X-Forwarded-For (XFF) operation query

[Alpalo]

Hello,

We are evaluating the implementation of X-Forwarded-For (XFF) functionality for logs.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/identify-users-connected-through-a...

However, this functionality was activated and affected the traffic, denying traffic that should be allowed and that contained the XFF header.

In case the feature is enabled, if the traffic contains the XFF header, - How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header? - Is there any mechanism to verify the authenticity of who wrote the XFF header? 

Thanks so much

[aleksandar.astardzhiev · Accepted solution]

Hi @Alpalo ,

As described here - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/policy-features/xff-header-support...

Since 10.0 PAN will use XFF source IP to enforce security policy.

Q: How is the traffic policy evaluated, and is the source IPv4 address no longer taken into account and replaced in the evaluation by the IPv4 address of the XFF header?
A: Correct. Security policy will evaluated based on the source IP from the XFF and not the source IP from the network packet header.

Q: Is there any mechanism to verify the authenticity of who wrote the XFF header? 

A: I don't there is a way. Due to the nature of the HTTP headers, you can slap there anything you want, the same way you can forged the user agent.