Creating a new premium front door

Pulkit Bhagat 20 Microsoft Employee

Hi,
I am trying to create a new premium front door from scratch and then create an Event Grid subscription of type webhook endpoint. The Webhook validation handshake is failing for premium front door.

However, when I am doing via standard front door everything passes smoothly.
Is there a difference on how to create standard and premium front doors differently.
Any additional configurations required to be added when using premium?
No API Management instance or anything of that sort is used.

Sai Prasanna Sinde 3,330 Reputation points Microsoft Vendor

2025-01-06T20:01:31.0933333+00:00
Hi @Pulkit Bhagat

Welcome to the Microsoft Q&A Platform. Thank you for posting your query here.

Differences and Considerations for Premium Front Door in Event Grid Webhook Validation

Azure Front Door Premium includes a managed WAF. It terminates the TLS connection at the Front Door edge and then inspects the traffic before potentially re-encrypting it and forwarding it to your origin. This means the initial TLS handshake during the Event Grid validation request will be with Front Door, not directly with your backend. For your reference: https://learn.microsoft.com/en-us/azure/frontdoor/scenarios https://learn.microsoft.com/en-us/azure/frontdoor/web-application-firewall#:~:text=Azure%20Web%20Application%20Firewall%20(WAF)%20on,WAF%20on%20Azure%20Front%20Door.

While Standard can also terminate TLS, it doesn't have the managed WAF by default.

You need to configure custom domains and associate SSL certificates with both tiers. Because Premium handles TLS termination at the edge, it's crucial that the certificate on Front Door is valid and trusted by Event Grid.

You might be using a managed Front Door certificate or your own. Ensure it includes the domain you're using for the endpoint.

The challenge is that if your backend is behind Front Door Premium with WAF enabled, the WAF might block the initial validation request before it reaches your backend if the WAF rules aren't properly configured.

Configure your WAF in Front Door Premium to explicitly allow the IP ranges used by Azure Event Grid. Microsoft publishes these ranges. If you don't allow them, the WAF might see the validation request as malicious and block it.

Create a custom rule in your WAF policy. Set the match condition to "IP address" and include the list of Event Grid IP ranges. Set the action to "Allow".

To isolate if the WAF is causing the problem, you can temporarily put the WAF into "Detection" mode or disable the ruleset.

If the validation succeeds with the WAF disabled or in detection mode, you know the WAF is the issue, and you need to fine-tune the rules.

Remember to re-enable the WAF or revert to "Prevention" mode after testing for security.

Verify the Front Door WAF logs. Analyze them to see if the validation request is being blocked and by which rule.

This will help you pinpoint exactly what needs to be adjusted in your WAF configuration. You can find the logs under the "Diagnostics settings" of your Front Door.

Make sure that your health probes are configured correctly in your Front Door Premium's origin group. If the health probe fails, Front Door might not route traffic to your backend, including the validation request.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Sai.
Pulkit Bhagat 20 Reputation points Microsoft Employee

2025-01-07T05:30:28.8366667+00:00

Are the WAF rules mandatory? Currently we are not using any for premium or standard front door just the WAF policy.

We are not using any custom domain though
Pulkit Bhagat 20 Reputation points Microsoft Employee

2025-01-07T10:59:53.5633333+00:00

Also is WAFPolicy mandatory for premium front door?
Sai Prasanna Sinde 3,330 Reputation points Microsoft Vendor

2025-01-07T20:24:09.1766667+00:00
Hi @Pulkit Bhagat

Good day!

Answering to your questions:

Question: Are the WAF rules mandatory? Currently we are not using any for premium or standard front door just the WAF policy. We are not using any custom domain though

The individual WAF rules (within a WAF policy) are generally not mandatory. You have the flexibility to enable, disable, or modify them based on your application needs and security requirements.

However, a WAF policy itself can be considered mandatory in certain scenarios.

A WAF policy without any rules enabled doesn't provide any actual protection.

Currently, with no WAF rules enabled, your Front Door is not actively protected against common web exploits and vulnerabilities. The WAF policy is in place but inactive.

Even if you're not using rules now, having the WAF policy associated with your Front Door allows for quick activation of protection later if needed, without reconfiguring the association.

Whether you use custom domains or not doesn't directly impact the mandatory nature of WAF rules. WAF applies at the Front Door endpoint level.

Question: Also is WAF Policy mandatory for premium front door?

You can set up and operate an Azure Front Door (Premium or Standard) without a WAF policy.

From a security best practice, a WAF policy is highly recommended, practically mandatory, for any internet-facing application.

Most security standards and compliance frameworks will expect or require a WAF for web applications.

Azure Front Door Premium offers advanced WAF features, including the Microsoft-managed Default Rule Set with anomaly scoring, bot protection, and more.

These features enhance security, but again, the WAF policy itself is not technically mandatory to use Front Door Premium. For your reference: https://azure.microsoft.com/en-in/products/frontdoor#:~:text=Defend%20your%20digital,real%2Dtime%20analytics.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Sai.
Sai Prasanna Sinde 3,330 Reputation points Microsoft Vendor

2025-01-08T17:20:59.04+00:00

Hi @Pulkit Bhagat

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Thanks,

Sai.
Pulkit Bhagat 20 Reputation points Microsoft Employee

2025-01-08T17:30:25.0866667+00:00

hey, I tried couple of things but still stuck in same loop, event grid subscription is successful with standard tier but with premium webhook validation is failing with response code unknown. the validation request itself is not coming to the application.
Sai Prasanna Sinde 3,330 Reputation points Microsoft Vendor

2025-01-10T00:53:39.0433333+00:00

Hi @Pulkit Bhagat

Good day!

We will do a repro of the above scenario and provide you with an update at the earliest convenience.

Thanks,

Sai.

Accepted answer

Sai Prasanna Sinde 3,330 Reputation points Microsoft Vendor

2025-01-16T17:14:14.9666667+00:00

Hi @Pulkit Bhagat

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

As discussed on Teams, I am posting the solution you provided since the original poster cannot accept their own answer. By reposting it, you will be able to mark it as the Accepted answer, which will help other community members find the appropriate solutions.

Issue: You are trying to create a new premium front door from scratch and then create an Event Grid subscription of type webhook endpoint. The Webhook validation handshake is failing for premium front door.

Solution: The issue was not of Azure front door or event grid. it was an authentication issue which was not letting the request reach the application, due to which you were getting 401 error.

Regards,
Sai.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Creating a new premium front door

0 additional answers

Your answer