X-Forwarded-For displays wrong ip (v6) in logs

[Magnus_App]

Hi.

We have a azure setup, web application, where an agw first terminates traffic and applies xff and then forwards to firewalls which then decrypt the session. We have X-Forwarded-For enabled and usually works fine and displays the correct ipv4 address in logs. From time to time though logs instead display ipv6 addresses which we dont use and afaik we know there is no ipv6 in play at all.

We are having a hard time troubleshooting since pcaps on firewalls are encrypted, is there a way around that? We've tried to look at pcaps on clients where we can decrypt in wireshark but xff is not visible there.

[akuzhuppilly]

Hello @Magnus_App 

It sounds like a software-related issue.

You may open a TAC case to get the fix/workaround.

[DarrenAdmin]

Hi Magnus,

We have a similar setup and experiencing the same issue with IPv6 showing up in the logs. Did you ever find a solution to this?

[blewinski]

Please read the notes section in the below KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIVCA0 

[Magnus_App · Accepted solution]

Hi Darren,

It became a known bug after a while and was fixed in 10.2.9, https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-9-known-and-addressed...

Bug id: PAN-241018

[DarrenAdmin]

Unfortunately upgrading PANOS to version 10.2.9 or later didn't totally fix it for me. The random ipv6 addresses in the traffic logs did go away, however now it just displays an empty field. I can verify policies based on XFF header IP is working and that in the URL category logs it's indeed displaying. Getting it to display in the regular traffic logs is still a problem. PA TAC even recommended to upgrade to version 11.1.4 and that didn't fix it either. This issue seems to only affect 443 traffic that being decrypted on the firewall. For port 80 traffic, it's able to display the XFF header IP fine in the traffic logs.