Disable HTTP X-Forwarded-For header on ProxySG for one URL

[Sulman Mushtaq Mushtaq Hussain]

Is it possible to disable this either for a particular source or for a destination URL or we have to disable the HTTP X-Forwarded-For header globally for all users

------------------------------
Symantec Enthusiast
------------------------------

[Slava]

Hello Sym, 

To answer your question: Yest it is possible and very simple.
You will need to created a new Web Access Layer in the VPM and by following the steps provided under the Resolution section of this KB https://knowledge.broadcom.com/external/article/168647/enable-the-xforwardedfor-header-in-the-v.html, with the exception of step #5 we want it to be set to Suppress.
Should look exactly like this 

This Action will Suppress the XFF header , and then you can specify a source IP or destination URL etc in this policy.

I hope this helps.
Have a wonderful day.
Slava V

[Sulman Mushtaq Mushtaq Hussain]

Thanks Slave for the help. Appreciate it.

------------------------------
Symantec Enthusiast
------------------------------

[Sulman Mushtaq Mushtaq Hussain]

Hi Slava, actually I tried this but its still not working, I can still see the client IP. Is there anything else I need to do to get it work?

------------------------------
Symantec Enthusiast
------------------------------

[Slava]

Hello SymSpec, 

The feature has been tested and working, perhaps there is no matching the policy configured to Suppress the XFF.
Verify and confirm that there is a match in the Policy!
If there is a match and the XFF is still not removed for the desired destination URL or Public IP or based on source client IP  then please log a technical case via the Broadcom Customer Portal.

Slava V

[Sulman Mushtaq Mushtaq Hussain]

Hi Slava, thanks for the reply. Basically I have created a 2 rules in the same WAL, the first URL is accessing this specific URL to any source, the second rule below this rule is suppressing the X Forwarded-For header as described in the KB and screenshot by you. Isn't this right?

Secondly, can I take a packet capture on Proxy which will basically show that proxysg is suppressing the header for this destination in the transaction, if yes then which field will show this in wire-shark that I need to see. Thanks

------------------------------
Symantec Enthusiast
------------------------------

[Slava]

Hello SymSpec,

1. Did you Create a new Web Access Layer ? if no , you have to to ensure a match.
2. Do you see a match in the Policy Trace for the policy you created to suppress the XFF?, if no the adjust it.

Once you have the above covered and the answer is Yes for both, then in the pcap for the session between proxy and the OCS( URL you are trying to suppress the XFF) the request should not contain the XFF header.
I would test this policy with an HTTP web site like example.com to ensure you have a match, cause if you are applying this policy for an HTTPS site you wont see the results in the pcap as those will be encrypted.

Slava V

[Sulman Mushtaq Mushtaq Hussain]

Hi Slava, thanks for the reply.

I havent created a new WAL for this, instead I have added these two rules in the same WAL which I have for my users. Does these two rules must be in a separate WAL?

I have enabled SSL interception for all destinations, so proxysg will decrypt all the traffic. Still I won't see the result in the pcap?

Thanks. 


------------------------------
Symantec Enthusiast
------------------------------

[Slava]

Hello SymSpec, 

1. Did you Create a new Web Access Layer ? if no , you have to, to ensure a match.
2. Do you see a match in the Policy Trace for the policy you created to suppress the XFF?, if no then adjust the policy.

Once you have the above covered and the answer is Yes for both, then in the pcap for the session between proxy and the OCS( URL you are trying to suppress the XFF) the request should not contain the XFF header.
I would test this policy with an HTTP web site like example.com to ensure you have a match, cause if you are applying this policy for an HTTPS site you wont see the results in the pcap as those will be encrypted.

Slava V