Applies toAzure Front Door Standard/Premium with WAF policy, Application Gateway WAF v2, Azure DDoS Network Protection
1. Triage: attack or real demand?
AzureDiagnostics
| where Category == "FrontDoorAccessLog" and TimeGenerated > ago(30m)
| summarize req=count() by bin(TimeGenerated, 1m), clientIp_s
| top 20 by req desc
AzureDiagnostics
| where Category == "FrontDoorAccessLog" and TimeGenerated > ago(30m)
| summarize req=count() by requestUri_s, userAgent_s, clientCountry_s
| top 20 by req desc
| Pattern | Likely |
|---|---|
| Few IPs or one user agent with very high rates; random query strings; login or search endpoint hammered | Attack (layer 7) |
| Many IPs, normal user agents, matches a campaign or event | Legitimate surge |
| Volumetric network flood to public IPs (not HTTP) | L3/L4 DDoS — DDoS Protection handles it; check its metrics |
2. Immediate mitigations (WAF policy)
Rate limit the hot path:
az network front-door waf-policy rule create -g rg-edge --policy-name wafprod \
-n RateLimitLogin --rule-type RateLimitRule --rate-limit-threshold 100 \
--rate-limit-duration 1 --action Block --priority 10 --defer
az network front-door waf-policy rule match-condition add -g rg-edge --policy-name wafprod \
-n RateLimitLogin --match-variable RequestUri --operator Contains --values "/login"
(100 requests per minute per client IP, on /login.)
Block clear offenders: custom rule on RemoteAddr IP ranges, or SocketAddr/RemoteAddr geo-match if the business doesn't serve that geography.
Bot protection: enable the managed Bot Manager rule set (Premium) and/or a JavaScript challenge action for suspicious traffic.
Make sure the WAF policy is in Prevention mode (Detection only logs).
3. Protect the origin
- Origins must accept traffic only from Front Door: the
AzureFrontDoor.Backendservice tag in NSGs / access restrictions plus checking theX-Azure-FDIDheader equals your Front Door ID. Otherwise attackers bypass the WAF by hitting the origin directly. - Turn on caching for static and cacheable content to absorb load at the edge.
4. Scale while you mitigate
- App Service / VMSS / AKS: scale out manually now; adjust autoscale limits.
- Database: check DTU/vCore saturation; enable read replicas or caching for hot reads.
- Return cheap responses for expensive endpoints under attack (feature flag: disable search, serve static "try later").
5. Escalate
- DDoS Network Protection customers: engage the DDoS Rapid Response team through an Azure support request (Sev A).
- Keep a timeline: start time, rules added (with time), impact metrics.
6. After the incident
- Keep useful rules, but review false positives in WAF logs (
FrontDoorWebApplicationFirewallLog, actionBlock). - Permanent rate limits on login, search and API endpoints; CAPTCHA or challenge on login.
- Load-test to know the real capacity; set alerts on request rate and origin latency.
Tip
Prepare an "under attack" WAF rule set in advance (rate limits and a challenge rule, disabled). During an incident you just enable it, instead of writing rules under pressure.