Technical Tip: How to learn Client-IP from X-Forwarded-For and apply them to firewall policy

[leej]

Description	This article describes how to learn Client-IP from the X-Forwarded-For header and apply learned Client-IP to proxy policy.
Scope	FortiGate.
Solution	When Application Gateway (AGW) sits behind FortiGate and sends traffic to FortiGate, all source IPs coming from AGW are translated by AGW's external IP. It makes FortiGate impossible to identify the user's real IP. In this case, AGW adds an X-Forwarded-For header including client-IP, and sends traffic to FortiGate. In order for FortiGate to learn client-IP and apply it to firewall policy, FortiGate needs additional configurations. Diagram. All traffic coming from AGW is translated by 20.249.24.75. AGW adds an XFF header including client-IP and sends traffic to two FortiGates which are UTM1 and UTM2. FortiGates learns client-IP from XFF and makes a decision based on learned client-IP. If client-IP is allowed, FortiGates do SNAT by P2's IP and forward traffic to INT NNB which is 10.0.0.71. INT NLB does load balancing to WEB 1 and WEB 2. Configure web-proxy to learn client-IP from XFF.                                               Configure firewall policy that redirects all HTTP traffic to proxy policy.                                                                  Based on learned client-IP, proxy policies check newly learned client-IP and make a decision. 'policy_id 3' allows all pre-defined srcaddr to be forwarded to 'INT NLB'. 'policy_id 1' denies all pre-defined srcaddr to be forwarded to 'INT NLB'. 'policy_id 2' allows all srcaddr except for pre-defined srcaddr to be forwarded to 'INT NLB'. webfilter-profile 'X-Forwarded-For' allows all. webfilter-profile 'X-Forwarded-Deny' denies all. Check logs if FortiGates learns client-IP and makes a decision.