topic Re: Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header? in General Topics

Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

eloy_hong — Fri, 18 Nov 2022 08:20:49 GMT

Hello. all.

Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

You can configure the firewall to use the source IP address in the X-Forwarded-For (XFF) HTTP header field to enforce security policy. When a packet passes through a single proxy server before reaching the firewall, the XFF field contains the IP address of the originating endpoint. However, if the packet passes through multiple upstream devices, the firewall uses the most recently added IP address to enforce policy or use other features that rely on IP information.

Thanks.
Regards,

Re: Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

OtakarKlier — Fri, 18 Nov 2022 22:37:10 GMT

Hello,

Not sure if that is possible, however I would suggest utilizing User-ID instead, if possible.

Regards,

Re: Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

BPry — Mon, 21 Nov 2022 20:54:29 GMT

@eloy_hong,

Last I heard, there was a feature request to add this functionality into PAN-OS but nothing actually supported at the moment on the firewall.