Web Server Protection and HTTPS Inspection in Azure

[John_Richards]

A client has setup access to a web server in Azure and have confirmed working. In the access policy you do not use the actual web server object but a Dynamic Object called LocalGatewayExternal. In the NAT policy is where you actually define the object in the translated destination. The client has defined the object as a “Web Server” and applied Web Server protections. Because this is not used in the access policy (only used in NAT) would those protections still apply? Secondly they want HTTPS inbound inspection enabled for the same webserver. Is this possible to do as I do not think you can use the actual web server object in the HTTPS policy (would need to use LocalGatewayExternal). This is VMSS implementation with a LoadBalancer in front of the Gateways. Thanks

[JoSec]

1. Define it on your translated destination. 

2. I do not know regarding HTTPS inspection in Azure maybe someone else can chime in..

Somethings to add that also can be done in addition to using IPS and the web server protection.

1. Use an inline layer rule and with the second rule restrict access using FQDN only. If the Load Balancer can do it, then do it there instead.
2. Create rules to restrict content that can be uploaded and downloaded to and from the web server.
3. Use Geo-Protection
4. Enable AV and Anti-bot but you may have to disable archive scanning because it can have a huge performance. impact.
5. Restrict the webservers/applications outbound access. 
6. Also, you may have to create a rule above the FQDN rule for the load balancer health check or the health check may fail if it uses IP for the health check. I did this by creating a custom application signature. This is only if you cannot restrict the FQDN via the LB or anything else upstream.