Client IP address isn't visible to the Sensor after you enable X-Forwarded-For in your Threat Management Gateway

Technical Articles ID: KB85570
Last Modified: 2024-01-23 12:11:20 Etc/GMT

Environment

Trellix Intrusion Prevention System

Microsoft Forefront Threat Management Gateway (TMG)
Winfrasoft X-Forwarded-For (XFF) plug-in for TMG

Problem

When you enable the XFF plug-in on your TMG server, you expect the Sensor and Manager to display the client IP behind the proxy. But, the client IP doesn't display and you see only the proxy IP address.

Cause

XFF for TMG protects internal IP information by removing the XFF field from the HTTP header when it detects the last proxy server in a chain; for example, when there's no web chaining rule. So, the proxy server closest to the internet removes the XFF data before the request is made to the internet.

Solution

The XFF for TMG download package includes a scripts folder, which contains the following configuration script files:

SendToInternetOn.js
SendToInternetOff.js
IgnoreIncomingXFFOn.js
IgnoreIncomingXFFOff.js

These scripts configure the function of XFF for TMG on the last proxy server in a chain, and how it handles retention of the XFF HTTP header data. To expose the correct IP, run the scripts SendToInternetOn.js and IgnoreIncomingXFFOff.js on the TMG after you install the XFF plug-in.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Client IP address isn't visible to the Sensor after you enable X-Forwarded-For in your Threat Management Gateway

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Client IP address isn't visible to the Sensor after you enable X-Forwarded-For in your Threat Management Gateway

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title