topic Azure App Gateway WAF ruleset in Esri Software Security & Privacy Questions

Azure App Gateway WAF ruleset

FraserHand — Mon, 09 Mar 2020 02:29:38 GMT

Hi There,

Is there a rule set availability for ArcGIS Enterprise deployments deployed in Azure behind an App Gateway with WAF enabled? Can these be loaded via the custom rule set functionality? Looking for some official Esri documentation if it is around.

Thanks!

Re: Azure App Gateway WAF ruleset

JYI — Fri, 30 Oct 2020 23:21:09 GMT

We have the same question. Since we deployed enterprise ArcGIS onto Azure, with the network structure like Internet -> Traffic Manager -> App Gateway -> Filewall -> VMs, there have been inaccessible issues with some services, especially when using Dashboards with some secured feature services. Cloud team is asking for such WAF policy profile rule set provided by ESRI that can be downloaded.

Re: Azure App Gateway WAF ruleset

BenWalker1 — Mon, 17 May 2021 14:58:49 GMT

Did you ever get any information from Esri

Re: Azure App Gateway WAF ruleset

JYI — Tue, 02 Nov 2021 13:26:31 GMT

So far no... It seems that we have moved away from traffic manager. The infrastructure is changed to use FortiGate.. How this will have effect on the WAF policy not known yet until next year when migrating to the new env.

Re: Azure App Gateway WAF ruleset

JYI — Tue, 14 Dec 2021 15:56:17 GMT

ESRI support just sent me the document which is available in December only, entitled "ArcGIS Enterprise Web Application Filter Rules". It says "This is required reading if you are implementing a WAF." To us, "OWASP Core Ruleset Guidance" is the most important part that we have been waiting for, although Azure team is not happy with so many rules that need to be disabled. 🙂 It also says "do not distribute or post publicly" so ask ESRI support for it.