This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Real Ip of internet Client hide by WAF in XG Firewall

Hello ,

Can someone from Sophos confirm that the WAF in XG firewall send the fields X-forwarded for header to back end server. so i can extract the real IP of Internet Client.

Best regards

This thread was automatically locked due to age.

0 Aditya Patel over 6 years ago

Hello Said,

You may disable NAT and check if that would work for you.

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Said Belarbi over 6 years ago in reply to Aditya Patel

Hello Aditya,

there is no nat in the configuration WAF in sophos XG , the business rule for Web server don't use NAT

Best Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Said Belarbi

Hi,

please post a copy of your rule.

Ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jon Bruno over 5 years ago in reply to rfcat_vk

Was this ever resolved?

I have the same issue,

Thanks

jon
Cancel
Vote Up 0 Vote Down

Cancel
0 Said Belarbi over 5 years ago in reply to Jon Bruno

no , the support confirmed that was not possible , and I had asked for a "feature-requests.aspx"

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/37746052-we-are-not-able-to-see-the-actual-public-ips-whic

thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Jon Bruno over 5 years ago in reply to Jon Bruno

Made sure to pass host headers through the WAF then I added X-Forwarded-For column to the IIS logs.. working a treat.

I'm now tweaking my Logstash pipleline to properly send it off to ElasticSearch for ingestion.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel