft_DefaultRuleSet",
189+
"ruleSetVersion": "2.1",
190+
"ruleId": "949110",
191+
"ruleGroup": "BLOCKING-EVALUATION",
192+
"message": "Inbound Anomaly Score Exceeded (Total Score: 5)",
193+
"action": "Blocked",
194+
"details": {
195+
"message": "Greater and Equal to Tx:inbound_anomaly_score_threshold at TX:anomaly_score.",
196+
"data": "",
197+
"file": "BLOCKING-EVALUATION.conf",
198+
"line": "36"
199+
},
200+
"hostName": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.fzXX.alb.azure.com",
201+
"trackingId": "0ef125db-7fb7-48a0-b3fe-03fe0ffed873",
202+
"policyId": "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/YYYYYY/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/ZZZZZZZ",
203+
"policyScope": "HTTPRoute-test-infra-contoso-waf-route-rule-0-match-0-waf.fzXX.alb.azure.com",
204+
"policyScopeName": "Route",
205+
"engine": "Azwaf"
206+
},
207+
"location": "northcentralus"
208+
}
209+
```

0 commit comments

Comments
 (0)