Skip to content

Commit fbc5ad6

Browse files
authored
Merge pull request #194309 from MicrosoftDocs/release-waf-per-rule-exclusions
Web Application Firewall - Add per-rule exclusions documentation
2 parents 510fb02 + 21f8d7c commit fbc5ad6

File tree

4 files changed

+248
-37
lines changed

4 files changed

+248
-37
lines changed

articles/web-application-firewall/ag/application-gateway-waf-configuration.md

Lines changed: 248 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -4,86 +4,297 @@ description: This article provides information on Web Application Firewall exclu
44
services: web-application-firewall
55
author: vhorne
66
ms.service: web-application-firewall
7-
ms.date: 03/08/2022
7+
ms.date: 04/21/2022
88
ms.author: victorh
99
ms.topic: conceptual
1010
ms.custom: devx-track-azurepowershell
1111
---
1212

1313
# Web Application Firewall exclusion lists
1414

15-
The Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications. This article describes the configuration for WAF exclusion lists. These settings are located in the WAF Policy associated to your Application Gateway. To learn more about WAF Policies, see [Azure Web Application Firewall on Azure Application Gateway](ag-overview.md) and [Create Web Application Firewall policies for Application Gateway](create-waf-policy-ag.md)
15+
The Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications. This article describes the configuration for WAF exclusion lists. These settings are located in the WAF policy associated to your Application Gateway. To learn more about WAF policies, see [Azure Web Application Firewall on Azure Application Gateway](ag-overview.md) and [Create Web Application Firewall policies for Application Gateway](create-waf-policy-ag.md).
1616

17-
Sometimes Web Application Firewall (WAF) might block a request that you want to allow for your application. WAF exclusion lists allow you to omit certain request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
17+
Sometimes WAF might block a request that you want to allow for your application. WAF exclusion lists allow you to omit certain request attributes from a WAF evaluation. The rest of the request is evaluated as normal.
1818

19-
For example, Active Directory inserts tokens that are used for authentication. When used in a request header, these tokens can contain special characters that may trigger a false positive from the WAF rules. By adding the header to an exclusion list, you can configure WAF to ignore the header, but WAF still evaluates the rest of the request.
19+
For example, Active Directory inserts tokens that are used for authentication. When used in a request header, these tokens can contain special characters that might trigger a false positive detection from the WAF rules. By adding the header to an exclusion list, you can configure WAF to ignore the header, but WAF still evaluates the rest of the request.
2020

21-
Exclusion lists are global in scope.
21+
You can configure exclusions to apply when specific WAF rules are evaluated, or to apply globally to the evaluation of all WAF rules. Exclusion rules apply to your whole web application.
2222

23-
To set exclusion lists in the Azure portal, configure **Exclusions** in the WAF policy resource's **Policy settings** page:
23+
## Identify request attributes to exclude
2424

25-
:::image type="content" source="../media/application-gateway-waf-configuration/waf-policy-exclusions.png" alt-text="Screenshot of the Azure portal that shows the exclusions configuration for the W A F policy.":::
25+
When you configure a WAF exclusion, you must specify the attributes of the request that should be excluded from the WAF evaluation. You can configure a WAF exclusion for the following request attributes:
2626

27-
## Attributes
28-
29-
The following attributes can be added to exclusion lists by name. The values of the chosen field aren't evaluated against WAF rules, but their names still are (see Example 1 below, the value of the User-Agent header is excluded from WAF evaluation). The exclusion lists remove inspection of the field's value.
30-
31-
* Request Headers
32-
* Request Cookies
27+
* Request headers
28+
* Request cookies
3329
* Request attribute name (args) can be added as an exclusion element, such as:
34-
3530
* Form field name
3631
* JSON entity
3732
* URL query string args
3833

39-
You can specify an exact request header, body, cookie, or query string attribute match. Or, you can optionally specify partial matches. Exclusion rules are global in scope, and apply to all pages and all rules.
40-
41-
The following are the supported match criteria operators:
34+
You can specify an exact request header, body, cookie, or query string attribute match. Or, you can specify partial matches. Use the following operators to configure the exclusion:
4235

4336
- **Equals**: This operator is used for an exact match. As an example, for selecting a header named **bearerToken**, use the equals operator with the selector set as **bearerToken**.
4437
- **Starts with**: This operator matches all fields that start with the specified selector value.
4538
- **Ends with**: This operator matches all request fields that end with the specified selector value.
4639
- **Contains**: This operator matches all request fields that contain the specified selector value.
4740
- **Equals any**: This operator matches all request fields. * will be the selector value.
4841

49-
In all cases matching is case insensitive and regular expression aren't allowed as selectors.
42+
In all cases matching is case insensitive. Regular expressions aren't allowed as selectors.
5043

5144
> [!NOTE]
5245
> For more information and troubleshooting help, see [WAF troubleshooting](web-application-firewall-troubleshoot.md).
5346
54-
## Examples
47+
### Request attributes by keys and values
48+
49+
When you configure an exclusion, you need to determine whether you want to exclude the key or the value from WAF evaluation.
50+
51+
For example, suppose your requests include this header:
52+
53+
```
54+
My-Header: 1=1
55+
```
56+
57+
The value of the header (`1=1`) might be detected as an attack by the WAF. But if you know this is a legitimate value for your scenario, you can configure an exclusion for the *value* of the header. To do so, you use the **RequestHeaderValues** request attribute, and select the header name (`My-Header`) with the value that should be ignored.
58+
59+
> [!NOTE]
60+
> Request attributes by key and values are only available in CRS 3.2 and newer.
61+
>
62+
> Request attributes by names work the same way as request attributes by values, and are included for backward compatibility with CRS 3.1 and earlier versions. We recommend you use request attributes by values instead of attributes by names. For example, use **RequestHeaderValues** instead of **RequestHeaderNames**.
63+
64+
In contrast, if your WAF detects the header's name (`My-Header`) as an attack, you could configure an exclusion for the header *key* by using the **RequestHeaderKeys** request attribute. The **RequestHeaderKeys** attribute is only available in CRS 3.2 and newer.
5565

56-
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
66+
## Exclusion scopes
5767

58-
The following examples demonstrate the use of exclusions.
68+
Exclusions can be configured to apply to a specific set of WAF rules, to rulesets, or globally across all rules.
5969

60-
### Example 1
70+
> [!TIP]
71+
> It's a good practice to make exclusions as narrow and specific as possible, to avoid accidentally leaving room for attackers to exploit your system. When you need to add an exclusion rule, use per-rule exclusions wherever possible.
6172
62-
In this example, you want to exclude the user-agent header. The user-agent request header contains a characteristic string that allows the network protocol peers to identify the application type, operating system, software vendor, or software version of the requesting software user agent. For more information, see [User-Agent](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent).
73+
### Per-rule exclusions
6374

64-
There can be any number of reasons to disable evaluating this header. There could be a string that the WAF sees and assumes it’s malicious. For example, the classic SQL attack “x=x” in a string. In some cases, this can be legitimate traffic. So you might need to exclude this header from WAF evaluation.
75+
You can configure an exclusion for a specific rule, group of rules, or rule set. You must specify the rule or rules that the exclusion applies to. You also need to specify the request attribute that should be excluded from the WAF evaluation.
6576

66-
The following Azure PowerShell cmdlet excludes the user-agent header from evaluation:
77+
Per-rule exclusions are available when you use the OWASP (CRS) ruleset version 3.2 or later.
78+
79+
#### Example
80+
81+
Suppose you want the WAF to ignore the value of the `User-Agent` request header. The `User-Agent` header contains a characteristic string that allows the network protocol peers to identify the application type, operating system, software vendor, or software version of the requesting software user agent. For more information, see [User-Agent](https://developer.mozilla.org/docs/Web/HTTP/Headers/User-Agent).
82+
83+
There can be any number of reasons to disable evaluating this header. There could be a string that the WAF detects and assumes it’s malicious. For example, the `User-Agent` header might include the classic SQL injection attack `x=x` in a string. In some cases, this can be legitimate traffic. So you might need to exclude this header from WAF evaluation.
84+
85+
You can use the following approaches to exclude the `User-Agent` header from evaluation by all of the SQL injection rules:
86+
87+
# [Azure portal](#tab/portal)
88+
89+
:::image type="content" source="../media/application-gateway-waf-configuration/waf-policy-exclusions-rule-edit.png" alt-text="Screenshot of the Azure portal that shows the per-rule exclusion configuration for the W A F policy.":::
90+
91+
# [Azure PowerShell](#tab/powershell)
6792

6893
```azurepowershell
69-
$exclusion1 = New-AzApplicationGatewayFirewallExclusionConfig `
70-
-MatchVariable "RequestHeaderNames" `
71-
-SelectorMatchOperator "Equals" `
72-
-Selector "User-Agent"
94+
$ruleGroupEntry = New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleGroup `
95+
-RuleGroupName 'REQUEST-942-APPLICATION-ATTACK-SQLI'
96+
97+
$exclusionManagedRuleSet = New-AzApplicationGatewayFirewallPolicyExclusionManagedRuleSet `
98+
-RuleSetType 'OWASP' `
99+
-RuleSetVersion '3.2' `
100+
-RuleGroup $ruleGroupEntry
101+
102+
$exclusionEntry = New-AzApplicationGatewayFirewallPolicyExclusion `
103+
-MatchVariable "RequestHeaderValues" `
104+
-SelectorMatchOperator 'Equals' `
105+
-Selector 'User-Agent' `
106+
-ExclusionManagedRuleSet $exclusionManagedRuleSet
107+
108+
$wafPolicy = Get-AzApplicationGatewayFirewallPolicy `
109+
-Name $wafPolicyName `
110+
-ResourceGroupName $resourceGroupName
111+
$wafPolicy.ManagedRules[0].Exclusions.Add($exclusionEntry)
112+
$wafPolicy | Set-AzApplicationGatewayFirewallPolicy
113+
```
114+
115+
# [Azure CLI](#tab/cli)
116+
117+
```azurecli
118+
az network application-gateway waf-policy managed-rule exclusion rule-set add \
119+
--resource-group $resourceGroupName \
120+
--policy-name $wafPolicyName \
121+
--type OWASP \
122+
--version 3.2 \
123+
--group-name 'REQUEST-942-APPLICATION-ATTACK-SQLI' \
124+
--match-variable 'RequestHeaderValues' \
125+
--match-operator 'Equals' \
126+
--selector 'User-Agent'
73127
```
74-
### Example 2
75128

76-
This example excludes the value in the *user* parameter that is passed in the request via the URL. For example, say it’s common in your environment for the user field to contain a string that the WAF views as malicious content, so it blocks it. You can exclude the user parameter in this case so that the WAF doesn't evaluate anything in the field.
129+
# [Bicep](#tab/bicep)
77130

78-
The following Azure PowerShell cmdlet excludes the user parameter from evaluation:
131+
```bicep
132+
resource wafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2021-05-01' = {
133+
name: wafPolicyName
134+
location: location
135+
properties: {
136+
managedRules: {
137+
managedRuleSets: [
138+
{
139+
ruleSetType: 'OWASP'
140+
ruleSetVersion: '3.2'
141+
}
142+
]
143+
exclusions: [
144+
{
145+
matchVariable: 'RequestHeaderValues'
146+
selectorMatchOperator: 'Equals'
147+
selector: 'User-Agent'
148+
exclusionManagedRuleSets: [
149+
{
150+
ruleSetType: 'OWASP'
151+
ruleSetVersion: '3.2'
152+
ruleGroups: [
153+
{
154+
ruleGroupName: 'REQUEST-942-APPLICATION-ATTACK-SQLI'
155+
}
156+
]
157+
}
158+
]
159+
}
160+
]
161+
}
162+
}
163+
}
164+
```
165+
166+
# [ARM template](#tab/armtemplate)
167+
168+
```json
169+
{
170+
"type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",
171+
"apiVersion": "2021-05-01",
172+
"name": "[parameters('wafPolicyName')]",
173+
"location": "[parameters('location')]",
174+
"properties": {
175+
"managedRules": {
176+
"managedRuleSets": [
177+
{
178+
"ruleSetType": "OWASP",
179+
"ruleSetVersion": "3.2"
180+
}
181+
],
182+
"exclusions": [
183+
{
184+
"matchVariable": "RequestHeaderValues",
185+
"selectorMatchOperator": "Equals",
186+
"selector": "User-Agent",
187+
"exclusionManagedRuleSets": [
188+
{
189+
"ruleSetType": "OWASP",
190+
"ruleSetVersion": "3.2",
191+
"ruleGroups": [
192+
{
193+
"ruleGroupName": "REQUEST-942-APPLICATION-ATTACK-SQLI"
194+
}
195+
]
196+
}
197+
]
198+
}
199+
]
200+
}
201+
}
202+
}
203+
```
204+
205+
---
206+
207+
### Global exclusions
208+
209+
You can configure an exclusion to apply across all WAF rules.
210+
211+
#### Example
212+
213+
Suppose you want to exclude the value in the *user* parameter that is passed in the request via the URL. For example, say it’s common in your environment for the `user` query string argument to contain a string that the WAF views as malicious content, so it blocks it. You can exclude all query string arguments where the name begins with the word `user`, so that the WAF doesn't evaluate the field's value.
214+
215+
The following example shows how you can exclude the `user` query string argument from evaluation:
216+
217+
# [Azure portal](#tab/portal)
218+
219+
:::image type="content" source="../media/application-gateway-waf-configuration/waf-policy-exclusions-global-edit.png" alt-text="Screenshot of the Azure portal that shows the global exclusion configuration for the W A F policy.":::
220+
221+
# [Azure PowerShell](#tab/powershell)
79222

80223
```azurepowershell
81-
$exclusion2 = New-AzApplicationGatewayFirewallExclusionConfig `
82-
-MatchVariable "RequestArgNames" `
83-
-SelectorMatchOperator "StartsWith" `
84-
-Selector "user"
224+
$exclusion = New-AzApplicationGatewayFirewallExclusionConfig `
225+
-MatchVariable 'RequestArgNames' `
226+
-SelectorMatchOperator 'StartsWith' `
227+
-Selector 'user'
228+
```
229+
230+
# [Azure CLI](#tab/cli)
231+
232+
```azurecli
233+
az network application-gateway waf-policy managed-rule exclusion add \
234+
--resource-group $resourceGroupName \
235+
--policy-name $wafPolicyName \
236+
--match-variable 'RequestArgNames' \
237+
--selector-match-operator 'StartsWith' \
238+
--selector 'user'
239+
```
240+
241+
# [Bicep](#tab/bicep)
242+
243+
```bicep
244+
resource wafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2021-05-01' = {
245+
name: wafPolicyName
246+
location: location
247+
properties: {
248+
managedRules: {
249+
managedRuleSets: [
250+
{
251+
ruleSetType: 'OWASP'
252+
ruleSetVersion: '3.2'
253+
}
254+
]
255+
exclusions: [
256+
{
257+
matchVariable: 'RequestArgNames'
258+
selectorMatchOperator: 'StartsWith'
259+
selector: 'user'
260+
}
261+
]
262+
}
263+
}
264+
}
85265
```
86-
So if the URL `http://www.contoso.com/?user%3c%3e=joe` is passed to the WAF, it won't evaluate the string **joe**, but it will still evaluate the parameter name **user%3c%3e**.
266+
267+
# [ARM template](#tab/armtemplate)
268+
269+
```json
270+
{
271+
"type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",
272+
"apiVersion": "2021-05-01",
273+
"name": "[parameters('wafPolicyName')]",
274+
"location": "[parameters('location')]",
275+
"properties": {
276+
"managedRules": {
277+
"managedRuleSets": [
278+
{
279+
"ruleSetType": "OWASP",
280+
"ruleSetVersion": "3.2"
281+
}
282+
],
283+
"exclusions": [
284+
{
285+
"matchVariable": "RequestArgNames",
286+
"selectorMatchOperator": "StartsWith",
287+
"selector": "user"
288+
}
289+
]
290+
}
291+
}
292+
}
293+
```
294+
295+
---
296+
297+
So if the URL `http://www.contoso.com/?user%3c%3e=joe` is scanned by the WAF, it won't evaluate the string **joe**, but it will still evaluate the parameter name **user%3c%3e**.
87298

88299
## Next steps
89300

Loading
88.3 KB
Loading

0 commit comments

Comments
 (0)