One site is regional-only behind Application Gateway; another is gl…

Question

One site is regional-only behind Application Gateway; another is global behind Front Door. Where should the security engineer attach WAF policies?

Accepted Answer

Associate a WAF policy with Application Gateway WAFv2 for the regional site and with Front Door WAF for the global site, rather than treating Azure Firewall Premium IDPS as “the WAF.” — WAF is a policy that rides on the host you already chose—Application Gateway WAFv2 regionally, Front Door WAF globally. Firewall IDPS is useful, but it isn’t that WAF.

Answer

Deploy a standalone WAF virtual machine appliance in every subnet and ignore Application Gateway and Front Door associations.

Answer

Attach only Azure Firewall Premium IDPS and claim it replaces Application Gateway and Front Door WAF policies.

Answer

Put both sites behind NSG HTTP allow rules and skip WAF policy association entirely.

One site is regional-only behind Application Gateway; another is global behind Front Door. Where should the security engineer attach WAF policies?

Short Explanation

Full Explanation