Enable Request Body Inspection for the Associated WAF Policy

Sign in to the Microsoft Azure Portal.

Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

From the Type equals all filter box, select Type for Filter, Equals for Operator, and Application gateway for Value, then choose Apply to list the Azure Application Gateways available in the selected subscription.

Click on the name (link) of the Azure Application Gateway that you want to examine.

In the resource navigation panel, under Settings, select Web application firewall to examine the WAF security policy configured for the selected Application Gateway.

In the Associated web application firewall policy section, click on the name (link) of the WAF security policy associated with your Application Gateway to access the policy configuration.

In the WAF policy navigation panel, under Settings, choose Policy settings, and check the Enforce request body inspection setting to determine the operational state of the Request Body Inspection feature. If the Enforce request body inspection setting checkbox is unchecked, Request Body Inspection is not enabled for the Web Application Firewall (WAF) policy associated with your Azure Application Gateway.

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

Run network application-gateway list command (Windows/macOS/Linux) with custom output filters to list the ID of each Azure Application Gateway available in the selected subscription:

az network application-gateway list
	--query '[*].id'

The command output should return the requested Application Gateway IDs:

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/applicationGateways/cc-project5-application-gateway",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/applicationGateways/cc-prod-stack-application-gateway"
]

Run network application-gateway show command (Windows/macOS/Linux) with the name of the Azure Application Gateway that you want to examine as the identifier parameter and custom output filters to describe the ID of the WAF security policy associated with the selected Application Gateway:

az network application-gateway show
	--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/applicationGateways/cc-project5-application-gateway"
	--query '{firewallPolicy:firewallPolicy.id}'

The command output should return the requested WAF policy ID. If the network application-gateway show command output returns null for "firewallPolicy", there are no WAF policies associated with your resource, therefore, Azure Web Application Firewall is not enabled for the selected Application Gateway. If the ID of the WAF policy is returned, as shown in the example below, continue the Audit process with the next step:

{
	"firewallPolicy": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/cc-app-gateway-waf-policy"
}

Run network application-gateway waf-policy show command (Windows/macOS/Linux) to determine the operational state of the Request Body Inspection feature, within the associated WAF policy settings. For --name, use the WAF policy name included in the resource ID returned in the previous step (i.e., "/subscriptions/\<subscription-id\>/resourceGroups/\<resource-group\>/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/\<waf-policy-name\>"):

az network application-gateway waf-policy show
	--name cc-app-gateway-waf-policy
	--resource-group cloud-shell-storage-westeurope
	--query "policySettings.requestBodyCheck"

The command output should return the feature status (true for enabled, false for disabled):

false

If the network application-gateway waf-policy show command output returns false, as shown in the example above, Request Body Inspection is not enabled for the Web Application Firewall (WAF) policy associated with your Azure Application Gateway.

Sign in to the Microsoft Azure Portal.

Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

From the Type equals all filter box, select Type for Filter, Equals for Operator, and Application gateway for Value, then choose Apply to list the Azure Application Gateways available in the selected subscription.

Click on the name (link) of the Azure Application Gateway that you want to configure.

In the resource navigation panel, under Settings, select Web application firewall to access the WAF security policy configured for the selected Application Gateway.

In the Associated web application firewall policy section, click on the name (link) of the WAF security policy associated with your Application Gateway.

In the WAF policy navigation panel, under Settings, choose Policy settings to access the policy configuration settings.

Check the Enforce request body inspection setting checkbox to enable the Request Body Inspection feature and provide a value for the Maximum request body inspection limit (KB). Maximum request body inspection limit controls how many bytes of an HTTP request body a Web Application Firewall (WAF) will inspect and apply its security rules to. The default value is 128 KB. Choose Save to apply the configuration changes.

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

Run network application-gateway waf-policy update command (Windows/macOS/Linux) to enable the Request Body Inspection feature for the Web Application Firewall (WAF) policy associated with the selected Azure Application Gateway. (Optional) Add the requestBodyInspectLimitInKB parameter value to the command request if you want to set the maximum request body inspection limit (in KB). If requestBodyInspectLimitInKB is not specified, the default value is 128 KB:

az network application-gateway waf-policy update
	--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/cc-app-gateway-waf-policy"
	--policy-settings "{requestBodyCheck:true,requestBodyInspectLimitInKB:128}"

The command output should return the configuration information available for the associated WAF policy:

{
	"customRules": [],
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/cc-app-gateway-waf-policy",
	"location": "westeurope",
	"managedRules": {
	"exclusions": [],
	"managedRuleSets": [
		{
			"ruleGroupOverrides": [],
			"ruleSetType": "OWASP",
			"ruleSetVersion": "3.2"
		}
	]
	},
	"name": "cc-app-gateway-waf-policy",
	"policySettings": {
		"fileUploadEnforcement": true,
		"fileUploadLimitInMb": 100,
		"maxRequestBodySizeInKb": 128,
		"mode": "Detection",
		"requestBodyCheck": true,
		"requestBodyEnforcement": true,
		"requestBodyInspectLimitInKB": 128,
		"state": "Enabled"
	},
	"provisioningState": "Updating",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"tags": {},
	"type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies"
}