Does Basic Azure Firewall supports X-FOrward-For

Question

Does Basic Azure Firewall supports X-FOrward-For?

How do I verify the client IP is passing to VM(apache2)?

Answer 1

Hi

Greetings!

X-Forwarded-For headers are part of HTTP/S traffic (Layer 7). This capability is only available in the Premium SKU of Azure Firewall. Since premium tier supports TLS inspection and IDPS, it can inspect HTTP/S traffic and thus handle XFF headers whereas Basic SKU operates at Layer 3/4, so it supports basic stateful firewall rules (IP/port filtering) but cannot inspect/modify HTTP headers like XFF.
Refer this link:https://learn.microsoft.com/en-us/azure/firewall/premium-deploy#tls-inspection-with-url-filtering

How do I verify the client IP is passing to VM(apache2)?

In the Application rule logs you can the see the client ip.

 

If you require XFF header then upgrade to Azure Firewall Premium for native XFF support, TLS inspection and advanced threat protection. If cost is a concern, you can try to use Azure Application Gateway (WAF feature) behind Basic SKU Azure Firewall for hybrid Layer 3/4 and Layer 7 traffic inspection.

---

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.