https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/the-xff-ip-is-the-same-but-the-country-of-origin-appears/m-p/1260872#M2471 <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="JiHwanHam_0-1785823048716.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/72185iC13F408B66009E3F/image-size/medium?v=v2&amp;px=400" role="button" title="JiHwanHam_0-1785823048716.png" alt="JiHwanHam_0-1785823048716.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Hello everyone,</P> <P>As shown in the screenshot, you can see that the traffic has the same X-Forwarded-For (XFF) value, but one session is allowed while the other is denied.</P> <UL> <LI> <P>The allowed session matched our custom application policy.</P> </LI> <LI> <P>The denied session matched the any deny policy.</P> </LI> </UL> <P>Based on what I am seeing, it appears that when the session is allowed, the firewall uses the original source IP, so the Country is shown as Any. However, when the session is denied, it seems to interpret the client IP using the XFF header, which is why the Country is shown as the Netherlands.</P> <P>Does anyone know if this is the expected behavior? Specifically, is XFF used for source IP interpretation only when a session is denied, while the original source IP is used when it is allowed?</P> <P>I searched the documentation but couldn't find any information describing this behavior. If anyone has seen this before or knows of any related documentation, I would really appreciate your insight.</P> <P>Thank you in advance.</P> Tue, 04 Aug 2026 06:00:43 GMT JiHwanHam 2026-08-04T06:00:43Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/the-xff-ip-is-the-same-but-the-country-of-origin-appears/m-p/1260872#M2471 <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="JiHwanHam_0-1785823048716.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/72185iC13F408B66009E3F/image-size/medium?v=v2&amp;px=400" role="button" title="JiHwanHam_0-1785823048716.png" alt="JiHwanHam_0-1785823048716.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Hello everyone,</P> <P>As shown in the screenshot, you can see that the traffic has the same X-Forwarded-For (XFF) value, but one session is allowed while the other is denied.</P> <UL> <LI> <P>The allowed session matched our custom application policy.</P> </LI> <LI> <P>The denied session matched the any deny policy.</P> </LI> </UL> <P>Based on what I am seeing, it appears that when the session is allowed, the firewall uses the original source IP, so the Country is shown as Any. However, when the session is denied, it seems to interpret the client IP using the XFF header, which is why the Country is shown as the Netherlands.</P> <P>Does anyone know if this is the expected behavior? Specifically, is XFF used for source IP interpretation only when a session is denied, while the original source IP is used when it is allowed?</P> <P>I searched the documentation but couldn't find any information describing this behavior. If anyone has seen this before or knows of any related documentation, I would really appreciate your insight.</P> <P>Thank you in advance.</P> Tue, 04 Aug 2026 06:00:43 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/the-xff-ip-is-the-same-but-the-country-of-origin-appears/m-p/1260872#M2471 JiHwanHam 2026-08-04T06:00:43Z