topic Re: XFF IP Address Logging clarification and impact in General Topics

XFF IP Address Logging clarification and impact

ET — Wed, 13 May 2026 17:18:05 GMT

I would like to view XFF IP Address in the Logs.

I went through a few articles and have a few clarifications:

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-connected-through-a-proxy-server/add-xff-values-to-url-filtering-logs

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClViCAK

1. Should i enable [ Device > Setup > Content-ID > X-Forwarded-For Headers ] in order to see the XFF in logs?

2. If enabled - will all security rules continue to function as before or they will start inspecting XFF IPs instead of the regular L3 IPs?

3. Should XFF also be enabled in URL profile for this feature to work ?

4. Can I see XFF in traffic logs? - YES.

Re: XFF IP Address Logging clarification and impact

BPry — Wed, 13 May 2026 19:07:37 GMT

@ET,

If you're just looking to log it without using it for user-id or policy, the only thing that you need to do is enable it in your url-filtering profiles. You would only enable the options under Content-ID if you want to use that information for User-ID or use it in security assessment.

Re: XFF IP Address Logging clarification and impact

ET — Wed, 13 May 2026 22:13:13 GMT

In this article it's mentioned "URL Filtering logs do not display the X-Forwarded For IP field. To view X-Forwarded-For IP log events, you must export the logs to CSV format"

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-connected-through-a-proxy-server/add-xff-values-to-url-filtering-logs

Yet in another article , they are seen in the traffic logs

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

Which one is correct or in which cases each is true ?