Question

Contoso runs a Web Application Firewall policy on Azure Application Gateway in Prevention mode. The security team creates two custom rules: Rule A (priority 100) allows traffic from the corporate public IP range 203.0.113.0/24, and Rule B (priority 50) blocks all requests where the URI path contains '/admin'. A user connecting from 203.0.113.15 reports they can no longer reach the '/admin' portal, even though their source IP is explicitly allowed. What is the reason the request is blocked?

Accepted Answer

Custom rules are evaluated in order of priority (lowest number first), so Rule B (priority 50) matches and blocks the request before Rule A is evaluated.

Answer

Managed rule sets always take precedence over custom rules, so the OWASP core rule set blocks the '/admin' path regardless of custom rule priority.

Answer

Custom rules are evaluated in order of priority (highest number first), so Rule A (priority 100) should allow the traffic; the block is a configuration bug.

Answer

In Prevention mode all custom rules are ignored and only managed rules apply, so the '/admin' request is blocked by default policy.