topic operation of the XFF Proxy function in Firewall and Security Management

operation of the XFF Proxy function

Agust — Tue, 15 Oct 2024 19:30:44 GMT

Hi guys.
We have a customer who is using the firewall as a non-transparent proxy and he shared with us some questions about the operation of XFF about which we did not find too much information published.
The first question is regarding the handling of XFF.
It is how to disable the output of the XFF header so that the proxy does not send the client's original IP to the destination server.
Can rules be configured in the firewall to identify the user or computer by the XFF content?
Can proxy Path be implemented in DNS so that DNS resolves to the proxy IP instead of an end server IP, redirecting traffic through that proxy for proper handling?

Re: operation of the XFF Proxy function

PhoneBoy — Tue, 15 Oct 2024 20:03:43 GMT

You can disable XFF by one of the two methods here: https://support.checkpoint.com/results/sk/sk100223
You can perform inspection based on XFF as described here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_IdentityAwareness_AdminGuide/Content/Topics-IDAG/Configuring-Identity-Awareness-Identifying-Users-behind-HTTP-Proxy-Server.htm

I'm not familiar with implementing a proxy path in DNS.
You can forward all requests to a different proxy server by following: https://support.checkpoint.com/results/sk/sk101395

Please note the known performance impact of operating in explicit proxy mode: https://support.checkpoint.com/results/sk/sk92482