App Gateway on Azure is a seven-tier load balancing service, and WAF is an extension of App Gateway services. The seven-tier load balancer adds the functionality of the WAF to protect the HTTP service in the background.
Azure WAF is based on the WAF functionality implemented by the open source modsecurity owasp core rule sets. Please refer to Modsecurity's website for details: https://modsecurity.org/
The current version of Azure support for owasp CRS has 3.0 and 2.2.92 versions. You can also enable or disable a feature in the library, depending on your needs:
This article describes a feature that is not currently supported by app Gateway and WAF: HTTP jumps to HTTPS with Haproxy implementation.
First, the topological structure
The specific structure is as follows:
1. The user initiates an HTTP request,
2. APP Gateway forwards the 80 port of Haproxy to the backend based on the backend server situation,
3. Haproxy HTTP request, do HTTP redirect, to the app gateway HTTPS
4. User initiated HTTPS request
5. The APP gateway is SSL-offload, and if a WAF is configured, HTTP content will be detected to prevent various attacks
6. The APP gateway forwards 8080 ports to haproxy,haproxy and forwards 8080 requests to the Nginx 800 port, based on the backend server situation.
Second, the APP gateway configuration
The specific creation process no longer describes the two definitions of rule that describe HTTP and https:
1. Listener
Configuring HTTP and HTTPS two x Listner
2. Rules
Rules for http:
HTTPSD Rules:
3. HTTP setting
To add HTTPS settings:
The rest is OK with the default configuration.
Third, the configuration of Haproxy
Install Haproxy in the VM and add the following configuration:
#---------------------------------------------------------------------# main FrontendwhichProxys to the backends#---------------------------------------------------------------------Frontend main*: themode httpredirect location https://x.x.x.xFrontend main *:8080mode httpdefault_backend static#---------------------------------------------------------------------# static Backend forserving up images, stylesheets and such#---------------------------------------------------------------------backend staticbalance roundrobinserver static127.0.0.1: -Check
As you can see, the Haproxy listens on 80 and 80,802 ports. A 80-port request will be forwarded directly to the app Gateway's https,8080 port and will be routed to the 800-port Nginx service.
Iv. Configuration of Nignx
Nginx only need to change the service port to 800.
V. Testing
Browser Enter the address of the app Gateway:
http://139.219.232.180/
will be forwarded to https:
HTTP jump HTTPS for app gateway or WAF via Haproxy on Azure