Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Reflection of Client IP on Fortiweb WAF
I have a Fortiweb WAF in my environment that routes traffic to my Apps. But my app only sees the IP of the WAF. How can i set up the WAF so that my apps can see the clients IPs.
Thank you.
Thank you.
Labels:
- Labels:
-
Application Delivery Controller
8 REPLIES 8
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Khalid,
You need to enable "Client Real IP" on your Server Policy.
You need to enable "Client Real IP" on your Server Policy.
Rafael LEHMANI
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Kalid,
If your WAF is not inline, or return path routing doesn't go through FortiWeb, you could also forward the client IP-address per X-Forwarded-For header.
Most applications can use XFF-header for policy or logging purposes.
Regards,
Ferry
If your WAF is not inline, or return path routing doesn't go through FortiWeb, you could also forward the client IP-address per X-Forwarded-For header.
Most applications can use XFF-header for policy or logging purposes.
Regards,
Ferry
Ferry
Sr. Director Consulting Systems Engineering
Sr. Director Consulting Systems Engineering
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ferry,
I have tried this but didnt work. but will try it again, maybe I missed something.
Thank you.
I have tried this but didnt work. but will try it again, maybe I missed something.
Thank you.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rafael,
Thank you for your response. Does the policy exists on the WAF or the server itself.
Thank you for your response. Does the policy exists on the WAF or the server itself.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Server Policy is on FWB configuration (Reverse Proxy Mode). Backend server must point their DFGW to the FWB. Can you share your network diagram?
------------------------------
Best Regards
Rafael LEHMANI
CSE INTL
------------------------------
------------------------------
Best Regards
Rafael LEHMANI
CSE INTL
------------------------------
Rafael LEHMANI
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rafael,
Please see the attached network diagram, its a simple client-server kind of setup but with a WAF in between.
I just need the WAF to be able pass the User IP to the Load Balancer, instead of the WAF IP.
Thank you.
Please see the attached network diagram, its a simple client-server kind of setup but with a WAF in between.
I just need the WAF to be able pass the User IP to the Load Balancer, instead of the WAF IP.
Thank you.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok Khalid.
As I said previously, you just need to enable ""Client Real IP" on the Server Policy.
Did you try it?
BR
Rafael
------------------------------
Best Regards
Rafael LEHMANI
CSE INTL
------------------------------
Rafael LEHMANI
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In case you also need to track source IPs from webapp, you do need to add an XFF policy on FWB and on LB that track AND add source IP/Proxy IP.
Can you share FWB and LB configs?
------------------------------
Best Regards
Rafael LEHMANI
CSE INTL
------------------------------
Can you share FWB and LB configs?
------------------------------
Best Regards
Rafael LEHMANI
CSE INTL
------------------------------
Rafael LEHMANI
