Azure Application Gateway: WAF & Load Balancing

In 2019, a single security breach in Capital One’s AWS infrastructure upended the enterprise. A misconfigured Web Application Firewall (WAF) allowed an attacker to access names, addresses, and bank account numbers of over 100 million customers.

The consequences? The bank holding company had to pay over $300 million in estimated total costs including fines, legal fees and settlements.

This is the price of not safeguarding your cloud infrastructure in the modern digital age. Milliseconds can cost you millions and cause irreparable reputational damage. Fortunately, Azure provides a comprehensive suite of services that allow you to build highly available, secure, and performant applications. Among these cloud managed services, Azure Application Gateway stands out as a robust tool for both WAF protection and load balancing.

Azure Application Gateway is a fully managed application delivery controller (ADC) that provides various capabilities such as load balancing, secure web traffic management, and intelligent routing. Integrating WAF with load balancing sets a solid foundation to protect your web applications from malicious attacks while handling traffic volumes with high availability.

In this blog, we’ll dive deep into Azure Application Gateway, explore how it functions as both a WAF and load balancer, and how you can use it to enhance the security and performance of your web applications.

What is Azure Application Gateway?

Azure Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that operates at the application layer of the OSI model. Unlike traditional layer 4 load balancers, which deal with network traffic (IP, TCP), Application Gateway works with web traffic and HTTP(S) requests, which makes it ideal for web applications.

It is like a traffic controller that can understand context. For example, Application Gateway ensures a request for a video stream doesn’t end up in the same backend pool as a lightweight API call. Azure enables this granularity through path-based routing and multi-site hosting.

Key features of Azure Application Gateway

Azure Application Gateway offers a rich set of features designed to enhance the
performance, security, and scalability of web applications. These are the most powerful cloud security solutions in its toolbox.

1. Web application firewall

The web application firewall is a key feature of Azure Application Gateway that helps protect your web applications from common web vulnerabilities and attacks. WAF inspects incoming traffic and blocks malicious requests, ensuring that only legitimate traffic reaches your web servers. This is a key security tool in all major cloud platforms, including Azure cloud security and AWS cloud security.

WAF has the following core functionalities:

OWASP Core Rule Set (CRS): WAF uses the OWASP CRS for cloud threat detection and to prevent attacks based on the OWASP Top 10 vulnerabilities, including SQL injection, cross-site scripting (XSS), and remote file inclusion.
Custom Rules: You can configure custom WAF rules to block specific attack patterns based on your application’s requirements.
Real-Time Monitoring: WAF integrates with Azure Monitor to provide real-time cloud monitoring and reporting about incoming traffic, allowing you to identify and respond to security threats quickly.
Protection Against DDoS: While WAF is not a replacement for a dedicated Distributed Denial of Service (DDoS) cloud security services, it can help mitigate some common types of attack traffic.

How WAF works

When a request is made to your web application, it passes through the Azure Application Gateway. WAF inspects the request and performs checks based on the defined security policies. If the request matches any known attack patterns or custom rules, WAF blocks the request and sends an alert to Azure Monitor.

2. Load balancing

Azure Application Gateway provides advanced load balancing capabilities to distribute incoming traffic across multiple backend servers. This ensures that your web applications can handle high traffic volumes efficiently and maintain high availability. It is a core part of cloud application development to make scalable, resilient, and high-performing web applications that can handle heavy user loads.

Load balancing has these key features:

URL-based Routing: Direct traffic to different backend pools based on URL paths. For example, you can route traffic for example.com/images to a backend pool dedicated to serving images.
SSL Termination: Application Gateway can offload SSL termination, decrypting HTTPS traffic before sending it to the backend servers. This reduces the load on your backend servers and simplifies certificate management.
Session Affinity (Sticky Sessions): Maintain session persistence by routing requests from the same client to the same backend server. This is useful for applications that store session data locally.
Multiple Backend Pools: You can configure multiple backend pools, allowing you to route traffic to different sets of servers based on criteria like URL path or host headers.
Autoscaling: The Application Gateway can automatically scale up or down based on traffic demand, ensuring that you have the right capacity to handle varying workloads.

How load balancing works

When a client makes an HTTP(S) request to your application, the Application Gateway forwards the request to an available backend server in one of the backend pools. The Gateway uses algorithms like round-robin, least connections, or weighted round-robin to balance the traffic across multiple servers.

3. Multi-site hosting

Azure Application Gateway supports multi-site hosting, which means you can use a single Application Gateway instance to host multiple applications or websites. This is ideal for scenarios where you have multiple web applications that share the same IP address but need to be routed to different backend pools based on the domain name or URL path.

Following are the essential features of multi-site hosting:

Host-based Routing: Route traffic based on the domain name (e.g., app1.example.com or app2.example.com), sending it to different backend pools.
Single IP for Multiple Sites: Host multiple sites behind a single public IP address, reducing the need for additional infrastructure.

4. Autoscaling

Azure Application Gateway supports autoscaling, which automatically adjusts the number of instances based on incoming traffic. This ensures that the application can handle varying traffic loads without manual intervention.

Autoscaling offers many benefits, such as:

Cost Efficiency: Only pay for the resources you use, as autoscaling adjusts capacity dynamically.
High Availability: Autoscaling ensures that your application can maintain performance and reliability during traffic spikes.

5. SSL offloading

SSL offloading allows you to terminate SSL connections at the Application Gateway rather than at your backend servers. This reduces the load on your backend servers and simplifies SSL certificate management.

This helps you manage your cloud infrastructure through:

Reduced Backend Load: Offloading SSL termination reduces the CPU usage on your backend servers, as they no longer need to handle encryption/decryption.
Simplified Certificate Management: Manage SSL certificates centrally on the Application Gateway, making it easier to update and renew certificates.

Using Azure Application Gateway for WAF and load balancing

Azure Application Gateway is a powerful solution for managing and securing web traffic due to its native integration of advanced load balancing capabilities and a strong WAF. Application Gateway combines both to give compelling advantages in performance and security.

Here is how can set up Azure Application Gateway for WAF and load balancing:

Step 1: Create an Application Gateway

Navigate to the Azure portal.
Click on Create a resource, and search for Application Gateway.
Select Application Gateway and click Create.
Configure the Basic Settings (e.g., name, region, and resource group).
Choose the SKU (Standard or WAF) and Virtual Network.

Step 2: Configure Backend Pools

Under Backend pools, add backend servers or virtual machine scale sets.
Define the backend pool settings, such as the backend type (VMs, IPs, or load balancers).

Step 3: Set Up Routing Rules

Configure URL-based routing or host-based routing to route traffic to different backend pools based on the request URL or domain name.
Set up listeners for HTTP/HTTPS traffic.

Step 4: Enable Web Application Firewall

Under Web Application Firewall, enable WAF and select the appropriate rule set (e.g., OWASP CRS).
Customize WAF settings if needed, and configure logging for real-time monitoring.

Step 5: Configure Autoscaling and SSL Offloading

Enable autoscaling to allow the Gateway to adjust capacity based on demand.
Configure SSL termination if you want the Gateway to handle SSL decryption.

Step 6: Monitor and Test

Use Azure Monitor to track metrics such as request count, backend response times, and WAF alerts. Test the configuration by sending traffic to your application and verifying that it’s correctly routed and protected.

Why use Application Gateway for WAF and load balancing?

Most other options treat WAF and load balancing as two separate entities. One handles performance, while the other handles security. Application Gateway breaks away from this siloed approach and merges them for strategic gains.

As a result, it gives several benefits that should make it your first choice to deploy WAF and load balancing.

1. Unified Deployment

A single interface for both performance tuning and security rules means fewer services to configure and pay for, which cuts down both operational complexity and latency.

2. Improved Security

The integrated web application firewall protects your applications from common web vulnerabilities, including SQL injection, XSS, and other OWASP Top 10 threats.

3. High Availability and Scalability

Application Gateway automatically scales based on traffic demand and ensures that your application remains available even during traffic spikes.

4. Centralized Management

Manage web traffic, load balancing, and security policies from a single interface in the Azure portal.

5. Cost Efficiency

With pay-per-use pricing and autoscaling, you only pay for the resources you consume, which helps in Azure cost optimization and makes it a cost-effective solution when managing Azure resources with Terraform.

6. Simplified SSL Management

Offload SSL termination to the Application Gateway, simplifying certificate management and reducing the load on your backend servers.

Conclusion

Azure Application Gateway is a shift in cloud infrastructure management. It is an essential tool for modern web applications that aligns intelligent load balancing with real-time, adaptive WAF. Cloud adoption will continue to grow as more and more businesses are shifting to cloud infrastructures to modernize their digital operations.

However, this shift will also lead to more complex digital threats and challenges, which means businesses will have to balance both high availability and cloud security. In that case, Azure Application Gateway is already the next chapter in the enterprise IT industry with its forward-thinking approach.

Xavor is a certified Microsoft Azure and AWS partner that offers modern, scalable, and secure managed cloud services. Our cloud experts have the experience and expertise to manage your cloud resources using all the latest platforms and tools like Azure Application Gateway.

News

Company:

Join our community of SUBSCRIBERS and be part of the conversation.