Focus

VM-Series Deployment Guide

Configuring Global HTTP(s) Load Balancer with XFF Header

Table of Contents

Configuring Global HTTP(s) Load Balancer with XFF Header

The Palo Alto Networks NGFW can read the XFF field and use the XFF IP address when enforcing security policy. Additionally, you can configure various logs and reports to display the XFF IP address along with the source IP address.

Following are the steps to add Client Source IP Header to HTTPS Load Balancer

Run the following gcloud command to add the client’s source IP address as a custom header. Replace <backend-services> with your backend service that contains the VM-Series instance group.
```
gcloud compute backend-services update <backend-service> \
    --global \
    --custom-request-header='X-Forwarded-For:{client_ip_address}'
```
Your HTTPS load balancer’s custom request headers should like the image below:
In your VM-Series web interface, go to Device > Setup > Content-ID >X-Forwarded-For Headers.
Set Use X-Forwarded-For Header to Enabled for Security Policy.
Commit the changes.

The following are the steps to view the Custom Header in Traffic Logs:

Go to Monitor > Traffic.
Add the X-Forward-For IP log field to view the client IP address.
Curl your web server through the HTTPS load balancer.
The traffic logs should now contain your client source IP address under the X-Forwarded-For IP column.

Onboarding Global HTTPS Load Balancer

Set Up a VM-Series Firewall on a Cisco ENCS Network