https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/574041#M115391 <P>Hello everyone,</P> <P>&nbsp;</P> <P>I have enable x-forwarded-for in PA.</P> <P>When I look at the pcap from PA, I see the ip address</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="HSutanto_0-1705994982774.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56776iFE232A83A30E391C/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="HSutanto_0-1705994982774.png" alt="HSutanto_0-1705994982774.png" /></span></P> <P>but from monitor log traffic, collum x-forwarded-for ip is empty</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="HSutanto_1-1705995502941.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56777i28C75339DB5BE101/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="HSutanto_1-1705995502941.png" alt="HSutanto_1-1705995502941.png" /></span></P> <P>&nbsp;</P> <P>Please your help.</P> <P>Thank you</P> Tue, 23 Jan 2024 07:39:57 GMT H.Sutanto 2024-01-23T07:39:57Z https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/574041#M115391 <P>Hello everyone,</P> <P>&nbsp;</P> <P>I have enable x-forwarded-for in PA.</P> <P>When I look at the pcap from PA, I see the ip address</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="HSutanto_0-1705994982774.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56776iFE232A83A30E391C/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="HSutanto_0-1705994982774.png" alt="HSutanto_0-1705994982774.png" /></span></P> <P>but from monitor log traffic, collum x-forwarded-for ip is empty</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="HSutanto_1-1705995502941.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56777i28C75339DB5BE101/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="HSutanto_1-1705995502941.png" alt="HSutanto_1-1705995502941.png" /></span></P> <P>&nbsp;</P> <P>Please your help.</P> <P>Thank you</P> Tue, 23 Jan 2024 07:39:57 GMT https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/574041#M115391 H.Sutanto 2024-01-23T07:39:57Z https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/574063#M115395 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/865903543">@H.Sutanto</a>&nbsp;,</P> <P>&nbsp;</P> <P>I've seen scenarios where XFF is not logged because of traffic not getting decrypted (<A href="https://live.paloaltonetworks.com/t5/general-topics/xff-ip-does-not-show-the-source-ips-on-the-monitor/td-p/471063)" target="_blank">https://live.paloaltonetworks.com/t5/general-topics/xff-ip-does-not-show-the-source-ips-on-the-monitor/td-p/471063)</A>.&nbsp;</P> <P>Also seen it because the url filtering profile where you enable XFF was not being applied to the rule.&nbsp;&nbsp;</P> <P>&nbsp;</P> <DIV class="slds-grid slds-gutters_small full cols-1 forcePageBlockSectionRow" data-aura-rendered-by="245:23685;a" data-aura-class="forcePageBlockSectionRow"> <DIV class="slds-col slds-grid slds-has-flexi-truncate has-tooltip full long-text forcePageBlockItem forcePageBlockItemView" data-target-selection-name="sfdc:RecordField.Knowledge__kav.Cause__c" data-aura-rendered-by="232:23685;a" data-aura-class="forcePageBlockItem forcePageBlockItemView"> <DIV class="slds-form-element slds-form-element_readonly slds-form-element_edit slds-grow slds-hint-parent override--slds-form-element hover" data-aura-rendered-by="233:23685;a"> <DIV class="slds-form-element__control slds-grid itemBody" data-aura-rendered-by="237:23685;a"> <DIV class="slds-rich-text-editor__output uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge" dir="ltr" data-aura-rendered-by="229:23685;a" data-aura-class="uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge">And also saw it when the firewall failed to parse IP address in XFF header due to additional port number being appended by Azure Application Gateway (PA-VM on Azure).</DIV> <DIV class="slds-rich-text-editor__output uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge" dir="ltr" data-aura-rendered-by="229:23685;a" data-aura-class="uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge">&nbsp;</DIV> <DIV class="slds-rich-text-editor__output uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge" dir="ltr" data-aura-rendered-by="229:23685;a" data-aura-class="uiOutputRichText forceOutputRichText forceKnowledgeOutputRichTextForKnowledge">If neither of these fit your scenario I'd recommend debugging further with<SPAN>&nbsp;<STRONG>packet-diag flow basic and ctd</STRONG> to get more details.</SPAN></DIV> </DIV> </DIV> </DIV> </DIV> <DIV class="slds-grid slds-gutters_small full cols-1 forcePageBlockSectionRow" data-aura-rendered-by="274:23685;a" data-aura-class="forcePageBlockSectionRow"> <DIV class="slds-col slds-grid slds-has-flexi-truncate has-tooltip full long-text forcePageBlockItem forcePageBlockItemView" data-target-selection-name="sfdc:RecordField.Knowledge__kav.Solution__c" data-aura-rendered-by="261:23685;a" data-aura-class="forcePageBlockItem forcePageBlockItemView">&nbsp;</DIV> <DIV class="slds-col slds-grid slds-has-flexi-truncate has-tooltip full long-text forcePageBlockItem forcePageBlockItemView" data-target-selection-name="sfdc:RecordField.Knowledge__kav.Solution__c" data-aura-rendered-by="261:23685;a" data-aura-class="forcePageBlockItem forcePageBlockItemView">Kind regards,</DIV> <DIV class="slds-col slds-grid slds-has-flexi-truncate has-tooltip full long-text forcePageBlockItem forcePageBlockItemView" data-target-selection-name="sfdc:RecordField.Knowledge__kav.Solution__c" data-aura-rendered-by="261:23685;a" data-aura-class="forcePageBlockItem forcePageBlockItemView">-Kim.</DIV> </DIV> Tue, 23 Jan 2024 10:07:20 GMT https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/574063#M115395 kiwi 2024-01-23T10:07:20Z https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/615550#M121820 <P>Hey,</P> <P>&nbsp;</P> <P>How did you solve the issue?</P> Tue, 29 Oct 2024 08:46:16 GMT https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-ip-not-appear-in-traffic-log/m-p/615550#M121820 nemanja_miloj 2024-10-29T08:46:16Z