Focus

VM-Series Deployment Guide

Additional XFF IP Logging

Table of Contents

Additional XFF IP Logging

The Additional XFF (X-Forwarded-For) Logging feature enhances visibility into the original client source IP address in proxied environments. In network architectures involving multiple proxies, CDNs, or load balancers, the XFF header often contains a comma-separated list of IP addresses. Previously, the firewall only logged the last IP address in the header, which might be a load balancer rather than the true client.

This feature introduces a new X-Forwarded-For field in Threat Logs that extracts and captures up to two additional IP addresses from the XFF header. When combined with the existing X-Forwarded-For IP field (which continues to log the last IP), the firewall can now record the last three IP addresses from the header. XFF IP Logging reveals the original client IP even when traffic passes through multiple proxies or load balancers. It also provides richer context in Threat Logs for incident investigation.

Platform Support

This feature is supported on the following platforms:

Hardware: PA-220R, PA-400 Series, PA-800 Series, PA-1400 Series, PA-3200 Series, PA-3400 Series, PA-5200 Series, PA-5400 Series, PA-7000 Series, PA-7500 Series.
Virtual Systems: VM-Series (all supported memory profiles), CN-Series, and Cloud NGFW.
Management: Panorama (M-200, M-300, M-600, M-700), and WF-500.

Pre-requisites:

Threat Prevention license
PAN-OS version 11.1 and above

Configuring XFF Logging

XFF logging involves two distinct functionalities: Logging (visibility) and Policy Enforcement (control). They are configured independently.

1. Enable Additional XFF Logging (Visibility)

Function: Enables the extraction and populating of the new X-Forwarded-For field in Threat Logs.
Default State: Disabled by default (Must be manually enabled via CLI).
Commit Required: No

CLI Command:

Run the following command to enable the feature:

set system setting ctd additional-xff-logging enable

Run the following command to disable the feature:

set system setting ctd additional-xff-logging disable

2. Enable XFF for Policy Enforcement (Control)

Function: Allows the firewall to use the extracted XFF IPs to match Security Policy rules.
Default State: Disabled.
Commit Required: Yes.

Firewall UI Configuration:

In your firewall web interface, go to Device > Setup > Content-ID.
Locate the Content-ID Settings section.
Check the box for Use X-Forwarded-For Header.
Commit the changes.

CLI Configuration:

Run the following command:

set deviceconfig setting ctd x-forwarded-for-client-ip 2

Verification of XFF Logging

Verify System State:

Run the following CLI command to confirm that the feature is active:

show system setting ctd state

Expected Output: Ensure that "Additional XFF logging" is enabled and "X-Forwarded-For" is set to the correct value (for example: 2).

Verify Logs:

Once enabled, generate traffic through a proxy or load balancer that inserts XFF headers.

Go to Monitor > Logs > Threat.
Locate the relevant threat logs.
You will now see two distinct fields:
X-Forwarded-For IP: Contains the last IP address in the header (existing behavior).
X-Forwarded-For: Contains up to two immediately preceding IP addresses from the header.

Important Considerations

Capacity: The system extracts the last three available IP addresses. If fewer than three are present, it extracts as many as available.
Performance: This feature is designed to have minimal impact on system performance but involves additional memory allocation for storing the extra IP addresses.
Syslog MTU: Adding more data to logs may increase the log size. Ensure your Syslog server and network path can handle slightly larger UDP packets to avoid fragmentation or drops.

Enable ZRAM on the VM-Series Firewall

Virtual Systems Support on VM-Series Firewall