395 questions with Azure Web Application Firewall tags

Sort by: Updated
0 answers

Intermittent IPv6 Connection Hangs/Timeouts to Azure Front Door Endpoints (t-msedge.net) on Windows 11 and Linux

I am experiencing consistent connectivity issues when accessing websites hosted on the Microsoft Azure edge network (specifically endpoints like part-0016.t-0009.t-msedge.net) over IPv6. The connection hangs indefinitely during data transfer, while IPv4…

Azure Web Application Firewall
asked 2026-03-12T19:39:31.82+00:00
Jakub Kahoun 0 Reputation points
commented 2026-03-12T20:47:37.4033333+00:00
Ganesh Patapati 10,990 Reputation points Microsoft External Staff Moderator
1 answer

How to restrict /admin path access to VPN users while keeping the rest of the application publicly accessible?

I have an application hosted behind an Azure Application Gateway with WAF enabled and accessible through a public domain. The requirement is: The main application (e.g., https://example.com) should be accessible to everyone on the internet. The…

Azure Web Application Firewall
asked 2026-03-04T17:41:34.54+00:00
Hariprasath Durairaj 0 Reputation points
commented 2026-03-06T03:26:37.78+00:00
Praveen Bandaru 10,720 Reputation points Microsoft External Staff Moderator
1 answer

WAF custom rule for rate limiting only blocking every other request once limit is reached.

This is the rule that is being applied: This is an example of the output: Notice that the status codes alternate between 401 and 429. The rule is kicking in but does not persist. There are other articles that indicate others are observing this…

Azure Web Application Firewall
asked 2026-02-17T22:32:04.48+00:00
Steven Bruce 0 Reputation points
commented 2026-02-25T09:02:53.74+00:00
Ganesh Patapati 10,990 Reputation points Microsoft External Staff Moderator
3 answers One of the answers was accepted by the question author.

Allow ICMP over Azure APPGW - Firwall

Hello colleagues, We are using an Internet breakout solution which looks like below: Internet > AzureFw > Azure APPGW > LB > IPS > Azure vnet that contains Backends on which WebApps are being hosted, one of this applications for…

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

1,332 questions
Azure Web Application Firewall
asked 2023-01-04T13:46:41.327+00:00
Anonymous
commented 2026-02-24T20:23:34.4366667+00:00
Sujay Kumar J 0 Reputation points
1 answer

Multipart request body failed strict validation and Failed to parse request body while trying to upload files using multi-formdata

Trying to upload a file using the below code var multipartContent = new MultipartFormDataContent { { new StringContent("hrishi"), "createdBy" }, { new StringContent("hrishi"),…

Azure Web Application Firewall
asked 2023-04-03T13:26:11.3366667+00:00
T T, Hrishikesh (Cognizant) 0 Reputation points
commented 2026-02-21T00:25:40.5833333+00:00
Dickson Souza 0 Reputation points
2 answers One of the answers was accepted by the question author.

WebApplicationFirewallPolicy validation failed. Subscriptions without DeveloperPreview flag enabled cannot use Microsoft_DefaultRuleSet_2.2

Attempting to create or update WAF premium policy with DRS 2.2 and I get the error in title. I cannot find what feature to register either in the portal or in powershell/CLI - Nothing references DefaultRuleSet.

Azure Web Application Firewall
asked 2025-12-04T03:47:01.5833333+00:00
Justin M. Szwed 35 Reputation points
edited a comment 2026-02-19T08:55:35.9466667+00:00
Ravi Varma Mudduluru 7,990 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Issue with IP Whitelisting Configuration in Azure Front Door

We are using a web application with Azure Front Door service and are trying to implement IP whitelisting. Unfortunately, the setup is not functioning as expected. We need assistance in troubleshooting and fixing this issue. Please provide support as soon…

Azure Web Application Firewall
asked 2026-02-17T11:55:29.5866667+00:00
Shubham Sanap 100 Reputation points
accepted 2026-02-17T13:59:27.4+00:00
Shubham Sanap 100 Reputation points
1 answer

Azure WAF AllowFrontDoor stuck at "pending"

Hello Azure Support, I hope all is well. We are unable to create an Azure Front Door WAF policy in our subscription. The subscription feature Microsoft.Network/AllowFrontdoor remains in Pending for >36 hours, and WAF policy creation fails with a…

Azure Web Application Firewall
asked 2026-01-29T12:45:07.42+00:00
Thomas 25 Reputation points
commented 2026-02-17T13:10:21.5233333+00:00
Vallepu Venkateswarlu 6,045 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Is it possible to allow multiple cookies in a custom rule in Frontdoor WAF?

Hi. Like the title says. We have now a bunch of cookies that we need to allow through the WAF. We have solved this with exclusions for now, but I would like to move them to custom rule(s) to try and clean up the exclusion a bit. Is it possible to…

Azure Web Application Firewall
asked 2026-02-05T13:00:44.64+00:00
Sebastian Enström 25 Reputation points
commented 2026-02-09T12:48:14.1466667+00:00
Ganesh Patapati 10,990 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Azure Front Door WAF custom rules inconsistently applied - IP whitelist bypassed intermittently despite correct configuration

Problem Summary: We have configured custom IP whitelist rules in our Azure Front Door WAF policy, but they are being applied inconsistently. Access to our domain works intermittently from the same whitelisted IP address - sometimes returning HTTP 200…

Azure Web Application Firewall
asked 2026-01-19T15:50:24.4366667+00:00
Yukta Suthar 20 Reputation points
accepted 2026-01-23T10:38:46.5333333+00:00
Yukta Suthar 20 Reputation points
1 answer

SSL Import Error on Application Gateway LB

Hello, I wanted to add SSL to the Application Gateway I created. I exported the SSL certificate using a p7b file and uploaded the root certificate, intermediate certificate, and regular certificate. However, I received an error. The error image is below.…

Azure Web Application Firewall
asked 2026-01-21T08:36:06.0933333+00:00
SHK 0 Reputation points
answered 2026-01-21T09:03:14.6433333+00:00
Ganesh Patapati 10,990 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

Azure WAF false positive problems

Hi. Why does Azure WAF DRS 2.1 still have frequent false positives, and why hasn’t this been improved? thanks

Azure Web Application Firewall
asked 2026-01-09T05:23:56.4233333+00:00
Shigeru Nakagaki 205 Reputation points
accepted 2026-01-21T01:06:01.0066667+00:00
Shigeru Nakagaki 205 Reputation points
3 answers

How to block blacklisted resources in WAF (Azure Front Door / Application Gateway)?

Hi Team, I have a legacy java application (exposed site: https://japfd.centoso.com ) on WebLogic / Tomcat. We have identified two high-risky endpoints, unfortunately we cannot patch them in application side immediately: …

Azure Web Application Firewall
asked 2025-12-15T08:08:56.6133333+00:00
K Sec Greg 0 Reputation points
commented 2025-12-30T11:15:33.9566667+00:00
Yuval Pery 0 Reputation points Microsoft Employee
0 answers

Azure WAF exclude specific content-type header

Hi community, I am trying to make an exclusion for a ruleid which is triggered for [REQUEST_HEADERS:Content-Type:application/scim+json; charset=UTF-8]}. It seems pretty straightforward: Match on RequestHeaderValues contains: scim+json However the rule…

Azure Web Application Firewall
asked 2025-09-19T08:56:07.43+00:00
Emil Enchev 10 Reputation points
edited a comment 2025-12-24T09:37:28.38+00:00
Lukasz Zablocki 0 Reputation points
2 answers

WAF does not block traffic based on IP address

Hi, I have a web app running on VMSS behind Application Gateway. Azure Firewall is front facing for that application gateway and domain name is also mapped with Azure Firewall public ip address. This domain name is configured as listener in…

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

1,332 questions
Azure Web Application Firewall
asked 2021-09-23T12:54:36.037+00:00
Zeeshan 26 Reputation points
answered 2025-12-24T00:43:37.5166667+00:00
Brajesh Kumar 65 Reputation points
1 answer

azure custom waf rules disappeared

We have a set of custom rules in our waf. For some unknown reason after updating 1 rule, the entire custom rules were deleted. I checked activity logs, I did not find any delete operations. Anyone with a suggestion on where to check?

Azure Web Application Firewall
asked 2025-12-10T10:11:54.3166667+00:00
Gomolemo 105 Reputation points
answered 2025-12-10T11:06:27.33+00:00
Vallepu Venkateswarlu 6,045 Reputation points Microsoft External Staff Moderator
2 answers One of the answers was accepted by the question author.

WAF not allowing above 128KB file Upload

Hello Team, We have some scenario where we need to send large volume of data from Web UI (Front End) to the backend APIs for processing. Often, due to the nature of the business transaction, the data crossed the default limit set in WAF rule, 128KB. That…

Azure Web Application Firewall
asked 2025-11-27T11:46:01.52+00:00
Kaushik Dutta 185 Reputation points
edited a comment 2025-11-27T13:53:16.2433333+00:00
Vallepu Venkateswarlu 6,045 Reputation points Microsoft External Staff Moderator
3 answers

Azure FD Premium w/ WAF Custom Exclusion Rule Not Working

I have an Azure Front Door Premium instance with a WAF in Prevention Mode and Enabled. I created a simple exclusion rule to block traffic coming from my ip address but it is not blocking the traffic. I tried creating a support request but it just kept…

Azure Web Application Firewall
asked 2025-11-20T19:44:36.44+00:00
Michael Paterson 0 Reputation points
edited an answer 2025-11-27T11:38:42.52+00:00
Vallepu Venkateswarlu 6,045 Reputation points Microsoft External Staff Moderator
1 answer One of the answers was accepted by the question author.

WAF policy custom rule, for each condition, the limitation of match values

WAF policy custom rule, for each condition, the limitation of match values is 10 according to the document, but I can update through AzPowershell the match values to more than 10, will the match values that exceed the limit take effect?

Azure Web Application Firewall
asked 2025-11-17T02:37:24.4433333+00:00
Elisa 20 Reputation points
accepted 2025-11-19T01:42:20.14+00:00
Elisa 20 Reputation points
1 answer

How do I reduce the cost of a WAF to 0 without deleting it?

We are hibernating assets in Azure. How can I reduce the cost of a WAF to 0 without deleting it?

Azure Web Application Firewall
asked 2025-11-18T20:42:25.78+00:00
rowland hirst 0 Reputation points
answered 2025-11-18T22:14:35.39+00:00
Venkatesan S 4,660 Reputation points Microsoft External Staff Moderator