How to block blacklisted resources in WAF (Azure Front Door / Application Gateway)?

Hi K Sec Greg,

Thanks for posting question in Microsoft Q&A forum,

It sounds like you want to block specific endpoints in your Azure Front Door Web Application Firewall (WAF) due to security concerns. You can achieve this by creating custom rules in your WAF policy. Here's a step-by-step guide to help you set it up:

1. Access Azure Portal: Navigate to the Azure portal and find your Azure Front Door service.
2. Create or Modify WAF Policy:
   • If you don’t have a WAF policy yet, you’ll need to create one. You can follow the Create a WAF policy for Azure Front Door by using the Azure portal guide.
   • If you already have a policy, click on it to modify.
3. Custom Rules:
   • Go to the "Custom rules" section within your WAF policy.
   • Add a new custom rule and define the match conditions. For your case, select the option to match against the request URI.
   • Set the condition to block requests if the URI matches /conf/users.xml or /debug/script.
4. Set the Action: Choose "Block" as the action for the rule you’re creating.
5. Priority Setting: Assign a priority to your new rule. Remember, lower numbers have higher priority, so ensure it's set appropriately so that it gets triggered before any other rules that might conflict.
6. Save and Deploy: After configuring your rules, save the WAF policy and deploy the changes.
7. Testing: Test the endpoints to ensure that they are blocked as intended.

This will ensure that any requests to those specific endpoints are blocked by your Azure Front Door WAF, providing you the immediate protection you need until you can apply application-level patches.

References:

• Overview: What is Azure web application firewall for Azure Front Door?
• Custom rules for web application firewall with Azure Front Door
• Create a WAF policy for Azure Front Door

If you have further questions or need more details about any specific step, feel free to ask!

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.