Hey folks, been wrestling with this all week while designing a new ingestion pipeline that needs serious WAF protection. We're architecting a system where our analytics API endpoints (hosted on AKS) will be exposed to some pretty unpredictable third-party data streams. Security is non-negotiable, but so is latency for our real-time dashboards.
I've used both Azure Front Door (AFD) with its WAF policy and the Application Gateway (AGW) with its WAF (v2, of course) in the past, but always in different contexts. Now I'm trying to make a direct, performance-centric comparison for a high-throughput scenario and the official docs are... less than helpful on concrete numbers. They talk about features and scaling, but the real-world overhead? Crickets.
My specific hangups are about the added milliseconds and potential throughput ceilings. For instance:
* **TLS Termination Overhead:** Both can do it, but is there a measurable difference in SSL handshake speed or CPU impact when the WAF rulesets (OWASP 3.2, say) are fully loaded?
* **Latency per Request:** What's the baseline added latency for a simple request/response passing through the WAF engine? I've seen whispers of 5-15ms for AGW, but is AFD different given its global anycast architecture vs. regional deployment?
* **Throughput Impact:** If I have a backend that can handle 10k RPS naked, what's a realistic expectation after putting it behind each WAF? Does the fact that AFD's WAF seems to be "closer to the edge" change the performance profile compared to AGW sitting in our VNet?
* **Rule Complexity Cost:** How much does enabling a complex custom rule (like a bunch of regex patterns for threat intel feeds) chip away at performance? Is one platform more sensitive to this than the other?
I cobbled together a basic test, but it's hardly production-grade. Used `wrk` against a dummy app, but I'm not sure I'm even measuring correctly.
```bash
# Rough test for baseline latency addition
wrk -t12 -c400 -d30s --latency https://myapp.azurefd.net/api/health
```
Has anyone done rigorous benchmarking or have internal numbers they can share? I'm especially curious about:
- The performance hit when geo-filtering or IP reputation rules are active.
- Any difference in behavior under sustained attack (like a DDoS that triggers rate limiting rules).
- Whether the "Managed Ruleset" in AFD performs differently than the identical-looking ruleset on AGW.
We're leaning towards AFD for its global scale and DDoS protection tier, but if the WAF adds significantly more latency than AGW for our primary region users, that's a dealbreaker. The devil's in the details, and right now, I'm missing a lot of details!
Data nerd out
Data nerd out
I'm a senior platform engineer at a mid-sized SaaS shop (120ish people) doing clickstream analytics, and we've run both AFD and AGW WAF in front of our data collector APIs on AKS for the last two years. We settled on a split setup based on traffic patterns.
**Latency overhead per request (hot path):** For a simple validated POST, our observability shows AGW WAF v2 adds a consistent 8-12ms to P95 latency with OWASP 3.1. AFD typically adds 3-7ms for the same request, likely because its POP is geographically closer to our users than our AGW's single region.
**TLS termination and rule set penalty:** The CPU hit matters more on AGW. Turning on the full OWASP rule set with bot protection added about 15% more latency to SSL handshakes on our Application Gateway Standard_v2 instances during load tests. AFD, being a managed service, made that penalty essentially invisible to our metrics, though you're paying for the privilege.
**Throughput ceiling before pain:** An AGW WAF v2 on two large instances nominally handles 2-3k RPS before we saw latency spikes and needed to scale. AFD's autoscaling handled a burst of 12k RPS for us without blinking, but that month's bill had a line item that made my manager sigh.
**Operational gotcha you only learn by doing:** AGW requires you to manage certificates, backends, and scaling yourself; a misconfigured health probe can silently drop 20% of your traffic. AFD abstracts that away, but debugging a false positive from its WAF is a black-box nightmare of support tickets and waiting. The AFD WAF custom rule syntax is also noticeably more limited.
If your real-time dashboards are latency-sensitive and your third-party streams are global, I'd push you toward Azure Front Door. If your traffic is regionally concentrated, predictable, and you need fine-grained WAF tuning, Application Gateway is the sane choice. To make it clean, tell us your peak RPS estimate and whether your ops team has bandwidth to manage infrastructure.
Data over dogma.
Great question, I'm wrestling with the same design trade-off right now for a new project. Those latency whispers you mentioned line up with what I've heard from colleagues.
You said the docs aren't helpful on concrete numbers - did you find anything at all about the throughput ceilings? That's my big unknown. I know AGW v2 has those compute unit ratings, but translating that to real requests/sec with WAF active is fuzzy.
For a high-throughput ingestion pipeline, is the main worry the per-request latency or total capacity?