Technical Tip: Tracking a FortiWeb client across source IP changes using Client Management

Description

This article describes how FortiWeb Client Management can identify the same client when the client's source IP address changes.

Scope

FortiWeb.

Solution

FortiWeb Client Management identifies clients using either the FortiWeb-generated cookie or the source IP address. When Client Management is enabled in an inline web protection profile, FortiWeb inserts the cookiesession1 cookie into the client's browser.

If the client presents this cookie in subsequent requests, FortiWeb uses the cookie to identify the client. If the cookie is not available, FortiWeb uses the source IP address instead. FortiWeb generates a unique Client ID based on the cookie value or source IP.

Enable Client Management in the web protection profile:

config waf web-protection-profile inline-protection
    edit "LAB_Profile"
        set client-management enable
    next
end

In this example, a client accessed the protected application from 10.100.3.195. The traffic log showed the following Client ID in the dev_id field:

src=10.100.3.195
dev_id=003D74FBF00D9E0D769D7595BDE810C642F2

The HTTP request contained the cookiesession1 cookie inserted by FortiWeb:

Cookie: PHPSESSID=<session_id>; cookiesession1=<FortiWeb_cookie>

While keeping the same browser session, the client source IP was changed from 10.100.3.195 to 10.100.3.196.

The subsequent traffic log showed the new source IP while the Client ID remained unchanged:

src=10.100.3.196
dev_id=003D74FBF00D9E0D769D7595BDE810C642F2

The unchanged Client ID shows that FortiWeb continued to identify the client after the source IP address changed because the FortiWeb-generated cookie remained available in subsequent requests.

For comparison, when Client Management was disabled, the traffic log did not contain a Client ID:

src=10.100.3.196
dev_id=none

After changing the client source IP, the traffic log continued to show no Client ID:

src=10.100.3.195
dev_id=none

This demonstrates the difference between the source IP recorded for an individual request and the Client ID maintained by Client Management. When the FortiWeb-generated cookie remains available, the same client can retain the same Client ID even when its source IP address changes.

By default, cookiesession1 is persistent, allowing FortiWeb to continue identifying the client while the cookie remains available.