XFF stripping

[mjcymru]

Hi, we are seeing XFF headers coming from our application traffic management device that goes through our checkpoint ending up at our webserver. At some point the Checkpoint is stripping the XFF header before it hits the web server and we just see xxxxxxxx

The interface this leaves the checkpoint has the option "interface leads to dmz" and is the only one that does.  Is this likely to be the cause of the header being removed?

what are the knock-ons of removing this option and are there other ways we can achieve this?

Thanks!

[_Val_]

Please look here and let me know if it helps: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

You can control stripping, it's described in the SK

[mjcymru]

Thanks for the reply, We have those options enabled including 'Hide X-Forwarded-For in outgoing traffic' and when we disable this it works though we wouldn't want XFF going out beyond our network either, if this is a possibility?

[_Val_]

Yes, it is possible. The SK I have provided you, it has the config steps and also troubleshooting options. If you still cannot achieve the goal, please open a support request.