How Should Azure WAF and Palo Alto NVAs Share Security Responsibilities?
Asked by
MellowCedar47
I'm designing an Azure hub-and-spoke environment that uses Palo Alto VM-Series appliances in the hub and a public load balancer for ingress. I'm trying to determine which security controls are provided by the network virtual appliances and which are missing at the application layer.
For public HTTP or HTTPS applications, I assume Layer 7 threat detection and traffic inspection through a WAF are necessary, but I'm unsure about the best architecture. Is placing a WAF behind or in front of the NVAs sufficient, or are there other controls I should evaluate? I'm particularly interested in avoiding gaps across ingress, egress, east-west traffic, authentication, TLS inspection, logging, and application protection. I understand that perfect security is impossible, but I want to make sure the design does not contain obvious control deficiencies.
Answers
A common pattern is to use a dedicated WAF or application gateway for public web ingress and use the Palo Alto NVAs primarily for outbound traffic, east-west inspection, segmentation, and other network-security functions. For a simple HTTP-based application, that can provide a clean separation of responsibilities. Make sure the routing prevents bypassing the WAF and that backend services accept traffic only from the intended gateway or inspection path.
Reply to this answer
Start with the security and application requirements rather than choosing an appliance first. “Palo Alto” or “WAF” alone does not describe the actual controls or policies enabled. Build a control matrix covering public ingress, application-layer attacks, DDoS, TLS handling, identity and authentication, outbound filtering, east-west segmentation, logging, alerting, vulnerability management, and incident response. Then map each requirement to the WAF, NVA, platform services, or the application itself. A WAF is not a replacement for secure application code or strong authentication.
Reply to this answer
Putting the WAF in front of the firewall can work, as can placing it behind the firewall, but the choice should follow the traffic flows and enforcement requirements. If the WAF terminates TLS, it can perform useful Layer 7 inspection without forcing the Palo Alto appliances to decrypt every session. TLS decryption on the NVAs can add substantial compute, licensing, certificate-management, and operational overhead, so it should be justified by specific requirements rather than enabled everywhere. Preserve and validate the original client IP, and ensure logs from the WAF, NVAs, load balancer, and applications are correlated.
Reply to this answer
Do not overlook non-WAF controls: platform DDoS protection, network security groups, private access to backend services, least-privilege identities, secure administration paths, patching, centralized monitoring, and tested incident-response procedures. Also verify that non-HTTP protocols are handled separately, since a WAF will not protect arbitrary TCP or UDP services. The important test is whether every ingress and egress path is explicitly documented and whether an attacker can bypass the intended inspection layer.
Reply to this answer
For any public-facing HTTP or HTTPS application, a WAF is generally appropriate because it protects at a different layer than a network firewall. The NVA mainly handles Layer 3 and Layer 4 controls, routing, segmentation, and possibly some advanced inspection, while the WAF can address application-layer risks such as those covered by the OWASP Top 10. The exact placement depends on routing, availability, TLS termination, client-IP preservation, and the application’s requirements.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions