Daniel Becroft (Partner) asked a question.
We are currently running PASOE (11.7.18) behind some on-premise load balancers and firewalls. A security requirement has arised from some customers that would see this need to be moved to behind an Azure Application Gateway / Web Application Firewall (WAF) instead instead.
We have found, putting some .NET applications through this, that there are some rules that certain frameworks don't play nicely with. One example is the AspNetCore.Correlation cookie value are sometimes blocked as "SQL injection". My concern is that there are going to be a number of these based on the regex
Has anyone gone through the process of running PASOE behind a WAF (Azure or Amazon, or any other provider) and has war stories to share? We are planning on moving some dev/test workloads to be behind it for testing purposes obviously.
We recently investigated issues with a WAF at a customer using the OWASP Core Rule Set. The client was a web frontend, and the JSDO-style queries it is using caused multiple rules to fail (JSON documents as part of the query string in particular).
You should be able to run the WAF in "monitor" mode before running in "block" mode, so that you can identify requests that are triggering the rule failures, without the requests being actually blocked.
Feel free to reach out if you need any help with the the analysis - it can get gnarly.