Skip to content

Latest commit

 

History

History
133 lines (114 loc) · 8.1 KB

rate-limiting-configure.md

File metadata and controls

133 lines (114 loc) · 8.1 KB
Raw
title titleSuffix description services author ms.service ms.custom ms.date ms.author ms.topic
Create rate limiting custom rules for Application Gateway WAF v2
Azure Web Application Firewall
Learn how to configure rate limit custom rules for Application Gateway WAF v2.
web-application-firewall
joeolerich
azure-web-application-firewall
devx-track-azurepowershell, devx-track-azurecli
11/01/2023
victorh
how-to

Create rate limiting custom rules for Application Gateway WAF v2

Rate limiting enables you to detect and block abnormally high levels of traffic destined for your application. Rate Limiting works by counting all traffic that matches the configured Rate Limit rule and performing the configured action for traffic matching that rule which exceeds the configured threshold. For more information, see Rate limiting overview.

Configure Rate Limit Custom Rules

Use the following information to configure Rate Limit Rules for Application Gateway WAFv2.

Scenario One - Create rule to rate-limit traffic by Client IP that exceed the configured threshold, matching all traffic.

Portal

  1. Open an existing Application Gateway WAF Policy
  2. Select Custom Rules
  3. Add Custom Rule
  4. Add Name for the Custom Rule
  5. Select the Rate limit Rule Type radio button
  6. Enter a Priority for the rule
  7. Choose 1 minute for Rate limit duration
  8. Enter 200 for Rate limit threshold (requests)
  9. Select Client address for Group rate limit traffic by
  10. Under Conditions, choose IP address for Match Type
  11. For Operation, select the Does not contain radio button
  12. For match condition, under IP address or range, enter 255.255.255.255/32
  13. Leave action setting to Deny traffic
  14. Select Add to add the custom rule to the policy
  15. Select Save to save the configuration and make the custom rule active for the WAF policy.

PowerShell

$variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RemoteAddr 
$condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable -Operator IPMatch -MatchValue 255.255.255.255/32 -NegationCondition $True      
$groupByVariable = New-AzApplicationGatewayFirewallCustomRuleGroupByVariable -VariableName ClientAddr      
$groupByUserSession = New-AzApplicationGatewayFirewallCustomRuleGroupByUserSession -GroupByVariable $groupByVariable
$ratelimitrule = New-AzApplicationGatewayFirewallCustomRule -Name ClientIPRateLimitRule -Priority 90 -RateLimitDuration OneMin -RateLimitThreshold 100 -RuleType RateLimitRule -MatchCondition $condition -GroupByUserSession $groupByUserSession -Action Block -State Enabled

CLI

az network application-gateway waf-policy custom-rule create --policy-name ExamplePolicy --resource-group ExampleRG --action Block --name ClientIPRateLimitRule --priority 90 --rule-type RateLimitRule --rate-limit-threshold 100 --group-by-user-session '[{'"groupByVariables"':[{'"variableName"':'"ClientAddr"'}]}]'
az network application-gateway waf-policy custom-rule match-condition add --match-variables RemoteAddr --operator IPMatch --policy-name ExamplePolicy --name ClientIPRateLimitRule --resource-group ExampleRG --value 255.255.255.255/32 --negate true

Scenario Two - Create Rate Limit Custom Rule to match all traffic except for traffic originating from the United States. Traffic will be grouped, counted and rate limited based on the GeoLocation of the Client Source IP address

Portal

  1. Open an existing Application Gateway WAF Policy
  2. Select Custom Rules
  3. Add Custom Rule
  4. Add Name for the Custom Rule
  5. Select the Rate limit Rule Type radio button
  6. Enter a Priority for the rule
  7. Choose 1 minute for Rate limit duration
  8. Enter 500 for Rate limit threshold (requests)
  9. Select Geo location for Group rate limit traffic by
  10. Under Conditions, choose Geo location for Match Type
  11. In the Match variables section, select RemoteAddr for Match variable
  12. Select the Is not radio button for operation
  13. Select United States for Country/Region
  14. Leave action setting to Deny traffic
  15. Select Add to add the custom rule to the policy
  16. Select Save to save the configuration and make the custom rule active for the WAF policy.

PowerShell

$variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RemoteAddr 
$condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable -Operator GeoMatch -MatchValue "US" -NegationCondition $True
$groupByVariable = New-AzApplicationGatewayFirewallCustomRuleGroupByVariablde -VariableName GeoLocation 
$groupByUserSession = New-AzApplicationGatewayFirewallCustomRuleGroupByUserSession -GroupByVariable $groupByVariable 
$ratelimitrule = New-AzApplicationGatewayFirewallCustomRule -Name GeoRateLimitRule -Priority 95 -RateLimitDuration OneMin -RateLimitThreshold 500 -RuleType RateLimitRule -MatchCondition $condition -GroupByUserSession $groupByUserSession -Action Block -State Enabled

CLI

az network application-gateway waf-policy custom-rule create --policy-name ExamplePolicy --resource-group ExampleRG --action Block --name GeoRateLimitRule --priority 95 --rule-type RateLimitRule --rate-limit-threshold 500 --group-by-user-session '[{'"groupByVariables"':[{'"variableName"':'"GeoLocation"'}]}]'
az network application-gateway waf-policy custom-rule match-condition add --match-variables RemoteAddr --operator GeoMatch --policy-name ExamplePolicy --name GeoRateLimitRule --resource-group ExampleRG --value US --negate true

Scenario Three - Create Rate Limit Custom Rule matching all traffic for the login page, and using the GroupBy None variable. This will group and count all traffic which matches the rule as one, and apply the action across all traffic matching the rule (/login).

Portal

  1. Open an existing Application Gateway WAF Policy
  2. Select Custom Rules
  3. Add Custom Rule
  4. Add Name for the Custom Rule
  5. Select the Rate limit Rule Type radio button
  6. Enter a Priority for the rule
  7. Choose 1 minute for Rate limit duration
  8. Enter 100 for Rate limit threshold (requests)
  9. Select None for Group rate limit traffic by
  10. Under Conditions, choose String for Match Type
  11. In the Match variables section, select RequestUri for Match variable
  12. Select the Is not radio button for operation
  13. For Operator select contains
  14. Enter Login page path for match Value. In this example we use /login
  15. Leave action setting to Deny traffic
  16. Select Add to add the custom rule to the policy
  17. Select Save to save the configuration and make the custom rule active for the WAF policy.

PowerShell

$variable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RequestUri  
$condition = New-AzApplicationGatewayFirewallCondition -MatchVariable $variable -Operator Contains -MatchValue "/login" -NegationCondition $True  
$groupByVariable = New-AzApplicationGatewayFirewallCustomRuleGroupByVariable -VariableName None       
$groupByUserSession = New-AzApplicationGatewayFirewallCustomRuleGroupByUserSession -GroupByVariable $groupByVariable 
$ratelimitrule = New-AzApplicationGatewayFirewallCustomRule -Name LoginRateLimitRule -Priority 99 -RateLimitDuration OneMin -RateLimitThreshold 100 -RuleType RateLimitRule -MatchCondition $condition -GroupByUserSession $groupByUserSession -Action Block -State Enabled

CLI

az network application-gateway waf-policy custom-rule create --policy-name ExamplePolicy --resource-group ExampleRG --action Block --name LoginRateLimitRule --priority 99 --rule-type RateLimitRule --rate-limit-threshold 100 --group-by-user-session '[{'"groupByVariables"':[{'"variableName"':'"None"'}]}]'
az network application-gateway waf-policy custom-rule match-condition add --match-variables RequestUri --operator Contains --policy-name ExamplePolicy --name LoginRateLimitRule --resource-group ExampleRG --value '/login'

Next steps

Customize web application firewall rules