azure-web-application-firewall

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Azure Web Application Firewall Skill

Azure Web Application Firewall Skill

This skill provides expert guidance for Azure Web Application Firewall. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.
本技能为Azure Web Application Firewall提供专业指导,涵盖故障排查、最佳实践、决策制定、架构与设计模式、限制与配额、安全、配置、集成与编码模式,以及部署。它结合了本地快速参考内容与远程文档获取能力。

How to Use This Skill

如何使用本技能

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g.,
L35-L120
), use
read_file
with the specified lines. For categories with file links (e.g.,
[security.md](security.md)
), use
read_file
on the linked reference file
IMPORTANT for Agent: If
metadata.generated_at
is more than 3 months old, suggest the user pull the latest version from the repository. If
mcp_microsoftdocs
tools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
  • Preferred: Use
    mcp_microsoftdocs:microsoft_docs_fetch
    with query string
    from=learn-agent-skill
    . Returns Markdown.
  • Fallback: Use
    fetch_webpage
    with query string
    from=learn-agent-skill&accept=text/markdown
    . Returns Markdown.
Agent注意事项:使用下方的分类索引定位相关章节。对于带有行范围的分类(如
L35-L120
),使用
read_file
读取指定行内容。对于带有文件链接的分类(如
[security.md](security.md)
),使用
read_file
读取链接的参考文件
Agent注意事项:如果
metadata.generated_at
的时间超过3个月,建议用户从仓库拉取最新版本。如果
mcp_microsoftdocs
工具不可用,建议用户安装该工具:安装指南
本技能需要网络访问权限以获取文档内容:
  • 优先方式:使用
    mcp_microsoftdocs:microsoft_docs_fetch
    ,并携带查询字符串
    from=learn-agent-skill
    ,返回Markdown格式内容。
  • 备用方式:使用
    fetch_webpage
    ,并携带查询字符串
    from=learn-agent-skill&accept=text/markdown
    ,返回Markdown格式内容。

Category Index

分类索引

CategoryLinesDescription
TroubleshootingL37-L43Diagnosing and fixing common Azure WAF issues on Front Door and Application Gateway, including false positives, blocked requests, rule tuning, and investigating WAF logs.
Best PracticesL44-L52Best practices for configuring, tuning, and hardening Azure WAF on Front Door and Application Gateway, including rule tuning, exclusions, geomatch rules, and deployment security.
Decision MakingL53-L59Guidance on planning and executing migration from legacy WAF configs to full WAF policies, and choosing/upgrading the appropriate Azure WAF managed rulesets.
Architecture & Design PatternsL60-L64Architectural guidance for designing DDoS-resistant web apps using Azure WAF with Front Door, including traffic flow, protection layers, and best-practice deployment patterns.
Limits & QuotasL65-L69Configuring WAF request body and file upload size limits on Application Gateway, including max size settings, constraints, and how to safely adjust them.
SecurityL70-L76Details on WAF security rules (Front Door DRS), bot protection on Application Gateway, and enforcing WAF configurations and governance using Azure Policy.
ConfigurationL77-L123Configuring Azure WAF (Front Door & App Gateway): policies, custom/managed rules, rate limiting, geo/IP filters, bot/CAPTCHA, exclusions, logging/scrubbing, and custom block responses.
Integrations & Coding PatternsL124-L134Using WAF with other Azure services: integrating logs with Sentinel/Log Analytics, automating incident response, investigating events, and protecting APIM/Azure OpenAI via Front Door WAF.
DeploymentL135-L140How to deploy and provision Azure Application Gateway WAF v2 using Bicep, ARM templates, or Terraform, including required resources, parameters, and configuration structure.
分类行范围描述
故障排查L37-L43诊断并修复Front Door和Application Gateway上常见的Azure WAF问题,包括误报、请求被阻止、规则调优以及WAF日志调查。
最佳实践L44-L52在Front Door和Application Gateway上配置、调优和强化Azure WAF的最佳实践,包括规则调优、排除项、地理匹配规则以及部署安全。
决策制定L53-L59关于从传统WAF配置迁移到完整WAF策略的规划与执行指导,以及如何选择和升级合适的Azure WAF托管规则集。
架构与设计模式L60-L64使用Azure WAF与Front Door设计抗DDoS Web应用的架构指导,包括流量流向、防护层以及最佳实践部署模式。
限制与配额L65-L69在Application Gateway上配置WAF请求体和文件上传大小限制,包括最大大小设置、约束条件以及如何安全调整这些限制。
安全L70-L76详细介绍WAF安全规则(Front Door DRS)、Application Gateway上的机器人防护,以及如何使用Azure Policy强制实施WAF配置与治理。
配置L77-L123配置Azure WAF(Front Door和App Gateway):策略、自定义/托管规则、速率限制、地理/IP过滤、机器人验证(bot/CAPTCHA)、排除项、日志记录/ scrubbing,以及自定义阻止响应。
集成与编码模式L124-L134将WAF与其他Azure服务结合使用:将日志与Sentinel/Log Analytics集成、自动化事件响应、调查事件,以及通过Front Door WAF保护APIM/Azure OpenAI。
部署L135-L140如何使用Bicep、ARM模板或Terraform部署和配置Azure Application Gateway WAF v2,包括所需资源、参数以及配置结构。

Troubleshooting

故障排查

Best Practices

最佳实践

Decision Making

决策制定

Architecture & Design Patterns

架构与设计模式

TopicURL
Design application DDoS protection with Azure WAF and Front Doorhttps://learn.microsoft.com/en-us/azure/web-application-firewall/shared/application-ddos-protection

Limits & Quotas

限制与配额

TopicURL
Configure WAF request and file upload size limits on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits
主题链接
在Application Gateway上配置WAF请求与文件上传大小限制https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits

Security

安全

Configuration

配置

TopicURL
Configure CAPTCHA challenges in Azure Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/captcha-challenge
Configure custom block responses for Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-custom-response-code
Configure IP restriction rules in Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction
Create and attach a WAF policy in Azure Front Doorhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-portal
Define custom WAF rules for Azure Front Doorhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules
Configure Azure Front Door WAF custom and managed ruleshttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules-powershell
Configure exclusion lists for Front Door WAF policieshttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion
Set up WAF exclusion rules on Azure Front Doorhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion-configure
Configure geo-filtering rules in Azure Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-geo-filtering
Configure monitoring and logging for Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor
Enable and configure bot protection in Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-policy-configure-bot-protection
Configure Azure Front Door WAF policy-level settingshttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-policy-settings
Configure rate limiting policies in Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit
Create and tune WAF rate-limit rules on Front Doorhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-configure
Create a geo-filtering WAF policy with PowerShellhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tutorial-geo-filtering
Configure log scrubbing on Azure Front Door WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-sensitive-data-protection-configure-frontdoor
Enable sensitive data protection for Front Door WAF logshttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-sensitive-data-protection-frontdoor
Reference for Application Gateway WAF CRS and DRS ruleshttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules
Customize Application Gateway WAF rules using Azure CLIhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-cli
Customize Application Gateway WAF rules in Azure portalhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-portal
Customize Application Gateway WAF rules with PowerShellhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-powershell
Configure WAF exclusion lists on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration
Configure and analyze Application Gateway WAF metricshttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-metrics
Associate WAF policies with existing Application Gatewayshttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/associate-waf-policy-existing-gateway
Configure bot protection rules for Azure Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/bot-protection
Configure custom block response codes and pages for Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/configure-custom-response-code
Create WAF v2 custom rules with Azure PowerShellhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/configure-waf-custom-rules
Design and apply WAF v2 custom rules on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-custom-waf-rules
Create and attach WAF policies to Azure Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag
Overview of WAF v2 custom rules on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview
Configure HTTP DDoS ruleset for Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ddos-ruleset
Configure geomatch custom rules for Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/geomatch-custom-rules
Use Application Gateway WAF Insights dashboardshttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/insights
Configure per-site WAF policies with PowerShellhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies
Understand and scope WAF policies on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview
Create rate-limiting custom rules for Application Gateway WAF v2https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/rate-limiting-configure
Configure rate limiting for Azure Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/rate-limiting-overview
Upgrade CRS/DRS ruleset versions on Application Gateway WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/upgrade-ruleset-version
Configure sensitive data protection in WAF logshttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-sensitive-data-protection
Set up WAF log scrubbing on Application Gatewayhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-sensitive-data-protection-configure
Enable and manage logging for Azure WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs
Manage WAF policies centrally with Azure Firewall Managerhttps://learn.microsoft.com/en-us/azure/web-application-firewall/shared/manage-policies
Use JavaScript challenge for bot mitigation in WAFhttps://learn.microsoft.com/en-us/azure/web-application-firewall/waf-javascript-challenge
主题链接
在Azure Front Door WAF中配置CAPTCHA挑战https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/captcha-challenge
为Front Door WAF配置自定义阻止响应https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-custom-response-code
在Front Door WAF中配置IP限制规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction
在Azure Front Door中创建并附加WAF策略https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-portal
为Azure Front Door定义自定义WAF规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules
配置Azure Front Door WAF自定义与托管规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules-powershell
为Front Door WAF策略配置排除列表https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion
在Azure Front Door上设置WAF排除规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion-configure
在Azure Front Door WAF中配置地理过滤规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-geo-filtering
为Front Door WAF配置监控与日志记录https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-monitor
在Front Door WAF中启用并配置机器人防护https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-policy-configure-bot-protection
配置Azure Front Door WAF策略级设置https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-policy-settings
在Front Door WAF中配置速率限制策略https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit
在Front Door上创建并调优WAF速率限制规则https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-configure
使用PowerShell创建地理过滤WAF策略https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tutorial-geo-filtering
在Azure Front Door WAF上配置日志 scrubbinghttps://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-sensitive-data-protection-configure-frontdoor
为Front Door WAF日志启用敏感数据保护https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-sensitive-data-protection-frontdoor
Application Gateway WAF CRS与DRS规则参考https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules
使用Azure CLI自定义Application Gateway WAF规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-cli
在Azure门户中自定义Application Gateway WAF规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-portal
使用PowerShell自定义Application Gateway WAF规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-powershell
在Application Gateway上配置WAF排除列表https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration
配置并分析Application Gateway WAF指标https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-metrics
将WAF策略与现有Application Gateway关联https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/associate-waf-policy-existing-gateway
为Azure Application Gateway WAF配置机器人防护规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/bot-protection
为Application Gateway WAF配置自定义阻止响应代码与页面https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/configure-custom-response-code
使用Azure PowerShell创建WAF v2自定义规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/configure-waf-custom-rules
在Application Gateway上设计并应用WAF v2自定义规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-custom-waf-rules
为Azure Application Gateway创建并附加WAF策略https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag
Application Gateway上WAF v2自定义规则概述https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview
为Application Gateway WAF配置HTTP DDoS规则集https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ddos-ruleset
为Application Gateway WAF配置地理匹配自定义规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/geomatch-custom-rules
使用Application Gateway WAF Insights仪表板https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/insights
使用PowerShell配置每个站点的WAF策略https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies
了解并限定Application Gateway上的WAF策略范围https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview
为Application Gateway WAF v2创建速率限制自定义规则https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/rate-limiting-configure
为Azure Application Gateway WAF配置速率限制https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/rate-limiting-overview
在Application Gateway WAF上升级CRS/DRS规则集版本https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/upgrade-ruleset-version
在WAF日志中配置敏感数据保护https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-sensitive-data-protection
在Application Gateway上设置WAF日志 scrubbinghttps://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-sensitive-data-protection-configure
启用并管理Azure WAF日志记录https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs
使用Azure Firewall Manager集中管理WAF策略https://learn.microsoft.com/en-us/azure/web-application-firewall/shared/manage-policies
在WAF中使用JavaScript挑战缓解机器人攻击https://learn.microsoft.com/en-us/azure/web-application-firewall/waf-javascript-challenge

Integrations & Coding Patterns

集成与编码模式

Deployment

部署