Can PA block IP address in X-Forwarded-For ?

[KiCheonLee]

Hello,

I built the sandwich type with external ELB & internal ELB.

As you know, external ELB shifts original client IP to X-Forwarded-For.

I enabled 'Use X-Forwarded-For Header in User-ID and I looked XFF IP in user-id of URL Filtering logs.

But PA has not shown XFF IP in traffic logs. 

I would like to block XFF IP using user-ID. 

If anyone knew it, Please let me know it.

Thanks,

KC Lee

[Warby]

Hi KC Lee,

One of our TMEs has a working prototype that uses Lambda to map IPs learned from XFF to a User-ID group that can then be blocked by policy.  It isn't ready to be published as a template yet but if you'd like a preview, please reach out to your sales team to schedule a demo.

HTH,

Warby

[Warby]

The XFF to User-ID solution has been published on GitHub: https://github.com/PaloAltoNetworks/XFF-to-User-ID-mapping

[theljula]

The solution provided deployes the XFF solution into an new VPC and Palo Alto instance. Is there any cloudformation template that is available to be deployed into an existing VPC and Palo Alto?