Use the IP Address in the XFF Header to Troubleshoot Events

Enable the X-Forwarded-For option within HTTP Header Logging in the URL Filtering profile.
Select
Objects
Security Profiles
URL Filtering
and select the URL Filtering profile you want to configure, or add a new one.
You can’t enable XFF logging in the default URL Filtering profile.
Select the
Settings
tab and select
X-Forwarded-For
.
Click
OK
to save the profile.
Attach the URL Filtering profile to the security policy rule(s) that enable access to web applications.
Select
Policies
Security
and click the rule.
Select the
Actions
tab, set the
Profile Type
to
Profiles
, and select the
URL Filtering
profile you just configured for X-Forwarded-For HTTP Header Logging.
Click
OK
and
Commit
.
Verify the firewall is logging XFF values.
Select
Monitor
Logs
URL Filtering
.
View the XFF values in one of the following ways:
To display the XFF value for a single URL Filtering log—Click the spyglass icon for the log to displays its details. The HTTP Headers section displays the X-Forwarded-For value.
To display the XFF values for all URL Filtering logs—Open the drop-down in any column header, select
Columns
, and select
X-Forwarded-For
. The page then displays an X-Forwarded-For column.
Use the XFF field in the URL Filtering log to troubleshoot a log event in another log type.
Although only the URL Filtering logs display the IP address of the source user in the X-Forwarded-For column of the logs, if you notice an event associated with HTTP/HTTPS traffic but that you cannot identify the source IP address because it is that of the proxy server, you can use the X-Forwarded-For value in a correlated URL Filtering log to help you identify the source address associated with the log event. To do this:
Find an event you want investigate in a Traffic, Threat, or WildFire Submissions logs that is showing the IP address of the proxy server as the source address.
Click the spyglass icon for the log to display its details and look for an associated URL Filtering log at the bottom of the Detailed Log Viewer window.
Select the header row and then select
X-Forwarded-For
from the
Columns
drop-down to display this value. The IP address in this column of the X-Forwarded-For column represents the IP address of the source user behind the proxy server. Use this IP address to track down the device that triggered the event you are investigating.