topic Re: HTTP XFF username in Application Control logs in General Topics

HTTP XFF username in Application Control logs

Alex_Shpilman — Thu, 28 Mar 2019 07:08:00 GMT

Hi Mates,

I have a use case where users are sitting behind a 3rd party proxy which then forwards the traffic to the internet through a security gateway.

Application Control, Identity Awareness and XFF detection enabled.

When I insert the proxied client IP into the HTTP XFF, the security gateway recognizes it and all works as expected, the XFF stripped off properly on the out.

But I'd like to see the source user in the Application Control instead of (or in addition) the original IP.

When I re-write the username into the HTTP XFF, the security gateway doesn't recognize it, I tried different combinations but no luck.

I was able to achieve this a few years back in R77.10 or R77.20 but can't remember what exactly I did back then...

Any ideas?

Thanks.

Re: HTTP XFF username in Application Control logs

Wolfgang — Thu, 28 Mar 2019 08:30:06 GMT

Alex,

you have to use IdentityAwarenessBlade and enable the XFF-support to match the XFF IPs to the real user names.

But this does not work for HTTPS connections, because I think the XFF-header is too encrypted and the firewall cannot read this. Except you're using HTTPS inspection.

Re: HTTP XFF username in Application Control logs

Alex_Shpilman — Thu, 28 Mar 2019 09:45:52 GMT

I am adding HFF only to HTTP on the proxy.

When IP is added, the security gateway can recognize it as "proxies source ip" but not the authenticated username.

Re: HTTP XFF username in Application Control logs

Wolfgang — Thu, 28 Mar 2019 14:37:43 GMT

Alex,

what are you saying?

With added XFF-header and IdentityAwareness configured like shown you are able to get the username.

This works in our environment.

Wolfgang

Re: HTTP XFF username in Application Control logs

Alex_Shpilman — Thu, 28 Mar 2019 19:18:19 GMT

Hi Wolfgang,

Do you use AD query or Identity Collector?

In my case, the real IP is visible through XFF, and there is an identity record for that IP (in PDP) but not reflected in the logs.

Thanks.

Re: HTTP XFF username in Application Control logs

Wolfgang — Thu, 28 Mar 2019 19:54:59 GMT

We are using Identity collector.