topic Re: PAN-VM x-forwarded-for feature question in gcp cloud in VM-Series in the Public Cloud

PAN-VM x-forwarded-for feature question in gcp cloud

ttak87 — Mon, 26 Jul 2021 06:25:48 GMT

Hello.
I have built a simple sandwich structure test environment on GCP Cloud.

ALB

↙ ↘

FW1 FW2

↘ ↙

NLB

↙ ↘

SV1 SV2

However, in the PAN traffic log, XFF IP is only the IP of the upper ALB.

GCP's official documentation confirmed that the XFF header contains both the client IP and the LB IP.

I actually did a packet capture from the PAN, both IPs are in the XFF header.

Below is a capture of only the XFF part of the captured packet.

(By capturing the packet, both the real client IP and the ALB IP can be checked.)

Below is the XFF IP seen by the PAN.
Only the IP of the ALB that is checked in packet capture is recorded in the log.

The detailed log only checks the IP of the ALB.

The point is, if the XFF IP is simply an ALB IP in the PAN traffic log, then the XFF function doesn't seem to have any meaning.

Is there any way to see in the log the client IP and not the ALB IP?
Or am I doing something wrong?

Please help me...

Regards,

Re: PAN-VM x-forwarded-for feature question in gcp cloud

SutareMayur — Mon, 26 Jul 2021 12:14:37 GMT

Hi @ttak87

You need to do settings on firewall to enable these logs. Its not enabled by default on Palo Alto.

Kindly refer below article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0

Hope it helps!

Re: PAN-VM x-forwarded-for feature question in gcp cloud

ttak87 — Tue, 27 Jul 2021 01:29:09 GMT

Hi, @SutareMayur

Thanks for your reply.

However, I have already set the settings you taught me.

I want to check the Client IP and not the ALB IP in the log.

Re: PAN-VM x-forwarded-for feature question in gcp cloud

SutareMayur — Tue, 27 Jul 2021 05:35:34 GMT

Hi @ttak87

Could you please share PA o/p of below cli command -

show system setting ctd state | match x-

Re: PAN-VM x-forwarded-for feature question in gcp cloud

ttak87 — Wed, 28 Jul 2021 01:11:16 GMT

Hi, @SutareMayur

This is the result of the requested command.

Re: PAN-VM x-forwarded-for feature question in gcp cloud

ttak87 — Wed, 28 Jul 2021 01:18:19 GMT

Additionally, I looked at Palo Alto's document, and it seems that only the LB's IP is checked for the XFF IP in the proxy type LB.

If so, I think that GCP is limited in practically using XFF when using ALB.
Am I right?

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging.html

Re: PAN-VM x-forwarded-for feature question in gcp cloud

jmeurer — Wed, 28 Jul 2021 03:03:30 GMT

The issue is that the firewall is using the last IP in the list and not the first. Please open a TAC case to push the fix through to engineering.

Re: PAN-VM x-forwarded-for feature question in gcp cloud

Susaant — Wed, 28 Jul 2021 03:49:48 GMT

Hi @ttak87,

There are a couple of options around XFF in PAN-OS:

If the requirement is to enforce security on XFF IP, the option you are currently using is the right one. However, with this PAN-OS feature, the policy enforcement and the corresponding logs will apply only to the last IP in the XFF list. In GCP, ALB inserts the source IP of the packet received followed by the ALB's IP. So the last IP in this case always happens to be ALB IP. So, unfortunately in GCP's ALB case, this feature is limited in its application.
If the requirement is only to log the original client IP (and not policy enforcement), then another option is to use the attached PAN-OS feature. With this feature though, the 'first' IP address in the XFF list is logged in the URL filtering logs. If the packet traverses multiple proxies on the path, there could be multiple IP addresses (comma separated) in the XFF header. And this feature will use the first IP address in the list to add to the URL filtering log.

Hope this helps.

Re: PAN-VM x-forwarded-for feature question in gcp cloud

ttak87 — Wed, 28 Jul 2021 05:17:25 GMT

I understood the content.
Be able to explain well to customers.

Thanks everyone for the replies. 🙂

Re: PAN-VM x-forwarded-for feature question in gcp cloud

Mitesh_Nandu — Sun, 26 Feb 2023 07:03:50 GMT

We Enabled for User-ID, still we are not receiving client real ip address.