How to get the client's IP address with x-forwarder-for in PAN.

exclusive — Wed, 12 Dec 2012 11:16:22 GMT

How to get the client's IP address with x-forwarder-for in PAN, I need to create something to caputure this part of HTTP header?

Thanks.

Patricia.

Re: How to get the client's IP address with x-forwarder-for in PAN.

mikand — Wed, 12 Dec 2012 13:04:40 GMT

I guess these settings might help (the first one is to remove that header from leaving your internal network):

set deviceconfig setting ctd strip-x-fwd-for yes

set deviceconfig setting ctd x-forwarded-for yes

According to the CLI manual for PANOS 4.1:

> ctd

+ bypass-exceed-queue — Set whether to skip inspection of session if queue limit is exceeded

+ http-proxy-use-transaction — Set whether to use transaction for stats for http proxy sessions

+ skip-block-http-range — Whether to skip the blocking of HTTP range requests

+ strip-x-fwd-for — Set whether to strip x-forwarded-for in http header

+ url-admin-timeout — Set URL admin continue timeout in minutes (1-86400)

+ url-coach-timeout — Set URL coach continue timeout in minutes (1-86400)

+ url-lockout-timeout — Set URL admin override lockout timeout in minutes (1-86400)

+ url-wait-timeout — Set URL category query timeout in seconds (1-60)

+ x-forwarded-for — Enable/disable parsing of x-forwarded-for attribute

There is also a similar setting in "set system setting", dunno what the difference is:

> ctd

> regex-stats-on — Whether or not generate regex statistics

> strip-x-fwd-for — Whether or not to strip x-forwarded-for from HTTP headers

> x-forwarded-for — Enables or disables parsing of the x-forwarded-for attribute