How to block the real IPs from CDN?

[SteveY]

Is there any function that can makes the PA block the traffic of the real IP instead of CDN IPs?

We deployed the PA NGFW on the external side of our web server and enabled the Threat Prevention function. Because we are using the CDN, so from the web server, all the source IPs in the traffic are hosted by the CDN service provider.

So when the PA  NGFW blocks  the source IP addresses because of the attack behavior, is there any way to block the real IPs of the attackers nor the IPs hosted by the CDN provider?

Thanks!

[rmonvon]

Hi...Do you know if the CDN provider is passing the real IP address in any way to your web server such that the PA can see it?

[SteveY]

Thanks for reply, rmonvon.

Yes, we have asked our CDN provider to pass the real IP addresses in the packet header.

Do you have any idea?

[rmonvon]

Are they embedding the IP address in the TCP option 28 header or HTTP 'x-forwarded-for' header or another header? 

If they are using  the TCP option 28 header, I suggest you contact your local Palo Alto Nwks' SE and submit a feature request. 

If they are using the HTTP 'x-forwarded-for' header, the PA can log the header so you can correlate the logs to determine the real IP of the intruder.  From there, you can write a custom threat signature to match the real IP and block this new custom threat. This is a manual process though.

[SteveY]

Thanks for your reply.

They are embedding the IP address in the HTTP 'x-forwarded-for' header.

Can the blocking function be automatical?

For example, if the attacker is launching a DOS attack, can PA only block or quarantine the real IP nor the CDN IP?

[SteveY]

For example, if I enable syn flood prevetion, will the PA FW quarantine the real IPs or CDN IP? Thank you!

[rmonvon]

The default behavior of the PA will take action on the source IP address, and in this case this would be the CDN's IP address.   At this time, the PA cannot take action on the IP address in the HTTP 'x-forwarded-for' header.  Please contact your local Palo Alto Nwks' SE and submit a feature request.  You can turn on logging for HTTP 'x-forwarded-for' header:

Enabling support for the X-Forwarded-For HTTP header