WAF with the webserver hosted in Azure

RE: WAF with the webserver hosted in Azure

Dominik Friedl — Tue, 03 Dec 2024 09:00:16 GMT

Thank you for the info! We will see if we can make it work with routing on the Azure side. Unfortunately, policy-based is no option for us. We have tried this before and had a lot of troubles with the tunnel disconnecting.

RE: WAF with the webserver hosted in Azure

Sreenivasulu Naidu — Wed, 27 Nov 2024 14:42:42 GMT

Hi Dominik Friedl , I have verified WAF over Policy based IPsec VPN on XGS---Azure setup, it works for me..I see LAN port's ip is being used for system generated TCP packet from SFOS and the web server page is loaded on the client requesting web page.

RE: WAF with the webserver hosted in Azure

Sreenivasulu Naidu — Wed, 27 Nov 2024 07:21:13 GMT

Hi @Dominik Friedl, sys-traffic-nat on cli of SFOS will not help placing waf traffic with the configured ip; in case of waf with route based vpn, the source ip will always be the xfrm ip. Please try if your use case with Azure works with policy based VPN, this uses one of the LAN ports ip while placing waf traffic into IPsec tunnel.

If the usage of route based vpn is a must, then please check with Azure on the routing part.

Also, if it is fine to use without WAF rule, equivalent functionality can be achieved by using SANT and DANT rules on SFOS.

RE: WAF with the webserver hosted in Azure

Dominik Friedl — Tue, 26 Nov 2024 08:28:59 GMT

Hi,

I have screenshots attached from the tests. 10.25.0.100 is the webserver.

First test was a ping with the SNAT for system-generated traffic:

Then I tried to access the WAF from my client:

Sophos Firewall: Configuring an IPsec VPN Gateway Connection to Azure

I used this instruction to setup my VPN Tunnel.

RE: WAF with the webserver hosted in Azure

Hardik_R — Wed, 20 Nov 2024 17:04:17 GMT

Hi Dominik Friedl

you are following the right way however TCPDUMP & GUI packet capture(Diagnostics > Packet capture) output for below 2 situations will help to understand more on packet flow : tcpdump -nei any host <web server IP>

1. When you ping the webserver directly from the firewall.
2. When you try to access web server using WAF

Also Which IP you have used in SNAT for system-generated traffic? and after configuring this, are you getting ping reply?