3

I have a VNET with two App Services and one Windows VM in Azure. They are in the same VNET using VPN point-to-site.

I want to protect this environment with a WAF and have read that I can use Application Gateway WAF instead of the very expensive setup with App Service Environment and Barracuda.

Could anyone please explain how I can achieve this? The closest I have found is https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-web-application-firewall-portal .

asgautm
  • 49
  • 1
  • 3
  • Questions asking us to recommend or find a book, tool, software library, tutorial or other off-site resource are off-topic for Stack Overflow as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it. – astaykov Feb 15 '17 at 19:11
  • I have created a Application Gateway now and I would like to protect my whole VNET, as explained above, with this Gateway using the new WAF feature in Application Gateway. I need help how to start using the feature, and how to connect the VNET to the Application Gateway. – asgautm Feb 16 '17 at 19:27

3 Answers3

3

In case someone has the same question, starting from July 2017, the Azure Application Gateway with Web Application Firewall supports App Services deployed in the multi-tenant environment. As described here.

More information on how to configure it here.

Paco de la Cruz
  • 2,066
  • 13
  • 22
  • 1
    That's great, it doesn't explain how to then lock down access to the app service such that you can only go through the gateway to get to the app service – johnstaveley Aug 31 '17 at 10:26
  • 1
    @johnstaveley - appreciate things change and this feature may not have been available at the time however App Service IP Restrictions are available on App Service. This could be the right solution however given that we know public IPs assigned to App Gateways may change, this may or may not be the best way to achieve this. – Lewis Mar 07 '18 at 21:33
2

Support for Azure Web Apps as backend pool member is not currently supported on Application Gateway. However for App Service Environment (ASE) there is a workaround possible. Refer to this blog post - http://sabbour.me/how-to-run-an-app-service-behind-a-waf-enabled-application-gateway/

amsriva-msft
  • 319
  • 1
  • 5
1

You can use a NSG to lockdown the Internet calls and only allow calls from the AG to the ASE.

Daniël
  • 11
  • 1