XFF trust IPs (7.6.0)
For the Trusted X-Header Sources table in Server Objects > X-Forwarded-For, we have removed the previous limitation of 256 IP address entries. Now, you can define IP ranges and IP groups within this table.
FortiWeb will only trust the X-headers of the IPs that you specified in Trusted X-Header Sources table. If you do not specify Trusted X-Header Sources, X-headers of all IPs will be trusted by FortiWeb.
To configure the Trusted X-Header Sources table:
- On the X-Forwarded-For rule editing page, click Create New.
- Configure the following settings. The IP address should be the one of the external proxy or load balancer according to packets’
SRCfield in the IP layer when received by FortiWeb.Type Select whether to define an IP address/IP range, or reference an IP group. IPv4/IPv6 / IP Range
Type the client’s source IP address.
You can enter either a single IP address or a range of addresses (e.g. 1.2.3.4,2001::1,1.2.3.4-1.2.3.40,2001::1-2001::100). Multiple addresses or ranges should be separated with comma ",".
The maximum length for the IPv4/IPv6/IP Range is 1024.
IP Group Select the IP Group you have created in Server Objects > IP Groups. By using the IP group, you can save the effort to type the IP addresses every time you need to re-use them. For more information, see Creating IP groups.
- Click OK.
For more information on X-Forwarded-For, see Defining your proxies, clients, & X-headers.