topic Re: XFF: For security Policy in General Topics

XFF: For security Policy

raji_toor — Sat, 18 Feb 2023 00:26:49 GMT

Trying to implement this.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

Azure Web Application Gateway is in the front, acting as proxy. I can see packet captures for port 80 x-forward for is included

But i don't see xff in traffic logs, and matching the url accessed shows traffic from Azure Gateways internal backend IP and not from the original client IP in XFF.

How ever I don't see IP under XFF traffic logs as source ip

Also i tried adding source ip to be blocked to test, and could not get it to work

Re: XFF: For security Policy

nikoolayy1 — Mon, 20 Feb 2023 09:12:58 GMT

Hello, I suspect that because also the port is included it causes issues. Try to have an HTTP header that contains just one IP address without a port :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0

Re: XFF: For security Policy

raji_toor — Tue, 21 Feb 2023 16:58:00 GMT

Thanks @nikoolayy1

Rewriting HTTP header on Application Gateway to remove port information made it work.