topic Re: Palo Alto behind ReverseProxy, how block real IP ? in General Topics

Palo Alto behind ReverseProxy, how block real IP ?

ManuelRighi — Fri, 19 Oct 2018 12:23:23 GMT

Hello,

I have many website behind my Palo Alto.

In front of many websites (and then Palo Alto), I have Reverse Proxy.

Into traffic logs I see Reverse proxy IP, not the real visitor IP.

I have enabled "Use X-Forwarded-For" and now I see Real IP into colum X-Forwarded-For in Url Filtering.

But, it's possible to apply Security Profiles based on the IP of the x-forwarded-for header?

Thanks

Manuel

Re: Palo Alto behind ReverseProxy, how block real IP ?

BPry — Fri, 19 Oct 2018 13:35:54 GMT

@ManuelRighi,

No, the X-Forwarded-For field can't be utilized in security policies unless you first utilize X-Forwarded-For for User-ID; when using X-Forwarded-For you would need to have a user-id mapping to that IP address to really get any benefit out of it from a security rulebase perspective. This may or may not be usable in your current situation, dending on if the sites are internal or external.

I would reach out to your SE so that they can look and see if there is an existing Feature Request for this that he can add your vote to, and if not have him make one.

Re: Palo Alto behind ReverseProxy, how block real IP ?

LukeBullimore — Fri, 19 Oct 2018 14:03:01 GMT

Hey @BPry @ManuelRighi

Actually, I believe you can use the XFF IP address in a security policy 😉

Device -> Setup -> Content-ID -> "X-Forwarded-For Headers"

"Use X-Forwarded-For Header in User-ID"

https://www.paloaltonetworks.com/documentation/translated/70/newfeaturesguide/user-id-features/user-attribution-based-on-x-forwarded-for-headers

Re: Palo Alto behind ReverseProxy, how block real IP ?

BPry — Fri, 19 Oct 2018 14:20:54 GMT

@LukeBullimore,

Right. As stated above, you can utilize the X-Forwarded-For header IP for user-ID mapping. This doesn't mean that you can utilize the X-Forwarded-For IP as a source IP when configuring policy or anything like that. It simply means that you could assign the XFF header IP to a user, and then use that user-id in policy, not the XFF IP. The source address that the firewall sees will continue to be the address actually sending the traffic.

Re: Palo Alto behind ReverseProxy, how block real IP ?

Remo — Sat, 20 Oct 2018 21:23:10 GMT

I have never tried it but if the firewall cannot assign a user to the xff IP it will add "x-fwd-for: IP-ADDRESS" in the source user field. Could be worth a try to use exactly that in the security policy as source user to create "source IP" based policies even with a reverse proxy in front of the paloalto firewall.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClViCAK

... or you place the reverse proxy also behind the paloalto firewall 😉