X-Forwarded-For (XFF) operation query

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

X-Forwarded-For (XFF) operation query

L4 Transporter

Hello,

We are evaluating the implementation of X-Forwarded-For (XFF) functionality for logs.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/identify-users-connected-through-a...

However, this functionality was activated and affected the traffic, denying traffic that should be allowed and that contained the XFF header.

In case the feature is enabled, if the traffic contains the XFF header, - How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header? - Is there any mechanism to verify the authenticity of who wrote the XFF header? 

 

Thanks so much

1 accepted solution

Accepted Solutions

Hi @Alpalo ,

 

As described here - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/policy-features/xff-header-support...

Since 10.0 PAN will use XFF source IP to enforce security policy.

Q: How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header?
A: Correct. Security policy will evaluated based on the source IP from the XFF and not the source IP from the network packet header.

 

Q: Is there any mechanism to verify the authenticity of who wrote the XFF header? 

A: I don't there is a way. Due to the nature of the HTTP headers, you can slap there anything you want, the same way you can forged the user agent.

View solution in original post

1 REPLY 1

Hi @Alpalo ,

 

As described here - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/policy-features/xff-header-support...

Since 10.0 PAN will use XFF source IP to enforce security policy.

Q: How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header?
A: Correct. Security policy will evaluated based on the source IP from the XFF and not the source IP from the network packet header.

 

Q: Is there any mechanism to verify the authenticity of who wrote the XFF header? 

A: I don't there is a way. Due to the nature of the HTTP headers, you can slap there anything you want, the same way you can forged the user agent.

  • 1 accepted solution
  • 596 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!