Why would the configuration not include a firewall before the WAF? I would expect the configuration to look like this:

Azure Front Door -> Firewall (Azure/Palo Alto/F5) ->Azure WAF ->Internal Load Balancer -> AKS