Announcing the public preview
of rate limit grouping for Azure Web Application Firewall (WAF) on Azure Front
Door Premium.
By default, a rate limit rule counts requests separately for
each client IP address. Distributed attacks get around this by spreading their
traffic across thousands of IP addresses, so that each one stays under the
threshold. Rate limit grouping adds new group-by options that count requests by
an attribute those clients share, so traffic from many IP addresses counts
toward a single threshold.
With this preview, you can group each rate limit rule by:
- JA4 fingerprint, to limit
attacks that rotate through many IP addresses but reuse the same client
software.
- AS number, to cap traffic
from networks your users don't usually come from, such as hosting and cloud
providers, without maintaining lists of their IP ranges.
- Country/region, to cap the
traffic that any single country or region can send.
You can also choose None to count all requests that match a
rule together, for example to cap the total request rate to a sign-in page.
Existing rate limit rules keep counting requests per IP address, so nothing
changes until you choose a grouping. Configure grouping in the Azure portal,
ARM templates, Bicep, the REST API, or Azure PowerShell, and keep a per-IP rule
alongside your grouped rules.
Learn
more.