FortiGate isn't logging the original visitor IP

[rohitkc007]

Dear Team, My firmware version is 7.4.4. We are routing our webservers behind through cloudflare proxy. Here what are we getting in logs are the cloudflare proxy Ip address ranges. Pls guide me how to configure the fortigate to get the Original ip of the source traffic or how to Include the original visitor IP in fortigate logs.

I have already done as per the process defined - https://docs.fortinet.com/document/fortiproxy/7.4.4/administration-guide/764110/logging-client-ip-fo...

FGT (global) # sh full-configuration

config web-proxy global

set ssl-cert "Fortinet_Factory"

set ssl-ca-cert "Fortinet_CA_SSL"

set fast-policy-match enable

set ldap-user-cache disable

set proxy-fqdn "default.fqdn"

set max-request-length 8

set max-message-length 32

set strict-web-check disable

set forward-proxy-auth disable

set forward-server-affinity-timeout 30

set max-waf-body-cache-length 32

set webproxy-profile "default"

set learn-client-ip enable

set always-learn-client-ip disable

set learn-client-ip-from-header true-client-ip x-real-ip x-forwarded-for (I have tried all of these single also, now its multiple)

set learn-client-ip-srcaddr "all"

set policy-category-deep-inspect enable

set log-policy-pending disable

set log-forward-server disable

set log-app-id disable

set proxy-transparent-cert-inspection disable end

Pls help

Thanks

Rohit

[johnathan]

Just wanna confirm, it goes from Cloudflare Reverse Proxy, then to the FortiGate, then the Web Servers?
If this is the case, Cloudflare would have to be the one attaching those headers to the client's HTTP request. 
The FortiGate would have no visibility of the client's IP if it is hitting Cloudflare first. 
Once the client's IP is in the headers, you can use 'set learn-client-ip-from-header' to log the true IP of the user.