Sourcefire Proxy Behind Firewall.

[jheesen123]

According to TAC Cisco will not support user identification behind a proxy IP address even it it send X-Forwarded-For headers.   This is a real let down as other vendors do support this.   Almost all organizations have some form of URL filtering and many require the use of an internal proxy server.   

They said "Put the proxy in front of the firewall".   This is a ridiculous answer the problem.    The issue being SFM can not map the LDAP users to the "origin client IP".     This is a big problem since you can not create user based rules or events etc, trace down issues easily at all.   Seems like an easy fix that could be solved with some sort of regex script.  

This case has been open over a month and this is what they came up with.   Not to mention many Firepower cases take forever to resolve using TAC

[mikael.lahtela]

Hi,

Not clear for me how the traffic is going trough your setup.
Is it a. client->proxy->firewall->internet or b. client->firewall->proxy->internet?
And next there is no information what firewall or management you are using.
If you are running Firepower behind proxy (A) you can see XFF address in Firepower Management Center. (but it's hidden under connection events>table view>x to change tables add original client ip).

br, Micke

[jheesen123]

The configuration is

client->proxy->firewall->internet

I can see the true IP of the client, I have no issues with that part. The issue is there's not a way to do an LDAP user mapping with the XFF address information. Most the built in alerting widets etc are designed around the source IP and no the original client IP. It makes it difficult to manage the firewall the way its intended. You can not do any LDAP firewall based rules in this scenario either.

deployment uses FMC 6.2.2 on a pair of 5515x running 6.2

Thanks.

[mikael.lahtela]

Now it's clear for me and sounds like a limitation in your case.
One option is to contact your Cisco representative and do a feature request.
They might add that in the future releases.

br, Micke

[jheesen123]

Yes, its a limitation. This is a extremely common configuration however, tough to tell customers they can't operate the firewall as they hoped or would have to migrate all URL filtering to Cisco.

Thanks.

[jheesen123]

Bug

CSCvg56823

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg56823/?reffering_site=dumpcr