How Should Azure WAF and Palo Alto NVAs Share Security Responsibilities?

For any public-facing HTTP or HTTPS application, a WAF is generally appropriate because it protects at a different layer than a network firewall. The NVA mainly handles Layer 3 and Layer 4 controls, routing, segmentation, and possibly some advanced inspection, while the WAF can address application-layer risks such as those covered by the OWASP Top 10. The exact placement depends on routing, availability, TLS termination, client-IP preservation, and the application’s requirements.

Do not overlook non-WAF controls: platform DDoS protection, network security groups, private access to backend services, least-privilege identities, secure administration paths, patching, centralized monitoring, and tested incident-response procedures. Also verify that non-HTTP protocols are handled separately, since a WAF will not protect arbitrary TCP or UDP services. The important test is whether every ingress and egress path is explicitly documented and whether an attacker can bypass the intended inspection layer.

Putting the WAF in front of the firewall can work, as can placing it behind the firewall, but the choice should follow the traffic flows and enforcement requirements. If the WAF terminates TLS, it can perform useful Layer 7 inspection without forcing the Palo Alto appliances to decrypt every session. TLS decryption on the NVAs can add substantial compute, licensing, certificate-management, and operational overhead, so it should be justified by specific requirements rather than enabled everywhere. Preserve and validate the original client IP, and ensure logs from the WAF, NVAs, load balancer, and applications are correlated.

Start with the security and application requirements rather than choosing an appliance first. “Palo Alto” or “WAF” alone does not describe the actual controls or policies enabled. Build a control matrix covering public ingress, application-layer attacks, DDoS, TLS handling, identity and authentication, outbound filtering, east-west segmentation, logging, alerting, vulnerability management, and incident response. Then map each requirement to the WAF, NVA, platform services, or the application itself. A WAF is not a replacement for secure application code or strong authentication.

A common pattern is to use a dedicated WAF or application gateway for public web ingress and use the Palo Alto NVAs primarily for outbound traffic, east-west inspection, segmentation, and other network-security functions. For a simple HTTP-based application, that can provide a clean separation of responsibilities. Make sure the routing prevents bypassing the WAF and that backend services accept traffic only from the intended gateway or inspection path.