XFF IP Address Logging clarification and impact

[ET]

I would like to view XFF IP Address in the Logs.

I went through a few articles and have a few clarifications:

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-con...

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-con...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClViCAK

1. Should i enable [ Device > Setup > Content-ID > X-Forwarded-For Headers ] in order to see the XFF in logs? 

2. If enabled - will all security rules continue to function as before or they will start inspecting XFF IPs instead of the regular L3 IPs?

3. Should  XFF also be enabled in URL profile for this feature to work ?

4. Can I see XFF in traffic logs? - YES. 

[BPry]

@ET,

If you're just looking to log it without using it for user-id or policy, the only thing that you need to do is enable it in your url-filtering profiles. You would only enable the options under Content-ID if you want to use that information for User-ID or use it in security assessment. 

[ET]

In this article it's mentioned "URL Filtering logs do not display the X-Forwarded For IP field. To view X-Forwarded-For IP log events, you must export the logs to CSV format"

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-con...

Yet in another article , they are seen in the traffic logs

https://docs.paloaltonetworks.com/network-security/security-policy/administration/identify-users-con...

Which one is correct or in which cases each is true ?