2

On Azure, I need to disassociate an existing WAF policy that is tied to an Azure Application Gateway but cannot find a way.

I've created a new WAF policy and associated it with my Azure Application Gateway. I do not like the way it is configured and would now like to remove it but it gives me an error message saying

Failed to delete the WAF policy 'wafpolicyNew'. Error: Firewall Policy can not be deleted since it is still allocated to resource subscriptions/75d2e0ac-xxxxx450c0a6fc/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/mygateway

Is there any way I can disassociate the policy from my Application Gateway?

I've tried using Powershell

$appGw = Get-AzApplicationGateway -Name "mygateway"
$appGw.FirewallPolicy = $null
Set-AzApplicationGateway -ApplicationGateway $appGw

But I get another error message saying

cannot be removed from Application Gateway, changing from one firewall policy to another is permitted

and also tried using the Portal to look for a disassociate button but none to be found.

2
1

WAF policies can be deleted from an application gateway by using the Azure CLI.

Stop the application gateway.

 az network application-gateway stop -g MyResourceGroup -n MyAppGateway

Remove the policy

 az network application-gateway waf-policy delete --name MyApplicationGatewayWAFPolicy --resource-group MyResourceGroup
2
  • Thank you! Is there a solution that does not involve stopping the gateway? This is my production environment. – Frank Fu Aug 4 '20 at 7:59
  • Did anyone test this? It doesn't work for me. I get "(waf policy) can not be deleted since it is still allocated to resource", even if I stop the associated app gateway. – Grilse Aug 17 '20 at 16:04
1

@Citizen It doesn't work for me. I get "(waf policy) can not be deleted since it is still allocated to resource", even if I stop the associated app gateway.

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

"Once a Firewall Policy is associated to a WAF, there must always be a policy associated to that WAF. You may overwrite that policy, but disassociating a policy from the WAF entirely isn't supported."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.