App Gateway Firewall Policy Custom Rule is not blocking the specified IP address

Brett Changus 0

I have an app gateway WAF policy custom rule configured to deny traffic to a specific ip address but the user with that ip is still able to connect.

The rule is enabled and the WAF policy is applied to the app gateway.

What could be the problem?

Ravi Varma Mudduluru 1,790 Reputation points Microsoft External Staff Moderator

2025-10-10T22:35:29.7666667+00:00
Hello @Brett Changus,
Thanks for reaching out to Microsoft Q&A.

Could you confirm the following so we can better identify the cause?

Is the WAF policy associated at the Application Gateway level or only at a specific listener/path-based rule?

Is the custom rule using RemoteAddr as the match variable with IPMatch operator?

What is the priority number of this deny rule compared to other custom rules?

Can you check the ApplicationGatewayFirewallLog in Log Analytics to see if the request from that IP is being evaluated or matching the deny rule?
https://free.blessedness.top/en-us/azure/application-gateway/application-gateway-diagnostics#firewall-log

Your answer