X-Forwarded-For displays wrong ip (v6) in logs

[Magnus_App]

Hi.

We have a azure setup, web application, where an agw first terminates traffic and applies xff and then forwards to firewalls which then decrypt the session. We have X-Forwarded-For enabled and usually works fine and displays the correct ipv4 address in logs. From time to time though logs instead display ipv6 addresses which we dont use and afaik we know there is no ipv6 in play at all.

We are having a hard time troubleshooting since pcaps on firewalls are encrypted, is there a way around that? We've tried to look at pcaps on clients where we can decrypt in wireshark but xff is not visible there.

[akuzhuppilly]

Hello @Magnus_App 

It sounds like a software-related issue.

You may open a TAC case to get the fix/workaround.