Not able to log XFF (Actual Client IP) in PaloAlto Logs even when we enable XFF and URL filtering profile in Palo's

tn001140351 — Wed, 26 Nov 2025 08:46:30 GMT

Issue Summary – XFF Not Logged on Palo Alto (Even With Decryption ON)

We are running a flow where AWS ALB inserts X-Forwarded-For (XFF) and the Palo Alto firewall performs SSL decryption + re-encryption:

Flow:

Client --> Internet --> AWS ALB (HTTPS) (Palo's are registered as TG IP) --> Palo Alto FW (SSL Decrypt) --> Server

What works

What doesn’t work

What we tested

Observed Behavior

XFF header is present on HTTP/80 after Palo decrypt → Visible in PCAP.
XFF header is missing on HTTPS/443 after Palo decrypt → Not visible in PCAP.
Therefore: Firewall cannot log XFF because the header never arrives on the decrypted HTTPS session.

Re: Not able to log XFF (Actual Client IP) in PaloAlto Logs even when we enable XFF and URL filtering profile in Palo's

tn001140351 — Thu, 27 Nov 2025 14:56:02 GMT

Do we have any solution for this issue?

ricardomo — Wed, 29 Apr 2026 14:35:51 GMT

I've got the same issue. Been doing test and with decrypt ON, I cant see XFF header. Without decrypt, works OK.

Dont know what the issue can be 😞