Reverse Proxy and X-forwarded-for

[MerrickNetworkEngineers]

We use a load balancer to terminate SSL connections coming into our publicly accessible web servers from the Internet.  The same load balancers are used as a reverse proxy.  Because this produces a blind-spot for us, we have configured the load balancer to insert the real Internet IP into the XFF entry of the resulting inbound HTTP packet (we don't re-encrypt the packet after the load balancer has decrypted it).  I can't find a way to generate a report that shows the XFF entries within packets coming into the firewall from the load balancer.

All documentation I can find is for outbound traffic going over a proxy server (not reverse-proxy).  Can the firewall retrieve the XFF entries from packets coming from a reverse-proxy sourced from the Internet?  If so, how can I generate a report that shows this information?

Thanks!

[reaper]

Hi

have you enabled x-forward for? How to Enable Support for the X-Forwarded-For HTTP Header

reaper@myNGFW> configure 
Entering configuration mode
[edit]                                                                          
reaper@myNGFW# set deviceconfig setting ctd x-forwarded-for 
  no    no 
  yes   yes 

[reaper]

Hi @MerrickNetworkEngineers

I deleted your comments in the KB article as those would not make sense from a conversational standpoint

If you have enabled the x-forward for headers, then we move on to the next step: have you enabled user-id in the zone where the load balancers sit?

[MerrickNetworkEngineers]

Yes.  User-ID is enabled for the zone the LB is in.

[MerrickNetworkEngineers]

An item of note in the document you refer to is that it appears that XFF entries in the Source User field is only support with URL filtering.  I'm not doing any URL filtering for inbound reverse-proxied connections.  There is not reason I can think of to do URL filtering on an inbound connection through a reverse-proxy.

[reaper]

Ah, that would explain why it's not working working as expected

XFF plugs in in the URL filtering layer on the firewall, if you haven't got URL filtering enabled the headers will be ignored

XFF Headers

[lagop]

Try creating a custom URL Filtering with your sites or * and apply it to a URL Filtering Profile which is then attached to your rule(s) processing inbound traffic. This can be done without the need for our PAN-DB URL Filtering subscription. This post has some useful steps that may be helpful. Although the true source IP will be added to the Source User field in your URL logs, they can also be leveraged when looking at other logs through 'Related Logs' feature.  Good luck and please post if it works or not.

[MikeSangray2019]

I'm working on this as well. To be clear, this has to be enabled twice in three places.

1) the GUI URL Filtering Profile -> URL Filtering Settings (tab)

2) cli -->   >configure   # set deviceconfig setting ctd x-forwarded-for yes|no

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0

3) create a custom URL Category with your sites listed, apply this custom category to a URL Filtering Profile, and apply the filtering profile to the appropriate security policies

This is working for me.