topic X-Forwarded-For (XFF) operation query in General Topics

X-Forwarded-For (XFF) operation query

Alpalo — Mon, 27 Nov 2023 12:13:05 GMT

Hello,

We are evaluating the implementation of X-Forwarded-For (XFF) functionality for logs.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

However, this functionality was activated and affected the traffic, denying traffic that should be allowed and that contained the XFF header.

In case the feature is enabled, if the traffic contains the XFF header, - How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header? - Is there any mechanism to verify the authenticity of who wrote the XFF header?

Thanks so much

Re: X-Forwarded-For (XFF) operation query

aleksandar.astardzhiev — Mon, 27 Nov 2023 14:26:12 GMT

Hi @Alpalo ,

As described here - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/policy-features/xff-header-support-for-security-policy

Since 10.0 PAN will use XFF source IP to enforce security policy.

Q: How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header?
A: Correct. Security policy will evaluated based on the source IP from the XFF and not the source IP from the network packet header.

Q: Is there any mechanism to verify the authenticity of who wrote the XFF header?

A: I don't there is a way. Due to the nature of the HTTP headers, you can slap there anything you want, the same way you can forged the user agent.