How to test XFF for Security Policy feature?
Objective
XFF in Security Policy mode allows Security Policy to be enforced on the XFF IP instead of the source IP. This feature was introduced in PAN-OS 10.0
This knowledge article will help a reader to have a clear understanding of XFF for Security Policy
- What is XFF?
- How XFF is used?
- Which configuration is required to enable XFF for security rule?
- How to configure security rule for controlling packet by XFF
- How to monitor XFF information on traffic log and url filtering log
- HTTPS Sessions
Environment
- PAN-OS 10.0 or later
- X-Forwarded-For (XFF)
Procedure
- What is XFF?
X-Forwarded-For is a HTTP Header
X-Forwarded-For is a header used to disclose information about the client that initiated a HTTP request, such as an IP Address
- How is XFF used?
Proxies can inject XFF Headers into the HTTP Request
Webservers, Firewalls, etc, can use this to determine what the original Client IP is
- Which configuration is required to enable XFF for security rule?
Configured under Device > Setup > Content-ID > X-Forwarded-For Headers
XFF Logging can be enabled in the URL Filtering Profile. This cannot be added to the ‘default’ URL Filtering profile. I created default-1.
- How we configure Security rule for controlling packet by XFF?
Configured 2 rules to match either the SRC IP or XFF IP:
- How we can monitor XFF information on traffic log and url filtering log?
If I send a HTTP request with an XFF IP of 10.1.1.1:
# curl -H "X-Forwarded-For: 10.1.1.1" http://portquiz.net
Now there is an XFF IP of 10.1.1.1, so it matches the rule for “XFF_IP_Rule”.
Traffic log shows x-fwd-for: 10.1.1.1 as ‘X-FORWARDED-FOR IP’
URL Filtering log shows x-fwd-for: 10.1.1.1 as ‘Source User’. This only logs if the traffic hits an action which alerts (like Block, Continue or Alert)
If there is no XFF IP, so it matches the rule “SRC_IP_Rule” as usual.
- HTTPS Sessions
For HTTPS sessions, check whether the session is decrypted or not. HTTPS must be decrypted for us to read the XFF.
If I send a HTTPS request with an XFF IP of 10.1.1.1:
# curl -k --header "X-Forwarded-For: 10.1.1.1" https://portquiz.takao-tech.com