Add note clarifying that WAF rate-limit thresholds apply per gateway instance, not gateway-wide - #128641
Add note clarifying that WAF rate-limit thresholds apply per gateway instance, not gateway-wide#128641E-G-C wants to merge 2 commits into
Conversation
Clarify the behavior of rate limiting with multiple Application Gateway instances and provide a cautionary note on threshold configuration.
|
Trying a close/reopen to nudge the stuck build. |
|
@E-G-C : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
@E-G-C : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Clarifies that WAF rate-limit thresholds on Application Gateway v2 are enforced per gateway instance (when scaled out), not as a single gateway-wide aggregate—helping readers avoid misconfiguring thresholds under autoscaling.
Changes:
- Adds a NOTE explaining per-instance rate-limit counting under multiple Application Gateway instances.
- Provides an example showing how requests can bypass a gateway-wide expectation due to distribution across instances.
- Adds guidance that configured thresholds shouldn’t be treated as strict gateway-wide limits during scale-out.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| The sliding window algorithm blocks all matching traffic for the first window in which the threshold is exceeded, and then throttles traffic in future windows. Use caution when defining thresholds when configuring wide-matching rules with either *GeoLocation* or *None* as the *GroupByVariables*. Incorrectly configured thresholds could lead to frequent short outages for matching traffic. | ||
|
|
||
| > [!NOTE] |
| The sliding window algorithm blocks all matching traffic for the first window in which the threshold is exceeded, and then throttles traffic in future windows. Use caution when defining thresholds when configuring wide-matching rules with either *GeoLocation* or *None* as the *GroupByVariables*. Incorrectly configured thresholds could lead to frequent short outages for matching traffic. | ||
|
|
||
| > [!NOTE] | ||
| > Depending on its the autoscaling configuration, the Application Gateway v2 can run multiple instances. When multiple instances are active, incoming requests are distributed among them, and each instance maintains its own rate-limit count. |
|
|
||
| > [!NOTE] | ||
| > Depending on its the autoscaling configuration, the Application Gateway v2 can run multiple instances. When multiple instances are active, incoming requests are distributed among them, and each instance maintains its own rate-limit count. | ||
| > For example, with a limit of 400 requests per client IP per minute, 500 requests might be divided between two instances as 270 and 230. Neither instance reaches the limit, so the WAF allows the requests even though the combined total exceeds 400. |
|
Learn Build status updates of commit 4ae1e59: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? Important: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
|
Learn Build status updates of commit 072e651: ✅ Validation status: passed
For more details, please refer to the build report. |
Clarify the behavior of rate limiting with multiple Application Gateway instances and provide a cautionary note on threshold configuration.