Azure Application Gateway Blocking Client

Question

My Azure Network connected with Office Datacenter. We are using Application Gateway with Private IP.

We were using Application Gateway WAF Tier Firewall Enabled but detection mode.

Under that situation, some particular user got blocked. Then we disabled Firewall mode and the issue solved.

Later that situation again arises, even firewall mode was disabled. I turn on the firewall mode and disable again, and that resolves the issue.

In order to get rid of that situation, i migrate Application Gateway to Standard Tier. After 3 days later we again faced that issue. Then i again migrate to WAF Tier, Enable Firewall under Detection mode then disable Firewall but keep WAF Tier, and That resolve the issue.

It doesn't block any particular page, it blocks the full domain even a simple HTML page not able to access.

Answer 1

Do you have proper exceptions set for the ports required by traffic manager?

Network Security Groups (NSGs) are supported on the application gateway subnet with the following restrictions:

Exceptions must be put in for incoming traffic on ports 65503-65534 for the Application Gateway v1 SKU and ports 65200 - 65535 for the v2 SKU. This port-range is required for Azure infrastructure communication.

I would recommend verifying the Firewall guidance from Microsoft here.