Skip to content

Commit e68a536

Browse files
v-edmckillopv-edmckillop
authored
Update partner-azure-web-application-firewall.md
1 parent 8811602 commit e68a536

File tree

1 file changed

+40
-39
lines changed

1 file changed

+40
-39
lines changed

‎articles/active-directory-b2c/partner-azure-web-application-firewall.md

Lines changed: 40 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.reviewer: kengaderdus
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: how-to
12-
ms.date: 08/17/2021
12+
ms.date: 03/08/2023
1313
ms.author: gasinh
1414
ms.subservice: B2C
1515
---
@@ -47,57 +47,58 @@ To enable WAF, configure a WAF policy and associate it with the AFD for protecti
4747

4848
### Create a WAF policy
4949

50-
To create a WAF policy with Azure-managed Default Rule Set (DRS):
50+
Create a WAF policy with Azure-managed default rule set (DRS). See, [Web Application Firewall DRS rule groups and rules](../web-application-firewall/afds/waf-front-door-drs.md).
51+
52+
1. Go to the [Azure portal](https://portal.azure.com).
53+
2. Select **Create a resource**.
54+
3. Search for Azure WAF.
55+
4. Select **Azure Web Application Firewall (WAF)**.
56+
5. Select **Create**.
57+
6. Go to the **Create a WAF policy** page.
58+
7. Select the **Basics** tab.
59+
8. For **Policy for**, select **Global WAF (Front Door)**.
60+
9. For **Front Door SKU**, select between **Basic**, **Standard**, or **Premium** SKU.
61+
10. For **Subscription**, select your Front Door subscription name.
62+
11. For **Resource group**, select your Front Door resource group name.
63+
12. For **Policy name**, enter a unique name for your WAF policy.
64+
13. For **Policy state**, select **Enabled**.
65+
14. For **Policy mode**, select **Detection**.
66+
15. Select **Review + create**.
67+
16. Go to the **Association** tab of the Create a WAF policy page.
68+
17. Select **+ Associate a Front Door profile**.
69+
18. For **Front Door**, select your Front Door name associated with Azure AD B2C custom domain.
70+
19. For **Domains**, select the Azure AD B2C custom domains to associate the WAF policy to.
71+
20. Select **Add**.
72+
21. Select **Review + create**.
73+
22. Select **Create**.
5174

52-
1. Go to the [Azure portal](https://portal.azure.com). Select **Create a resource** and then search for Azure WAF. Select **Azure Web Application Firewall (WAF)** > **Create**.
53-
54-
2. Go to the **Create a WAF policy** page, select the **Basics** tab. Enter the following information, accept the defaults for the remaining settings.
55-
56-
| Value | Description |
57-
|:--------|:-------|
58-
| Policy for | Global WAF (Front Door)|
59-
| Front Door SKU | Select between Basic, Standard, or Premium SKU |
60-
|Subscription | Select your Front Door subscription name |
61-
| Resource group | Select your Front Door resource group name |
62-
| Policy name | Enter a unique name for your WAF policy |
63-
| Policy state | Set as Enabled |
64-
| Policy mode | Set as Detection |
65-
66-
3. Select **Review + create**
67-
68-
4. Go to the **Association** tab of the Create a WAF policy page, select + **Associate a Front Door profile**, enter the following settings
69-
70-
| Value | Description |
71-
|:----|:------|
72-
| Front Door | Select your Front Door name associated with Azure AD B2C custom domain |
73-
| Domains | Select the Azure AD B2C custom domains you want to associate the WAF policy to|
75+
### Change policy mode from detection to prevention
7476

75-
5. Select **Add**.
77+
When you create WAF policy, the policy is in Detection mode. We recommend you don't disable Detection mode. In this mode, WAF doesn't block requests. Instead, requests that match the WAF rules are logged in the WAF logs.
7678

77-
6. Select **Review + create**, then select **Create**.
79+
Learn more: [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md)
7880

79-
### Change policy mode from detection to prevention
81+
The following query shows the requests blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode.
8082

81-
When a WAF policy is created, by default the policy is in Detection mode. In Detection mode, WAF doesn't block any requests, instead, requests matching the WAF rules are logged in the WAF logs. For more information about WAF logging, see [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md).
83+
![Screenshot of blocked requests](./media/partner-azure-web-application-firewall/blocked-requests-query.png)
8284

83-
The sample query shows all the requests that were blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode.
85+
![Screenshot of blocked requests details, such as Rule ID, Action, Mode, etc.](./media/partner-azure-web-application-firewall/blocked-requests-details.png)
8486

85-
![Image shows the blocked requests](./media/partner-azure-web-application-firewall/blocked-requests-query.png)
87+
Review the WAF logs to determine if policy rules cause false positives. Then, exclude the WAF rules based on the WAF logs.
8688

87-
![Image shows the blocked requests details](./media/partner-azure-web-application-firewall/blocked-requests-details.png)
89+
Learn more: [Define exclusion rules based on Web Application Firewall logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs)
8890

89-
It's recommended that you let the WAF capture requests in Detection mode. Review the WAF logs to determine if there are any rules in the policy that are causing false positive results. Then after [exclude the WAF rules based on the WAF logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs).
91+
#### Switch to prevention mode
9092

91-
To see WAF in action, use Switch to prevention mode to change from Detection to Prevention mode. All requests that match the rules defined in the Default Rule Set (DRS) are blocked and logged in the WAF logs.
93+
To see WAF operating, select **Switch to prevention mode**, which changes the mode from Detection to Prevention. Requests that match the rules in the DRS are blocked and logged in the WAF logs.
9294

93-
![Image shows the switch to prevention mode](./media/partner-azure-web-application-firewall/switch-to-prevention-mode.png)
95+
![Screenshot of options and selections for DefaultRuleSet under Web Application Firewall policies.](./media/partner-azure-web-application-firewall/switch-to-prevention-mode.png)
9496

95-
In case you want to switch back to the detection mode, you can do so by using Switch to detection mode option.
97+
To revert to Detection mode, select **Switch to detection mode**.
9698

97-
![Image shows the switch to detection mode](./media/partner-azure-web-application-firewall/switch-to-detection-mode.png)
99+
![Screenshot of DefaultRuleSet with Switch to detection mode.](./media/partner-azure-web-application-firewall/switch-to-detection-mode.png)
98100

99101
## Next steps
100102

101-
- [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md)
102-
103-
- [WAF with Front Door service exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md)
103+
* [Azure Web Application Firewall monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md)
104+
* [Web Application Firewall (WAF) with Front Door exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md)

0 commit comments

Comments
 (0)