Threat Logs: Countries with no IP

[raji_toor]

So we have 'Use X-Forwarded-For HeaderEnabled for Security Policy' enabled, and are using it policies.

The threat logs show the real Source Country but no address under X-Forwarded For IP Column. Although when exported to CSV many logs show the real address under XFF column. And many don't. Again checking in GUI although some logs show XFF in in packet capture(single packet enabled) it does not show in the logs. 

Now because I cannot filter for XFF in threat logs, I can't use dynamic address groups to auto block these IPs

Logging need to be improved for 'Use X-Forwarded-For HeaderEnabled for Security Policy'  feature.

We are on 10.1.8

[SutareMayur · Accepted solution]

Hi @raji_toor ,

Please check if this -

Click here for more details.

[raji_toor]

Thanks @SutareMayur , Yes that was an oversight. Low level logs without packet capture were showing as expected and critical also stated showing IP address after disabling packet capture on vulnerability profile.