No traffic is checked by Front Door WAF

Question

I upgraded my Front Door from standard to premium. I created a WAF policy with the defaults and associated it with my front door. However, it doesn't log anything to FrontDoorWebApplicationFirewallLog and the metric Web Application Firewall Request Count shows nothing. I created another front door from scratch and got it to work. I compared the 2 and don't see any differences. Any idea how to proceed?

Answer 1

Hi @Bill Wolohan

Welcome to the Microsoft Q&A Platform.

Thank you for reaching out & I hope you are doing well.

There are reasons why the FrontDoorWebApplicationFirewallLog is not appearing in Log Analytics. Please check the points below.

1. The reason the FrontDoorWebApplicationFirewallLog table is not appearing in Log Analytics is that logs will only be generated if a firewall event occurs in Front Door.
2. If you did not select the FrontDoor WebApplicationFirewall Log while attaching logs to Log Analytics, those logs will not appear.

3. Make sure to enable the managed rule set after upgrading to the Premium SKU.follow the Ms Doc for more details.

Note: If you create a WAF manually, the managed rule set will be enabled automatically.

As I tested in my lab, there are no firewall events in Azure Front Door, so there are no firewall logs in log analytics workspace.

AzureDiagnostics
| summarize Count=count() by Category
| order by Count desc

For testing, I generated malicious attacks on Front Door endpoints.

After generating malicious traffic, the managed rule set blocked the traffic, and it was detected in the WebApplicationFirewall Log.

Reference: Upgrade from Azure Front Door Standard to Premium

I hope this helps to resolve your issue.

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.