Does the Cisco ASA version 9.2 with IPS handle detecting X-Forwarded-For IP addresses?

[Whit Richardson]

We have two Cisco ASA 5545's fronting our Internet traffic a lot of it comes from Akamai. Because we use a CDN if an attacker uses them to start an attack the ASA is seeing an IP from Akamai that is allowed.  Can the IPS or IDS read the X-Forwarded-For field to catch this potential problem?  

[androdri]

Hello Whit

The Legacy Cisco IPS does not break out the X-Forwarded-For field,  but you may be able to use the service-http engine header-regex to detect  the string X-Forward-For field and corresponding malicious content in that field.

If you require any further assistance Cisco TAC can assist you or direct you to the correct parties.