topic Re: X-Forwarded-For displays wrong ip (v6) in logs in Next-Generation Firewall Discussions

X-Forwarded-For displays wrong ip (v6) in logs

Magnus_App — Wed, 27 Sep 2023 07:12:39 GMT

Hi.

We have a azure setup, web application, where an agw first terminates traffic and applies xff and then forwards to firewalls which then decrypt the session. We have X-Forwarded-For enabled and usually works fine and displays the correct ipv4 address in logs. From time to time though logs instead display ipv6 addresses which we dont use and afaik we know there is no ipv6 in play at all.

We are having a hard time troubleshooting since pcaps on firewalls are encrypted, is there a way around that? We've tried to look at pcaps on clients where we can decrypt in wireshark but xff is not visible there.

Re: X-Forwarded-For displays wrong ip (v6) in logs

akuzhuppilly — Thu, 05 Oct 2023 06:21:44 GMT

Hello @Magnus_App

It sounds like a software-related issue.

You may open a TAC case to get the fix/workaround.

Re: X-Forwarded-For displays wrong ip (v6) in logs

DarrenAdmin — Thu, 27 Jun 2024 17:50:20 GMT

Hi Magnus,

We have a similar setup and experiencing the same issue with IPv6 showing up in the logs. Did you ever find a solution to this?

Re: X-Forwarded-For displays wrong ip (v6) in logs

blewinski — Tue, 06 Aug 2024 22:37:47 GMT

Please read the notes section in the below KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0

Re: X-Forwarded-For displays wrong ip (v6) in logs

Magnus_App — Mon, 12 Aug 2024 08:35:19 GMT

Hi Darren,

It became a known bug after a while and was fixed in 10.2.9, https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-9-known-and-addressed-issues/pan-os-10-2-9-addressed-issues

Bug id: PAN-241018

Re: X-Forwarded-For displays wrong ip (v6) in logs

DarrenAdmin — Sat, 24 Aug 2024 17:44:35 GMT

Unfortunately upgrading PANOS to version 10.2.9 or later didn't totally fix it for me. The random ipv6 addresses in the traffic logs did go away, however now it just displays an empty field. I can verify policies based on XFF header IP is working and that in the URL category logs it's indeed displaying. Getting it to display in the regular traffic logs is still a problem. PA TAC even recommended to upgrade to version 11.1.4 and that didn't fix it either. This issue seems to only affect 443 traffic that being decrypted on the firewall. For port 80 traffic, it's able to display the XFF header IP fine in the traffic logs.