WAF rule processing load and its impact analysis

Question

Hello all,

Good day!

I would like to know if I have a FrontDoor/AppGw WAF policy in prevention mode with all the default rulesets enabled + a bunch of custom rulesets added (say 50), when a request hits the frontdoor or AppGw, that 1 request would be checked against all these rulesets sequentially based on the priority of the rulesets before allowing the traffic or how efficiently it processes the requests and WAF ruleset validation?

The reason behind this question is to understand if WAF rule processing would cause any latency or delay to connect to the site till it finds a match.

Answer 1

WAF rules are applied in the order of custom rules first, then managed rulesets. If any of your custom rules are Allow rules rather than Deny, then processing will stop after passing the first Allow rule.

WAF rule processing is done in order where there are rules with different priorities, which can add some delay to processing. However, this delay is usually very minimal. You should test this with your own traffic to confirm whether it causes you any issues.