topic Re: Actual Host IP in FMC connection event in Network Security

Actual Host IP in FMC connection event

mohammadrezafathikohi — Wed, 14 Oct 2020 10:35:45 GMT

Hello,

my lan range is 192.168.1.0/24 and I have a kerio operating as a web proxy which eventually connects to FTD. As it is appear on the photo, when I see the connection events logs, it shows the 10.10.10.22 ip not the actual LAN ip. What should be done in order to see the actual lan ip instead of kerio’s outside interface ip?

thank you.

Re: Actual Host IP in FMC connection event

Aref Alsouqi — Wed, 14 Oct 2020 10:55:30 GMT

Go to FMC connection events > Table View of Connection Events, and click any of the black x to add a new column, scroll down till you find Original Client IP.

Re: Actual Host IP in FMC connection event

balaji.bandi — Wed, 14 Oct 2020 11:05:16 GMT

what you see as outside IP of the proxy is correct, since you proxying the Internal IP address with proxy IP, that is feature of Proxy.

Are you looking proxy send internal IP address to FTD ? you may need to look for HTTP_X_FORWARDED_FOR

Re: Actual Host IP in FMC connection event

mohammadrezafathikohi — Sat, 31 Oct 2020 10:23:29 GMT

I did what you said but again it shows 10.10.10.22 ip address and not the actual host address.

Re: Actual Host IP in FMC connection event

mohammadrezafathikohi — Sat, 31 Oct 2020 10:24:30 GMT

How can I do that in FMC?

Re: Actual Host IP in FMC connection event

Aref Alsouqi — Wed, 04 Nov 2020 19:07:39 GMT

Looks like your proxy is not configured to send the original client information inside the packets passing through the FTD. I would check if that would be supported on your proxy.