IP Groups association with WAF

Hi @Natarajan, Raja,

Thank you for reaching out on Microsoft Q&A forum.

I understand that you want a solution to block malicious IPs using Azure Web Application Firewall (WAF) on Application Gateway.

Currently, Azure Web Application Firewall (WAF) policies do not support a dedicated "IP Group" resource that you can dynamically reference in custom rules for blocking malicious IPs. Instead, WAF custom rules allow you to specify IP addresses or CIDR ranges directly in match conditions to block or allow traffic. This means you need to list out IP addresses or IP ranges explicitly within the custom rule.

You can create custom rules with the IPMatch operator on the RemoteAddr or SocketAddr variable, specifying CIDR-formatted IP ranges to match and block malicious IPs. However, there is a limit on the number of IP ranges per match condition (typically around 600), so this approach works best for a moderate number of IPs.

Refer: https://learn.microsoft.com/en-us/answers/questions/1329570/azure-waf-limitationsRefer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview#match-variable-required

Besides manually adding IP ranges, Azure WAF provides managed rule sets you can enable to block known malicious traffic patterns automatically. These managed rules cover common vulnerabilities and attack vectors without the need to specify IPs.

Additionally, there is an Anomaly Scoring mode in Azure WAF that evaluates request patterns and blocks based on suspicious activity, which can help with dynamic protection beyond static IP blocking.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,

Thanmayi