Use WAF prevention mode

March 21, 2025 · View on GitHub

SYNOPSIS

Internet exposed Application Gateways should use prevention mode to protect backend resources.

DESCRIPTION

Application Gateways with Web Application Firewall (WAF) enabled support two modes of operation:

Detection - Monitors and logs all threat alerts. In this mode, the WAF doesn't block incoming requests that are potentially malicious.
Protection - Blocks potentially malicious attack patterns that the rules detect.

RECOMMENDATION

Consider switching Internet exposed Application Gateways to use prevention mode to protect backend resources.

EXAMPLES

Configure with Azure template

To deploy Application Gateways that pass this rule:

Set the properties.webApplicationFirewallConfiguration.firewallMode property to Prevention.

For example:

{
    "type": "Microsoft.Network/applicationGateways",
    "apiVersion": "2020-11-01",
    "name": "appGw-001",
    "location": "[resourceGroup().location]",
    "properties": {
        "sku": {
            "name": "WAF_v2",
            "tier": "WAF_v2"
        },
        "webApplicationFirewallConfiguration": {
            "enabled": true,
            "firewallMode": "Prevention",
            "ruleSetType": "OWASP",
            "ruleSetVersion": "3.2",
            "disabledRuleGroups": [],
            "requestBodyCheck": true,
            "maxRequestBodySizeInKb": 128,
            "fileUploadLimitInMb": 100
        }
    }
}

Configure with Bicep

To deploy Application Gateways that pass this rule:

Set the properties.webApplicationFirewallConfiguration.firewallMode property to Prevention.

For example:

resource name_resource 'Microsoft.Network/applicationGateways@2019-09-01' = {
  name: 'appGw-001'
  location: location
  properties: {
    sku: {
      name: 'WAF_v2'
      tier: 'WAF_v2'
    }
    webApplicationFirewallConfiguration: {
      enabled: true
      firewallMode: 'Prevention'
      ruleSetType: 'OWASP'
      ruleSetVersion: '3.2'
      disabledRuleGroups: []
      requestBodyCheck: true
      maxRequestBodySizeInKb: 128
      fileUploadLimitInMb: 100
    }
  }
}

Configure with Azure CLI

az network application-gateway waf-config set --enabled true --firewall-mode Prevention -n '<name>' -g '<resource_group>'

Configure with Azure PowerShell

$AppGw = Get-AzApplicationGateway -Name '<name>' -ResourceGroupName '<resource_group>'
Set-AzApplicationGatewayWebApplicationFirewallConfiguration -ApplicationGateway $AppGw -Enabled $True -FirewallMode 'Prevention'