Technical Tip: WAF scans against Client's Original IP in the X-Forwarded-For HTTP header

Description

This article describes how to configure X-Forwarded-For rule to identify Client's Original IP for WAF scans.

Scope

 FortiWeb.

Solution

By default, FortiWeb uses the source IP address of the incoming connection when performing WAF policy enforcement, logging, and IP-based security checks such as IP Trust Lists.
In environments where FortiWeb is deployed behind a reverse proxy, load balancer, or CDN, the source IP seen by FortiWeb may be the address of the intermediate device rather than the original client.

To ensure that IP Trust List matching is performed against the actual client IP address, FortiWeb can be configured to extract and trust the client IP information contained in the X-Forwarded-For (XFF) header.
This article describes the required configuration to enable XFF-based client IP identification and use it for IP Trust List evaluation.

Steps to configure:

1. Navigate to Server Objects -> X-Forwarded-For.

2. Select Create New.

3. Enable 'Use X-Header to Identify Original Clinet's IP' and ensure the right X-Forwarded-For header name is defined.

4. Enable 'Block Using Original Client's IP'.

5. Select OK to save.
   
   

6. Define the created X-Forwarded-For Rule in the respective Web Protection Profile.
   

FortiWeb will now perform WAF scans against the Client's Original IP as included in X-Forwarded-For.

Related document:

Defining your proxies, clients, & X-headers