topic Re: does PA supports xForward ? in General Topics

does PA supports xForward ?

LCMember4717 — Wed, 22 Dec 2010 09:40:38 GMT

hi,

am wondering if PA can supports xforward as i need to install PA behind a bluecoat were the users request reaches 1st bluecoat then PA, so is there a way for pa to detect the ip addresses or usernames.

Re: does PA supports xForward ?

James — Wed, 22 Dec 2010 10:15:57 GMT

Hi There,

If you enable x-forward-for on the proxy, then the PA-Appliance will see the original source. However, this will only be seen in the URL logs and cannot currently be tied to User-ID.

Thanks

James

Re: does PA supports xForward ?

LCMember4717 — Wed, 22 Dec 2010 10:19:28 GMT

what about app-id would it work ? assuming my proxy doing url filter and pa application ana data filter ?

Re: does PA supports xForward ?

James — Wed, 22 Dec 2010 10:23:52 GMT

Yes, App-ID will work - but you will not see users or the X-Forward-For information in the traffic logs - only the URL logs

Re: does PA supports xForward ?

solsen — Thu, 23 Dec 2010 09:30:55 GMT

Hi all!

Be aware if you do x-forward-via header you will "publish" your

internal IP-addresses on the internet as the header will not be removed by Palo Alto.

That is as far as I know a new feature in 4.0.

There is a much better way to do this!

Let Blue Coat do "send-client-ip" and you will see the original source from the client.

You can enable this function in management console (my guess is proxy and general) or in the VPM and forward layer.

I recommend to use two dedicated L3 interfaces on the Palo Alto for this and put these in its own routing table, just to make 100% sure you do not get any asymmetric routing. So hope you have one "spare" public IP you can use for this.

Make sure you have this also in the local policy of the Blue Coat.

http.client.persistence(preserve)

You probably do not need an routing table in Blue Coat either except the default gateway.

Be aware that Blue Coat will do return-to-sender by default, meaning that it will reply to internal macaddress where the packet came from.

So there should be no need for a routing table.

Best regards Staffan, Radpoint Sweden.

Re: does PA supports xForward ?

linuss — Mon, 19 Dec 2011 02:24:34 GMT

Hi James,

You mentioned the App-ID will work, do you mean we can see which application (e.g. facebook) was using but the source IP is still the proxy server in traffic log?
How about the user-based QOS, it doesn't work with x-Forwared-for neither, right?

In PAN-OS 4.0.x/4.1.x, is the same limitation exist?

Regards,
Linus