topic Re: x-forwarded-for and User Identificaton in General Topics https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-and-user-identificaton/m-p/20729#M15142 <HTML><HEAD></HEAD><BODY><P>This is expected behavior.&nbsp; The PAN receives the x-forwarded-for address after the TCP session has already started.&nbsp; User-ID happens at the start of the session, not during an existing session.</P><P></P><P>Kelly</P></BODY></HTML> Tue, 02 Mar 2010 15:02:43 GMT kbrazil 2010-03-02T15:02:43Z x-forwarded-for and User Identificaton https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-and-user-identificaton/m-p/20728#M15141 <HTML><HEAD></HEAD><BODY><P>We have configured x-forwarded-for flagging along with the User Identification.</P><P></P><P>Traffic logs from a tap upstream of a (squid) proxy carry the x-forwarded-for flag, but the IP is not resolved to a user.</P><P></P><P>Is this expected behaviour? (i.e. is ip-to-user translation supported in reference to x-forwarded-for?)</P><P></P><P>Many thanks in advance.</P></BODY></HTML> Tue, 02 Mar 2010 14:27:44 GMT https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-and-user-identificaton/m-p/20728#M15141 joshua_green 2010-03-02T14:27:44Z Re: x-forwarded-for and User Identificaton https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-and-user-identificaton/m-p/20729#M15142 <HTML><HEAD></HEAD><BODY><P>This is expected behavior.&nbsp; The PAN receives the x-forwarded-for address after the TCP session has already started.&nbsp; User-ID happens at the start of the session, not during an existing session.</P><P></P><P>Kelly</P></BODY></HTML> Tue, 02 Mar 2010 15:02:43 GMT https://live.paloaltonetworks.com/t5/general-topics/x-forwarded-for-and-user-identificaton/m-p/20729#M15142 kbrazil 2010-03-02T15:02:43Z