We're a relatively small business handling around 200,000 requests per day, but we recently experienced short Layer 7 DDoS bursts involving several million requests. Azure Front Door WAF rate limiting didn't help much because the traffic was distributed across many edge locations, and lowering the limits further would have affected legitimate users. We upgraded to Front Door Premium for managed WAF and DDoS-related protections, but we're concerned that we'll still be billed for attack traffic. The increased cost has us considering Cloudflare or another provider instead. Has anyone dealt with this and found an effective way to protect the origin while controlling attack-related costs?
5 Answers
Make sure the Front Door profile has the Microsoft-managed WAF rules enabled, along with the bot protection rules where applicable. Premium mainly adds managed protections, while custom WAF rules are also available in the Standard tier. Geo-filtering and carefully tuned rate limits can supplement those rules. Cloudflare enables more protection by default, so comparing the total cost and configuration effort is sensible.
Replacing Front Door completely with Cloudflare or Akamai is worth evaluating. A common design is to allow the origin firewall to accept traffic only from the chosen provider, so attackers can’t bypass it. If you keep Front Door, caching as much content as possible can reduce pressure on the origin before application-level rules take effect. Bot-management rules may help, but they aren’t guaranteed to stop every attack.
Some teams have found Front Door’s WAF and operational workflow frustrating and moved to a third-party edge provider with Application Gateway behind it. That approach can give you more control over filtering and origin access, but you should compare features, latency, migration effort, and pricing rather than assuming it will automatically be cheaper.
It may be worth opening an Azure support case to ask whether your subscription qualifies for DDoS-related cost protection or credits. Some Azure DDoS Protection configurations have offered support for eligible attack-related expenses, but reimbursement depends on the specific service, tier, and terms, so it’s not something to assume without confirmation.
One option is to put Cloudflare in front of Front Door, but be deliberate about which service handles each function. For example, enable caching and optimization in only one layer rather than building two overlapping CDN caches. This can provide another security layer, though it also adds complexity and another provider to manage.
If Front Door isn’t providing useful CDN features in that setup, replacing it with Application Gateway behind Cloudflare may be simpler and less expensive.