Is Application gateway with WAF send outbound traffic to internet?

Question

Hi Team,

We are going to deploy Application gateway with WAF in the HUB. We don't have Azure firewall in HUB.

I am uncertain about which path outgoing (Internet traffic) traffic will take if traffic is originating from a back-end poll server (spoke). Is Azure firewall is required or Appgateway with WAF will take of outgoing traffic.

Answer 1

@Mahavir Saroj

Thank you for reaching out.

Based on your question above.

I am uncertain about which path outgoing (Internet traffic) traffic will take if traffic is originating from a back-end poll server (spoke). Is Azure firewall is required or Appgateway with WAF will take of outgoing traffic.

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications.

Now as only Azure Application gateway WAF is deployed in the Hub the outgoing traffic originating from the back-end pool server (spoke) to the internet will not go via App Gateway's public IP as it is only meant for Inbound traffic.

If there is a Public IP assigned to back-end pool server, the outgoing traffic to internet will use this IP address. If there is no public IP assigned to the back-end pool server (spoke) the outgoing traffic will go to the internet using default outbound IP address.

Deploying an Azure Firewall in this scenario is a good idea as you can use the Outbound TLS Inspection feature of the firewall to inspect the outbound traffic originating from backend server.

This scenario of deploying Azure Application gateway along with Azure Firewall is described in this guide here.

For parallel implementation this will be the traffic flow.

It will also help if you could go through this guidance for Hup and spoke topology for Azure Firewall and Application Gateway.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

I have a similar question too. Our application is hosted in AKS and proxying thru App Gateway. We would like to enable WAF to lock down some of the traffic. The clients from internet and they are connecting thru https. We are trying to understand the pricing for WAF and wondering if we need to calculate only inbound traffic or do we need to consider for outbound traffic rate too as most of our clients are request reply type traffic.