Single service comparison

Azure WAF is delivered as an integral module of Application Gateway or Front Door, so enforcement points, TLS termination, and routing are bundled with the gateway resource. Huawei WAF is an independent cloud service accessed by CNAME proxy (cloud mode) or a dedicated engine, decoupled from ELB/CDN. This means Azure policy is bound to a frontend listener; Huawei policy is bound per protected domain and account, with edition tiers (Entry/Standard/Professional/Enterprise) capping protected domain counts and QPS rather than tying the WAF to a specific load balancer SKU.

Policy modeling and tuning differ materially. Azure exposes managed rule sets with per-rule-group overrides, exclusions, and custom rules in a single WAF policy object, versioned and observable through Azure Monitor/Log Analytics. Huawei WAF exposes built-in rules plus configurable policies per domain (basic protection, CC, precise protection, blacklist/whitelist, content), with full attack/access/request logs shipped to Log Tank Service (LTS). The Huawei tuning workflow centers on per-domain rule scope and edition-gated features, whereas Azure centers on policy-level rule-set versioning and action overrides, so custom exclusions rarely map one-to-one and must be re-built per domain.

Scaling, HA, and complementary controls differ. Azure scaling inherits the App Gateway/Front Door tier and autoscale rules; the WAF has no independent QPS catalog. Huawei WAF advertises multi availability-zone and multi-region failover with up to 10M QPS targets, billed per edition plus extension packs, and is commonly composed with Anti-DDoS (AAD), Cloud Firewall (CFW), and Cloud Certificate Manager (CCM). Azure integrations lean on Azure Monitor, Key Vault, and Front Door's global TLS stack; Huawei equivalents use LTS, CCM, and HSS, so observability, secret, and edge-DDoS toolchains must be reassessed rather than assumed equivalent.

Begin with assessment and target choice. Inventory Azure WAF policies (managed rule-set versions, custom rules, exclusions, action preferences), per-listener bindings, TLS certificates, and logs used for tuning. Select Huawei WAF edition by protected-domain count and peak QPS, and pick cloud-mode CNAME for SaaS-style reverse-proxy traffic or dedicated mode for isolated or non-standard-port workloads. Validate that high-value exclusions (by request attribute, path, header) have Huawei-side equivalents, since import tooling does not exist.

Migrate configuration manually. There is no automated Azure-to-Huawei policy converter, so recreate each domain entry in the Huawei WAF console: add the protected domain, upload or reference TLS certificate via Cloud Certificate Manager, define origin server addresses and ports, then rebuild basic OWASP protection, custom precise-protection rules, CC rules, and black/whitelists. Mirror sensitive-field masking if Azure used custom log masking. Where Front Door's global edge or DDoS behavior was relied on, add Huawei Anti-DDoS (AAD) and Cloud Firewall (CFW) rather than expecting WAF alone to cover edge L3/L4 volumetric attacks.

Validate before cutover. Ingest representativetraffic through a test Huawei WAF instance (or staged CNAME in shadow/monitor mode where supported) and compare false positives/negatives against Azure WAF logs for at least a peak and an off-peak period. Confirm response actions, custom block pages, geographic/IP reputation, and any PCI-DSS/3DS compliance-style TLS settings still behave as expected. Run origin health checks and certificate validation to catch TLS chain issues, which are a common regression with CNAME-based WAFs.

Plan cutover and cost model change. Cutover is a DNS CNAME switch per protected domain, performed sequentially with monitoring, taking advantage of the multi-AZ failover Huawei WAF offers within a region. Recompute TCO because Azure bills per policy tier plus processed requests while Huawei bills an edition fee (per-month) plus extension packs for additional domains/QPS, plus separately priced LTS retention, AAD, and CCM where used. Document residual gaps (managed rule-set version parity, Azure-native Monitor queries, Key Vault certificate automation) and decide whether to bridge them through LTS dashboards and manual certificate rotation.