X-Forwareded-For Not Working With Preserve client

Question

i have fortiweb 7.6 and fortigate 7.0  I configured the FortiWeb VIP as a virtual server on the FortiGate. However, when I enable `preserve-client` on the FortiGate, XFF stops working—even though I have configured XFF on the FortiWeb (and I have set up multiple FortiWebs that work correctly). When I disable `preserve-client`, XFF starts working properly again.in XFF enabled Delete  Previous XFF Headers

funkylicious · Answer

not a FWB expert but i assume the XFF setting in question that you mentioned and works it with preserve-client off in FGT is this https://docs.fortinet.com/document/fortiweb/8.0.1/cli-reference/577849/waf-x-forwarded-for#:~:text=disable-,delete%2Dheaders%20%7Benable%20%7C%20disable%7D,-Enable%20to%20delete

have you tried to leave preserve-client on and enable also, x-forwarded-for-support - Enable to delete all the previous X-Forward-For headers. If x-forwarded-for-support is enabled, the request will only have one header and one IP which is created by FortiWeb.

any reasons why you would need both XFF enabled ( assuming that FGT doesnt do NAT ) ? if so, try set merge-headers enable - Enable to merge all the previous X-Forward-For headers into one header to create an IP list.

Sign up

Login with SSO

Login to the community

Login with SSO