|
Before FortiWeb, if there was any NAT device and XFF information was available, it was possible to see the original IP source as the X-Forwarder-For IP in traffic logs.
In a network, there is a device before FortiWeb that enables the firewall to perform SNAT. In FortiWeb, only the SNAT is displayed as the source IP for all client requests in the FortiWeb traffic logs.
To disable the NAT on the firewall and see the original client IP address in traffic logs as the source IP, configure XFF settings on the firewall. In this example, the firewall is performing SNAT before FortiWeb.
To view the client IP address as the Original Source IP address in FortiWeb traffic logs, disable the following settings:
config waf x-forwarded-for
edit XEF
set skip-private-original-ip disable
end
Related document:
waf-x-forwarded-for - FortiWeb CLI reference
|
