Azure WAF Custom Rule Overblock: az network application-gateway waf-policy When a Header Is Blocked

Azure · Techclick CLI troubleshooting lab

Bot or partner integration dies with 403. Managed rules look fine. A custom WAF rule was added last week.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Azure for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Custom rules evaluate first. A sloppy contains() on a header will 403 a partner. List the custom rules before you disable OWASP.

Why this ticket shows up

People debug managed CRS while a custom rule they wrote is the one dropping traffic.

Symptoms operators actually see

• 403 only on the partner path

• Custom rule present

• Managed rules detection-only

• Started last week

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

az network application-gateway waf-config show -g rg1 --gateway-name agw1
az rest --method get --url /subscriptions/<sub>/resourceGroups/rg1/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/waf1?api-version=2023-09-01
az monitor activity-log list --resource-group rg1 --max-events 20

How to read that output

If managed rules are detection-only and you still 403, a custom rule or a listener misconfig is doing the block.

Triage order

1. List custom rules and their actions

2. Match the partner header/IP

3. Set that rule to log or tighten the match

4. Do not flip the whole WAF to detect

5. Retest the partner

Classic traps

What you see	Real cause	Fix
Disable OWASP CRS	Custom rule is the 403	Edit custom
Allow the partner IP at NSG only	WAF still 403s	WAF is in front
Rebuild the WAF policy	One rule is greedy	Fix that rule

Proof the ticket is closed

• Partner 200

• Custom rule still exists in a safer form

• Managed rules unchanged

Say this in an interview

A 403 with managed rules in detect mode is a custom WAF rule until proven otherwise.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/