Following on from my previous post about Network Security Groups, this post is about securing an App Service Environment. An Application Gateway with Web Application Firewall (WAF) is also included to provide additional protection by providing the Web Application Gateway functionality. This works by inspecting the traffic and providing defence against the OWASP top 10 threats. WAF on Application Gateway is based on
Core Rule Set (CRS) 3.1, 3.0, or 2.2.9 from the Open Web Application Security Project (OWASP). The WAF automatically updates to include protection against new vulnerabilities, with no additional configuration needed.

The aim of this post is to explain how to configure the ASE, Application Gateway, and Outbound Firewall to control traffic flow. It is not designed to describe the core setup and configuration of these resources, nor is it designed to describe the deployment of specific Web App Services or Function Apps.

External access can also be facilitated by using an externally facing firewall, which can use NAT to redirect traffic to the front-end interface of the Application Gateway.

Figure 1, High level resource deployment

Figure 2, Traffic flow via Application Gateway

Application Service Environment Setup

Logging

The ASE should be configured to save any logs and send these to a SIEM tool for monitoring and alerting. Ideally this would be to the Log Analytics Workspace used by Sentinel. This is achieved by adding a new Diagnostic setting which is configured to send the AppServiceEnvironmentPlatformLogs to an appropriate Log Analytics Workspace.

ASE Subnet

The following service endpoints need to be added to the subnet used by the ASE.

• Microsoft.EventHub
• Microsoft.KeyVault
• Microsoft.ServiceBus
• Microsoft.SQL
• Microsoft.Storage
• Microsoft.Web

Network Security Group

A Network Security Group to be associated with the ASE subnet to restrict traffic to only the minimum required sources and destinations. The tables below provide the core rules which should be applied to this NSG to assure a ‘Deny by Default’ approach.

There are a few external, outbound dependencies that are almost entirely defined with FQDNs. These services do not have a static addresses behind them, as a result Network Security Groups cannot be used to lock down the outbound traffic. One solution to securing outbound addresses to these endpoints, would be to use a layer 7 firewall device. This firewall can then control outbound traffic based on FQDNs. An Azure Firewall can restrict outbound HTTP and HTTPS traffic based on the FQDN of the destination.

Inbound rules

Outbound rules

NSG Flow Logs

The NSG should be configured to save the NSG flow logs to a storage account. Ideally these logs should then be ingested by a SIEM tool.

Route Table

A route table needs to be associated with the ASE subnet, to enable required external traffic to be inspected via a firewall. There are several inbound endpoints that are used to manage an ASE. Several routes need to be created for Management IP addresses, this prevents asymmetric routing issues, the traffic does not actually leave the Azure Fabric, but is not routed via the firewall.

Routes

The following routes need to be added to the route table to cause internet bound traffic to be routed via the external firewall, and to prevent a circular routing reference for Azure service.

Application Gateway Setup

The Application Gateway should be configured to permit end to end encryption with the backend pool being the Internal Load balancer IP address of the ASE. This Application Gateway needs to be a WAF tier with the Web Application Firewall (WAF) enabled and configured with Prevention mode.

Logging

Logging should be configured on the Application Gateway. This logging should be configured to save its logs, ideally to the Log Analytics Workspace used by Sentinel. This is achieved by adding a new Diagnostic setting which is configured to send the following logs to the appropriate Log Analytics Workspace

• ApplicationGatewayAccessLog
• ApplicationGatewayFirewallLog

Network Security Group

A Network Security Group should be associated with the Application Gateway subnet, with the following rules.

Inbound rules

Outbound rules

NSG Flow Logs

The NSG should be configured to save the NSG flow logs to a storage account. Ideally these logs should then be ingested by a SIEM tool.

Firewall Setup

To permit the required access to external hosted services for ASE the following rules need to be added to a firewall device, details included here are for an Azure Firewall. For rules need for other firewall types please see appendix I.

Application rule collection

A new Application rule collection needs to be created, to provide access to the following FQDN tags, in order to permit the management of the ASE.

FQDN tags

Network rule Collection

A new Network Collection needs to be created, which provides the ASE with access to NTP and Azure Monitor services.

IP Addresses

Service Tags