topic Re: Can PA block IP address in X-Forwarded-For ? in VM-Series in the Public Cloud

Can PA block IP address in X-Forwarded-For ?

KiCheonLee — Fri, 21 Jul 2017 08:35:41 GMT

Hello,

I built the sandwich type with external ELB & internal ELB.

As you know, external ELB shifts original client IP to X-Forwarded-For.

I enabled 'Use X-Forwarded-For Header in User-ID and I looked XFF IP in user-id of URL Filtering logs.

But PA has not shown XFF IP in traffic logs.

I would like to block XFF IP using user-ID.

If anyone knew it, Please let me know it.

Thanks,

KC Lee

Re: Can PA block IP address in X-Forwarded-For ?

Warby — Sat, 26 Aug 2017 22:10:08 GMT

Hi KC Lee,

One of our TMEs has a working prototype that uses Lambda to map IPs learned from XFF to a User-ID group that can then be blocked by policy. It isn't ready to be published as a template yet but if you'd like a preview, please reach out to your sales team to schedule a demo.

HTH,

Warby

Re: Can PA block IP address in X-Forwarded-For ?

Warby — Fri, 26 Jan 2018 00:17:39 GMT

The XFF to User-ID solution has been published on GitHub: https://github.com/PaloAltoNetworks/XFF-to-User-ID-mapping

Re: Can PA block IP address in X-Forwarded-For ?

theljula — Wed, 18 Apr 2018 20:11:36 GMT

The solution provided deployes the XFF solution into an new VPC and Palo Alto instance. Is there any cloudformation template that is available to be deployed into an existing VPC and Palo Alto?