Azure Application Gateway WAF logging Cloudflare edge IP instead of original client IP

Question

Azure Application Gateway WAF logging Cloudflare edge IP instead of original client IP

Estevan Luis Garcia 20

Hello everyone,

I am experiencing an issue with Azure Application Gateway (with WAF enabled) where the WAF logs display the Cloudflare edge IP address in the clientIP field rather than the actual end-user client IP.

Here are the specific details of the behavior observed:

Issue: When requests arrive through Cloudflare, the Application Gateway logs the Cloudflare IP address as the clientIP.

Testing: We have confirmed that traffic reaching the Application Gateway without passing through Cloudflare displays the correct IP, while traffic passing through Cloudflare consistently shows the proxy's IP.

Operational Impact: This behavior makes it impossible to implement rate-limiting rules based on IP. Any rate-limit rule applied to the current clientIP would result in completely inaccurate blocks, as the logs only reflect the edge proxy and not the actual user.

Hypothesis: It appears that the WAF is not properly parsing the X-Forwarded-For header and is defaulting to the RemoteAddr of the incoming connection. While we do not insist that the clientIP field itself must be redefined, it is critical that the actual end-user IP is correctly identified and available for the WAF to perform legitimate analysis and rule enforcement.

Has anyone encountered this behavior when using Cloudflare in front of an Azure Application Gateway? We are looking for a way to ensure the WAF logic correctly identifies the real client IP for its security rules and logging, rather than the Cloudflare edge IP.

Any guidance on configuration or best practices for this scenario would be greatly appreciated. Thanks!

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Yep - that has been my experience as well. When Cloudflare proxies traffic, it terminates the client connection and establishes a new connection to the Application Gateway, so the source IP seen by the gateway is the Cloudflare edge IP rather than the original end-user IP.

Although Cloudflare forwards the original client IP in HTTP headers such as CF-Connecting-IP (and optionally X-Forwarded-For), Application Gateway WAF logging and WAF rate-limiting use the network source IP, not these forwarded headers. As a result, the clientIP field in WAF logs continues to show the Cloudflare edge address.

You might want to consider implementing IP-based rate limiting at Cloudflare instead of Azure Application Gateway. If rate limiting must occur in Azure, then an alternative would involve using Azure Front Door Premium with WAF, which provides support for client IP handling in proxied scenarios, or redesigning the architecture so that Application Gateway receives client connections directly rather than through another reverse proxy.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin