Skip to content

Update NAP Doc - Configure App Protect WAF - Custom Policies #1041

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 2, 2025
Merged

Update NAP Doc - Configure App Protect WAF - Custom Policies #1041

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8d36ff9
Update NAP Docs
kafeelhasan Sep 1, 2025
03f121d
Removed Extra Space
kafeelhasan Sep 1, 2025
eaee0e6
Merge branch 'main' into NLB-6573-Update-NAP-doc-filePath-change
mjang Sep 2, 2025
4931218
Addressed PR comments
kafeelhasan Sep 2, 2025
c6240e5
Merge branch 'main' into NLB-6573-Update-NAP-doc-filePath-change
mjang Sep 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions content/nginxaas-azure/app-protect/configure-waf.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,14 @@ To create a custom security policy in the Azure Portal:
3. Select **Custom Policies**
4. Select **Add Custom Security Policy** to open the policy editor

In the policy editor, enter the **Name**, **File path**, your policy content, and then select **Save**. The **File path** is optional and will default to the path "/etc/app_protect/conf/" plus the policy **Name** with a ".json" extension. After your policy has been saved, you can then reference it in your NGINX configuration. For more information on policy configuration and syntax, refer to the NGINX App Protect [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).
In the policy editor:

- Enter the **Name** (as a filename), **File path**, your policy content, and then select **Save**.

- Be sure to append the filename with ".json".
- The **File path** is automatically generated with "/etc/app_protect/conf/" as the default policies folder.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So user must now specify literally the '.json' for the extension to the filename. Why don't we call the filed 'File name' instead of 'Name'? Can I assume we check if the extension is missing (or some other value), and fail fast?
For the file path, are we saying they should not specify '/etc/app_protect/conf/' (i.e., enter only a relative path)? I'm not sure what the 'as the default policies folder' is implying. This seems to imply we can change the default. I believe all custom policies MUST be somewhere under this folder.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @russokj based on this discussion - https://github.com/nginxinc/nalb-shared/issues/1695
There is .json extension validation added to the file path, so if user doesn't give .json to the file path, it will ask to give that and save button will be disabled.
In the UI, it is mentioned as name, hence the same in the documentation.
Users need to set a complete file path either with default '/etc/app_protect/conf' or their own. - @happyhd can add more on this point.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, I was wrong, the filePath must be started with '/etc/app_protect/conf', so no custom file path setting is allowed. How about:

  • Enter the Name, File path, your policy content, and then select Save. The File path must be set with "/etc/app_protect/conf/" plus a file name with ".json" extension.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe they can set any filepath other than /etc/app_protect/conf/..., right? @happyhd


After your policy has been saved, you can then reference it in your NGINX configuration. For more information on policy configuration and syntax, refer to the NGINX App Protect [configuration guide](https://docs.nginx.com/nginx-app-protect-waf/v5/configuration-guide/configuration/).

{{< call-out "note" >}}The **name** field within the security policy must be unique among the policies referenced in your NGINX configuration.{{< /call-out >}}

Expand All @@ -128,4 +135,4 @@ It is highly recommended to use logging to monitor the performance of NGINX App

## What's next

[Enable App Protect WAF Logs]({{< ref "/nginxaas-azure/app-protect/enable-logging.md" >}})
[Enable App Protect WAF Logs]({{< ref "/nginxaas-azure/app-protect/enable-logging.md" >}})
Loading