Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

[eloy_hong]

Hello. all.

Is it possible to apply "IP Address Exemptions" into Security Profiles based on the IP of the x-forwarded-for header?

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/identify-users-connected-through-a...

You can configure the firewall to use the source IP address in the X-Forwarded-For (XFF) HTTP header field to enforce security policy. When a packet passes through a single proxy server before reaching the firewall, the XFF field contains the IP address of the originating endpoint. However, if the packet passes through multiple upstream devices, the firewall uses the most recently added IP address to enforce policy or use other features that rely on IP information.

Thanks.
Regards,

[OtakarKlier]

Hello,

Not sure if that is possible, however I would suggest utilizing User-ID instead, if possible.

Regards,

[BPry]

@eloy_hong,

Last I heard, there was a feature request to add this functionality into PAN-OS but nothing actually supported at the moment on the firewall.