x-forwarded-for IP not appear in traffic log

[H.Sutanto]

Hello everyone,

I have enable x-forwarded-for in PA.

When I look at the pcap from PA, I see the ip address

but from monitor log traffic, collum x-forwarded-for ip is empty

Please your help.

Thank you

[kiwi]

Hi @H.Sutanto ,

I've seen scenarios where XFF is not logged because of traffic not getting decrypted (https://live.paloaltonetworks.com/t5/general-topics/xff-ip-does-not-show-the-source-ips-on-the-monit.... 

Also seen it because the url filtering profile where you enable XFF was not being applied to the rule.  

And also saw it when the firewall failed to parse IP address in XFF header due to additional port number being appended by Azure Application Gateway (PA-VM on Azure).

If neither of these fit your scenario I'd recommend debugging further with packet-diag flow basic and ctd to get more details.

Kind regards,

-Kim.