PA5020 and Proxy Server

[aguley]

I have a PA5020 and am using a proxy server to filter internet traffic.  In the traffic monitor all the traffic I see going to the web is from the proxy server.  I turned this feature on on the firewall.  Enabling support for the X-Forwarded-For HTTP header.  After enabling this feature I didn't see any difference in the monitor section of the firewall.

Is there anyway I can identify the user or IP address instead of just identifying the proxy server.

Thanks

[kadak]

Hello aguley,

I went through Enabling support for the  X-Forwarded-For HTTP header. document and didn't see the commit operation mentioned.

If you have enabled it from the configuration mode, lets make sure you commit the configuration: 

> configure

# set deviceconfig setting ctd x-forwarded-for yes

#commit force

Regards,

Kunal Adak

[aguley]

That's the command that I ran and I commited the changes as well.  Still just seeing traffic from proxy.  Or possibly I am looking in the wrong place.  Should I just see it in the monitor section of the firewall or do I need to dig deeper into some logs?

Thanks

[kadak]

Hello aguley,

I hope you are looking into URL logs for X-forwarded information - not the traffic logs.

Reference:

x-forward source user information is not showing in traffic logs

Hope that helps!

Thanks and regards,

Kunal Adak

[aguley]

I am looking at the traffic logs.  I am getting an error trying to click on your link saying access is restircted.  How do I view the URL logs for X-forwarded information?

I am very new to PA so thank you for the very quick responses.