12. Azure Application Gateway and Azure WAF

Azure Application Gateway is essentially a load balancer for web traffic, but it also provides us with better traffic control. Traditional load balancers operate on the transport layer and allow us to route traffic based on protocol (TCP or UDP) and IP address, mapping IP addresses, and protocols in the frontend to IP addresses and protocols in the back end. This "classic" operation mode is often referred to as layer 4. Application gateway expands on that and allows us to use hostnames and paths to determine where traffic should go, making it a layer 7 load balancer. For example, we can have multiple servers that are optimized for different things. If one of our servers is optimized for video, then all video requests should be routed to that specific server based on the incoming URL request.

We will cover the following recipes in this chapter:

• Creating a new application gateway
• Configuring the backend...

Technical requirements

For this chapter, an Azure subscription is required.

Creating a new application gateway

Azure Application Gateway can be used as a simple load balancer to perform traffic distribution from the frontend to the backend based on protocols and ports. But it can also expand on that and perform additional routing based on hostnames and paths. This allows us to have resource pools based on rules and also allows us to optimize performance. Using these options and performing routing based on context will increase application performance, along with providing high availability. Of course, in this case, we need to have multiple resources for each performance type in each backend pool (each performance type requests a separate backend pool).

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to create a new application gateway, we must do the following:

1. In the Azure portal, select Create a resource and choose Application Gateway under Networking (or...

Configuring the backend pools

After the application gateway is created, we must define the backend pools. Traffic coming to the front end of the application gateway will be forwarded to the backend pools. Backend pools in application gateways are the same as backend pools in load balancers and are defined as possible destinations where traffic will be routed based on other settings that will be added in future recipes in this chapter.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to add backend pools to our application gateway, we must do the following:

1. In the Azure portal, locate the previously created application gateway.
2. In the Application gateway pane, under Settings, select Backend pools. Select Add to add a new backend pool or select an existing one to edit:
   

   Figure 12.12: Adding a backend pool to our application gateway

3. In the new pane, the only difference between new...

Configuring HTTP settings

HTTP settings in application gateways are used for validation and various traffic settings. Their main purpose is to ensure that requests are directed to the appropriate backend pool. Some other HTTP settings are also included, such as affinity or connection draining. Override settings are also part of HTTP settings—these will allow you to redirect if an incomplete or incorrect request is sent.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to add HTTP settings to our application gateway, we must do the following:

1. In the Azure portal, locate the previously created application gateway.
2. In the Application gateway pane, under Settings, select HTTP settings. Select Add to add a new HTTP setting or select an existing one to edit:
   

   Figure 12.14: Locating HTTP settings in the Application gateway pane

3. In the new pane, first, we need to provide a name...

Configuring listeners

Listeners in an application gateway listen for any incoming requests. After a new request is detected, it's forwarded to the backend pool based on the rules and settings we have defined. In this recipe, we will add a new listener to our application gateway.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to add a listener to an application gateway, we must do the following:

1. In the Azure portal, locate the previously created application gateway.
2. In the Application gateway pane, under Settings, select Listeners, then select Add listener to add a new listener, or edit an existing one:
   

   Figure 12.16: Adding a new listener through the Azure portal

3. In the new pane, we need to provide a name for the listener (if you are editing an existing listener, this option will be grayed out), select the Frontend IP configuration, and provide the Port and Protocol that...

Configuring rules

Rules in application gateways are used to determine how traffic flows. Different settings determine where a specific request is forwarded to and how this is done.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to add a rule to the application gateway, we must do the following:

1. In the Azure portal, locate the previously created application gateway.
2. In the Application gateway pane, under Settings, select Rules. Add a new rule or select an existing one to edit:
   

   Figure 12.18: Adding a routing rule for our application gateway

3. In the new pane, we must provide a name for the new rule (if you are editing an existing rule, this option is grayed out) and select the Listener, as shown in Figure 12.19:
   

   Figure 12.19: Configuring the routing rule

4. We also need to set up a backend target, where we need to define Target type and select options for Backend target and...

Configuring probes

Probes in application gateway are used to monitor the health of the backend targets. Each endpoint is monitored, and if one is found to be unhealthy, it is temporarily taken out of rotation and requests are not forwarded. Once the status changes, it's added back. This prevents requests from being sent to unhealthy endpoints that can't serve the request.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to add a probe to our application gateway, we must do the following:

1. In the Azure portal, locate the previously created application gateway.
2. In the Application gateway pane, under Settings, select Health probes. Select Add to add the new probe:
   

   Figure 12.21: Adding a new health probe

3. In the new pane, we must provide the Name of the probe (this option will be grayed out if an existing probe is edited), along with the Protocol, Host, and Path. We also...

Configuring a Web Application Firewall (WAF)

WAF is an additional setting for the application gateway. It's used to increase the security of applications behind the application gateway, and it also provides centralized protection.

Getting ready

To enable a WAF, we must set the application gateway to the WAF tier. To do so, we must do the following:

1. In the Application gateway pane, go to Web application firewall, under Settings. Change the Tier selection from Standard V2 to WAF V2 and select Save:
   

Figure 12.23: Setting the application gateway to the WAF V2 tier

How to do it...

After the application gateway is set to WAF, we can enable and set the firewall rules. To do so, we must do the following:

1. In the Application gateway pane, go to Web application firewall, under Settings, and enable Firewall status. After we set Firewall status to Enabled, a new set of options will appear:
   

   Figure 12.24: Enabling a WAF for our application gateway

2. We must...

Customizing WAF rules

A WAF comes with a predetermined set of rules. These rules are enforced to increase application security and prevent malicious requests. We can change these rules to address specific issues or requirements as needed.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to change the WAF rules, we must do the following:

1. Select Web application firewall under Settings in the Application gateway pane.
2. Select Rules in the WAF settings. Select Enabled under Advanced rule configuration, as shown in Figure 12.26:
   

   Figure 12.26: Enabling Advanced rule configuration

3. The rules will appear in the form of a list. We can check or uncheck boxes to enable or disable rules:
   

Figure 12.27: Customizing WAF rules in the Application gateway pane

How it works...

A WAF comes with all rules activated by default. This can slow down performance, so we can disable some of...

Creating a WAF policy

A WAF policy allows us to handle WAF settings and configurations as a separate resource. By doing so, we can apply the same policy to multiple resources instead of individual application gateways. A WAF policy can be associated with Application Gateway, Front Door, or CDN.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

In order to create a new application gateway, we must do the following:

1. In the Azure portal, select Create a resource and choose Web Application Firewall under Networking (or search for Web Application Firewall in the search bar).
2. In the new pane, we must complete the Basics section first. We need to set what the policy is going to be used for (Application Gateway, Front Door, or CDN), configure Subscription and Resource group, and fill in the Policy name and Location fields. Additionally, we can set whether the policy will be enabled or disabled once...