topic Re: How to block the real IPs from CDN? in General Topics

How to block the real IPs from CDN?

SteveY — Sun, 26 Jan 2014 04:55:47 GMT

Is there any function that can makes the PA block the traffic of the real IP instead of CDN IPs?

We deployed the PA NGFW on the external side of our web server and enabled the Threat Prevention function. Because we are using the CDN, so from the web server, all the source IPs in the traffic are hosted by the CDN service provider.

So when the PA NGFW blocks the source IP addresses because of the attack behavior, is there any way to block the real IPs of the attackers nor the IPs hosted by the CDN provider?

Thanks!

Re: How to block the real IPs from CDN?

rmonvon — Mon, 27 Jan 2014 15:34:15 GMT

Hi...Do you know if the CDN provider is passing the real IP address in any way to your web server such that the PA can see it?

Re: How to block the real IPs from CDN?

SteveY — Mon, 27 Jan 2014 15:55:12 GMT

Thanks for reply, rmonvon.

Yes, we have asked our CDN provider to pass the real IP addresses in the packet header.

Do you have any idea?

Re: How to block the real IPs from CDN?

rmonvon — Mon, 27 Jan 2014 16:44:53 GMT

Are they embedding the IP address in the TCP option 28 header or HTTP 'x-forwarded-for' header or another header?

If they are using the TCP option 28 header, I suggest you contact your local Palo Alto Nwks' SE and submit a feature request.

If they are using the HTTP 'x-forwarded-for' header, the PA can log the header so you can correlate the logs to determine the real IP of the intruder. From there, you can write a custom threat signature to match the real IP and block this new custom threat. This is a manual process though.

Re: How to block the real IPs from CDN?

SteveY — Mon, 27 Jan 2014 17:43:38 GMT

Thanks for your reply.

They are embedding the IP address in the HTTP 'x-forwarded-for' header.

Can the blocking function be automatical?

For example, if the attacker is launching a DOS attack, can PA only block or quarantine the real IP nor the CDN IP?

Re: How to block the real IPs from CDN?

SteveY — Mon, 27 Jan 2014 17:58:12 GMT

For example, if I enable syn flood prevetion, will the PA FW quarantine the real IPs or CDN IP? Thank you!

Re: How to block the real IPs from CDN?

rmonvon — Mon, 27 Jan 2014 18:17:22 GMT

The default behavior of the PA will take action on the source IP address, and in this case this would be the CDN's IP address. At this time, the PA cannot take action on the IP address in the HTTP 'x-forwarded-for' header. Please contact your local Palo Alto Nwks' SE and submit a feature request. You can turn on logging for HTTP 'x-forwarded-for' header:

Enabling support for the X-Forwarded-For HTTP header