This article applies to:

• WebMarshal 6.5 and above
• Note version-specific behaviors described in the article

Question:

• How can I determine which client sent a request through WebMarshal?
• Capturing network traffic from a specific client
• Identifying the end user at a proxy server downstream of WebMarshal
• Some sites returning error 403 (forbidden) when browsing through WebMarshal

Background:

If WebMarshal forwards traffic to another proxy server or device, you may want to know which user or system originated the request.

WebMarshal 6.5 and above supports adding the X-Forwarded-For: header to requests it forwards. This header shows the IP address of the original client. It can be read using network capture software, or from logs of another device.

Version Specific information:

WebMarshal 6.10.2 and below:

• The X-Forwarded-For header is not added by default for HTTP requests. You can configure the behavior for HTTP requests.
• The X-Forwarded-For header is never added to HTTPS requests.

WebMarshal 6.10.3 and 6.11:

• The X-Forwarded-For header is not added by default. You can configure the behavior.
• If you enable the header, it is added to all requests including inspected HTTPS requests.

WebMarshal 6.12 and above:

• The X-Forwarded-For header is added by default for HTTP requests. You can choose not to add it. 
• The X-Forwarded-For header is NOT added by default for inspected HTTPS sites. You can configure this option separately.

To control the addition of X-Forwarded-For:

Add or edit the following attribute entries in the WebMarshal Proxy Configuration file (WMProxy.config.xml).

In a WebMarshal array, add this entry to the file on each processing node server.

• ProxySettings forwardClientIP (possible values: "true" or "false")
  • Default value: false for versions prior to 6.12; true for 6.12 and above
• ProxySettings forwardClientIPforHTTPS (possible values: "true" or "false")
  • Available in version 6.12 and above; default value: false 

Example

<WebMarshal> 
   <Proxy>
    <Config>
        <ProxySettings forwardClientIP="true" 
           forwardClientIPforHTTPS="false" 
           {other settings} />
    </Config> 
 </Proxy>
</WebMarshal>

If the ProxySettings element is already present, do not add another copy of this element. For more information about editing XML documents, see Knowledge Base article Q12705.

To apply the change, restart the Proxy service.

Notes:

• Reports from the field indicate that some servers return a 403 (forbidden) response if this header is not present. This result has been noted beginning in January 2016.
• Additional reports indicate that some HTTPS requests fail if the header IS present.
• In theory, providing the Client IP increases your security exposure because it provides information about internal network IP addresses. If this exposure is a concern you can disable this option. However, some sites will not function correctly.
• If the X-Forwarded-For header was present in the request made to WebMarshal (indicating the request had already been forwarded from another device), the existing information will be retained and the new forwarding information will be appended so that all forwarding information is preserved.