Use the IP Address in the XFF Header to Troubleshoot Events

1. Enable the X-Forwarded-For option within HTTP Header Logging in the URL Filtering profile.
   1. Select ObjectsSecurity ProfilesURL Filtering and select the URL Filtering profile you want to configure, or add a new one.
      You can’t enable XFF logging in the default URL Filtering profile.
   2. Select the Settings tab and select X-Forwarded-For.
   3. Click OK to save the profile.
2. Attach the URL Filtering profile to the security policy rule(s) that enable access to web applications.
   1. Select PoliciesSecurity and click the rule.
   2. Select the Actions tab, set the Profile Type to Profiles, and select the URL Filtering profile you just configured for X-Forwarded-For HTTP Header Logging.
   3. Click OK and Commit.
3. Verify the firewall is logging XFF values.
   1. Select MonitorLogsURL Filtering.
   2. View the XFF values in one of the following ways:
      • To display the XFF value for a single URL Filtering log—Click the spyglass icon for the log to displays its details. The HTTP Headers section displays the X-Forwarded-For value.
      • To display the XFF values for all URL Filtering logs—Open the drop-down in any column header, select Columns, and select X-Forwarded-For. The page then displays an X-Forwarded-For column.
4. Use the XFF field in the URL Filtering log to troubleshoot a log event in another log type.
   Although only the URL Filtering logs display the IP address of the source user in the X-Forwarded-For column of the logs, if you notice an event associated with HTTP/HTTPS traffic but that you cannot identify the source IP address because it is that of the proxy server, you can use the X-Forwarded-For value in a correlated URL Filtering log to help you identify the source address associated with the log event. To do this:
   1. Find an event you want investigate in a Traffic, Threat, or WildFire Submissions logs that is showing the IP address of the proxy server as the source address.
   2. Click the spyglass icon for the log to display its details and look for an associated URL Filtering log at the bottom of the Detailed Log Viewer window.
   3. Select the header row and then select X-Forwarded-For from the Columns drop-down to display this value. The IP address in this column of the X-Forwarded-For column represents the IP address of the source user behind the proxy server. Use this IP address to track down the device that triggered the event you are investigating.