When parsing of the "X-forwarded-for" attribute is enabled and the source user is unknown, the leftmost IP address (client's IP address) is stored in the source user column of the URL log. If the firewall is not licensed for URL filtering, perform the following to enable sessions to populate the URL log.
Create a URL filtering profile object
Under the block list, add the following two entries: