13

We are looking for a Web Application Firewall (WAF) solution for our Sitecore CMS implementation, because we are an Azure shop we specifically wanted to use the WAF feature on the Azure AppGateway resource.

Per Sitecore's knowledge base article, it appears that this is not a supported feature. https://kb.sitecore.net/articles/682999

  • Does anyone know why this isn't supported?
  • Is it the case that no WAF products are supported?
  • Has anyone had experience with Sitecore support pushing back due to the presence of a WAF?

Thank you!

Improve this question

2 Answers 2

Reset to default
16

Update: Currently WAF is supported in diagnostic mode only for v8.2 and 9.0

In version 9.1 WAF is supported for the CD servers.

More information can be found here: https://doc.sitecore.com/developers/91/sitecore-experience-manager/en/using-azure-application-gateway-to-secure-your-content-delivery-server.html

Below are the list of OWASP rules that are causing problems, and as you can see there are two that cannot be disabled so we there is no work around for WAF right now.

Breaks Site: 942200 942260 942330 942340 942350 942370
Breaks CMS (when going into a piece of content): 941180 942100 942110 942130 942150
Can't be removed in WAF: 949110 980130

Improve this answer
7
  • 5
    For anyone interested, the rules 949110 and 980130 relate to the "total inbound anomaly scores" and are rated as critical. The Security Rules are listed in a GitHub repo at github.com/SpiderLabs/owasp-modsecurity-crs/tree/…
    – Richard Hauer
    Apr 3, 2018 at 13:21
  • Does Sitecore have an official page which shows this as not supported? Does Sitecore have any recommendations on an alternative WAF?
    – Brett Larson
    Jun 20, 2018 at 17:13
  • Unfortunately we cannot document everything what we don't support. There is no recommendation for any firewalls I am aware of.
    – Tamas Varga Sitecore
    Jun 20, 2018 at 19:40
  • Is it supported in Sitecore 9.1? I do not see anything in the release notes.
    – DevUser
    Dec 12, 2018 at 14:36
  • 2
    Yes, in version 9.1 WAF is supported for the CD servers. I have updated the answer.
    – Tamas Varga Sitecore
    Dec 12, 2018 at 15:08
3

We tried WAF prevention mode in 9.0.2 (9.0.1 should also work) and made it work in the end. Imp: Sitecore 9.1 won't magically fix it as MS itself is struggling to expose variables to customize Azure WAF parameters.

First time webforms submit failed as 942130 rule blocked it: "Matched Data: ADGTypeValue>Terms found within ARGS:fieldsets.fields.customParams.value: Terms of Use "

so we disabled this rule and the ones below. Keep in mind that 'post' goes through a log checking of its content(body), especially if there is a form that accepts upload(pdf or pics). It is pointless to check all the contents of upload, so we disabled the inspect request body.

enter image description here

We only need this for CD. So just do proper testing and monitor the WAF logs(first in detection mode, in PROD). Run this query in Monitor-> Logs and chill.

search in (AzureDiagnostics) ResourceType == "APPLICATIONGATEWAYS" and 
Resource == "<RG NAME>" | sort by TimeGenerated desc
| where Category == "ApplicationGatewayFirewallLog" 
| where Message like "SQL Injection Attack" 
| where clientIp_s == "<IP of machine doing testing>" //optional

EDIT: Azure WAF 2.0 can have exceptions rules just like windows firewall

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.