Conflict Resolution: Azure Web App Autoscaling with Azure Application Gateway and WAF

Question

Problem Description: I'm currently architecting a solution in Azure that requires both autoscaling capabilities for my web application to ensure scalability and a Web Application Firewall (WAF) to protect against common vulnerabilities such as XSS and SQL injection attacks. However, I'm facing a dilemma regarding the use of Azure Application Gateway with WAF and Azure Web App's internal load balancer for autoscaling.

Reproducible Example:

1. I have configured Azure Application Gateway with WAF enabled to provide security features for my web application.
2. Additionally, I have enabled autoscaling for my Azure Web App to dynamically adjust the number of instances based on traffic demand.

Expected Behavior: I expect the Azure Web App to scale dynamically to handle varying levels of traffic while also benefiting from the security features provided by the WAF.

Actual Behavior: However, I'm concerned about potential conflicts between the Azure Application Gateway's load balancer used for WAF and the Azure Web App's internal load balancer used for autoscaling. I'm unsure if having two load balancers in the architecture could lead to conflicts or inefficiencies.

Attempts to Solve:

1. I've researched Azure documentation and best practices but haven't found clear guidance on integrating Azure Web App autoscaling with Azure Application Gateway and WAF.
2. I've considered alternative architectures but haven't identified a solution that meets both scalability and security requirements without potential conflicts.

Specific Questions:

1. What are the best practices for integrating Azure Web App autoscaling with Azure Application Gateway and WAF to ensure both scalability and security?
2. Are there any known conflicts or considerations when using multiple load balancers in this architecture?
3. How can I architect my solution to leverage autoscaling for scalability and WAF for security without introducing potential conflicts or inefficiencies?

Answer 1

Azure Application Gateway and Azure Web App's internal load balancer can work together without conflicts. Here's why:

1. Azure Application Gateway operates at the application layer (Layer 7) of the OSI model, handling HTTP/HTTPS traffic. It routes traffic based on URL patterns, which is why it can host multiple websites behind a single IP. It also provides WAF capabilities.

2. Azure Web App's internal load balancer operates at a lower layer, distributing incoming traffic to the available instances of your web app. It's not aware of the Application Gateway; it simply receives requests and routes them to available instances.

When you enable autoscaling for your Azure Web App, Azure automatically adjusts the number of instances based on your autoscale settings and the load on your app. The internal load balancer then distributes the incoming traffic across all available instances.

So, in your setup:

• The Application Gateway receives the incoming HTTP/HTTPS requests, applies WAF rules, and forwards the requests to the Azure Web App.

• The Azure Web App's internal load balancer receives the requests from the Application Gateway and distributes them to the available
  instances.

There's no conflict between the two as they operate at different layers and have different responsibilities. This setup allows you to benefit from the WAF capabilities of the Application Gateway and the autoscaling feature of Azure Web App.

Remember to configure the custom health probes in Application Gateway to point to the correct path in your web app, so it can accurately determine the health of your web app instances.