IPS exception based on Proxied Source IP?

[LPsUsername]

I'm OK with adding IPS exceptions based on src, dst, port or protection, but is it possible to add one based on just the proxied source IP?

The scenario is we have traffic coming from an externally hosted vulnerability scanning service taking the following path:

External source --> FW --> reverse proxy --> FW --> web server

I can add an exception based on the "real" source the first time through the firewall no problem, but on the second time through the source is now the reverse proxy. I don't want to add and exception for everything from the reverse proxy and I don't want to block these scans either.

Any way to allow the good scan through but keep blocking the bad stuff?

[Lloyd_Braun]

I don't think so. You would need to configure x-forwarded-for (XFF) header insertion on the reverse proxy, then be able to use that variable in threat prevention exceptions. I am pretty sure this is only configured in access control layer properties to consider XFF as source IP. Was thinking maybe you could create custom application definition of that specific XFF variable, and use an application object, but it appears only services can be used in threat prevention exceptions.

If you can change traffic from that source IP to be sourced from a unique IP on the reverse proxy, that would probably be your best bet.

[Timothy_Hall]

Identity Awareness has the ability to match identities based on the X-Forwarded-For header variable IP address instead of the packet's source IP address to properly establish identity in a proxied scenario, assuming that proxy server is configured to include it in the forwarded request.  I don't think there is any way to configure an IPS exception to match a particular value for the X-Forwarded-For header field instead of the source IP address on the packet.

However you may be able to create a custom indicator matching "X-Forwarded-For: (IP address)" header via the AV/ABOT blades and then just set the action to "Inactive".