If there is a CDN / proxy in front of TR7, how does the WAF see the real client IP?

Short answer

With the Trusted Proxies profile. Only for connections coming from the networks in the Trusted Networks field (the IP ranges published by the CDN or by the proxy in front), the profile makes the address in the header selected in the Real IP from field the client address. Since this resolution is done before the WAF scan (components that use the resolved address), the WAF's blacklist inspection, the Teacher and Conditional Learning IP definitions, the learning and analysis filters, and the Attacker IP, Attacker Location and Attack Network information in Event Logs use the resolved address. If there is no profile, the WAF treats all requests as coming from the CDN's addresses, and blacklisting an attacker from Event Logs blocks all the CDN traffic. The profile is created on the Load Balancer → Profiles → Trusted Proxies screen or from the vService form and is selected in the Trusted Proxy field in the Details list of the HTTP vService; in WEB-CLI, the lb trusted-proxy add and lb service update commands are used. The whole internet is not entered in the Trusted Networks field; otherwise, a client can spoof the header and present itself as another address.

Problem: The WAF Treats Every Request as Coming from the CDN Address

If there is a CDN or proxy in front of TR7, the client that connects to TR7 is the CDN's edge server. When no profile is assigned to the vService, TR7 does not use the incoming X-Forwarded-For and similar headers as the client address; the WAF also sees the CDN address the connection comes from. The consequences of this in the WAF:

• Blacklist: Blacklist Protection and Frontend Blacklist look at the CDN's address, not the visitor's; blacklisting an address from the Actions menu of the Attacker IP row in Event Logs blocks all the visitors coming from that CDN address.
• Learning: The identities defined with IP for Teacher and Conditional Learning are not recognized; the country and source IP criteria in the Analysis & Learning filters work according to the CDN addresses.
• Records and reports: Attacker IP, Attacker Location and Attack Network in Event Logs and the country distribution in the WAF Dashboard show the CDN's addresses and locations.

The real address is in the header added by the CDN; this header must be trusted only when it comes from the CDN, because the client can also write the same header itself.

Solution: 3 Methods

The three methods create the same profile and assign it to the vService; the result is the same.

Your situation	Suitable method
I want to create the profile in advance and assign it to one or more vServices	Method 1: From the Profiles menu
I want to create the profile while editing the vService	Method 2: New profile from the vService form
I want to configure it from the command line	Method 3: WEB-CLI

Method 1: From the Profiles Menu Recommended

• How it works For connections coming from the trusted networks, the profile makes the address in the selected header the client address; for other connections, the header is not taken into account (it is not deleted, it is forwarded to the Backend Service as it is). If there is more than one source, they are evaluated in order and the first match is applied.
• Where it is openedLoad Balancer → Profiles → Trusted Proxies · vService → Details → Trusted Proxy
• Requirement The IP ranges published by the CDN; an HTTP vService with WAF on
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Trusted Proxies path is followed and Add is clicked (profile add form).

2

Adım 2 Enter the name

A unique name is written in the Trusted Proxy Profile Name field.

3

Adım 3 Select the header

In the first source under Sources, Real IP from is selected: for Cloudflare, Custom Header and Header Name = CF-Connecting-IP; for Akamai, Custom Header and True-Client-IP; for general setups with more than one proxy layer, X-Forwarded-For (last / most trusted) (default). The difference between the options: What is the difference between the "Real IP from" options in the Trusted Proxy profile (X-Forwarded-For (last / most trusted), X-Forwarded-For (first), Custom Header)?

4

Adım 4 Enter the trusted networks

The IPv4 and IPv6 ranges published by the CDN are entered in CIDR form in the Trusted Networks field (at least one); they are added with a new row (+). The ranges do not come to TR7 automatically; they are taken from the list published by the CDN. If a very wide prefix such as /0 or /1 is entered, the form shows a warning. For more than one CDN or proxy, a new source is added to the Sources field with (+).

5

Adım 5 Save the profile

The Add button is clicked.

6

Adım 6 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService with WAF on is selected and the edit form is opened with Edit.

7

Adım 7 Select the profile

In the Details list, the Trusted Proxy box is checked and the profile is selected in the Trusted Proxy Profile field.

8

Adım 8 Save

The Save button is clicked; there is no separate deployment step. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Attacker addressWAF Event Logs

In the preview of a record created after the profile is assigned, the Request & Location tab is examined.

ExpectedAttacker IP and Attacker Location show the visitor

Records created before the profile was assigned continue to show the CDN address.

2Comparison with the headerWAF Event Logs

In the Event Logs list, the address in the X-Forwarded-For column is compared with the client address of the same record.

ExpectedThe client address is outside the CDN ranges

3Profile appliedLoad Balancer Management

On the Load Balancer Management screen of the vService, the sentence stating that the real IP is resolved through the profile appears.

ExpectedThe real client IP is resolved from a header through the … profile

Method 2: New Profile from the vService Form

• How it works The profile is created in the window opened from the vService form and is selected in the field automatically.
• Where it is opened vService → Details → Trusted Proxy → Add in the Trusted Proxy Profile drop-down list
• Requirement The IP ranges published by the CDN; an HTTP vService with WAF on
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and opened with Edit.

2

Adım 2 Open the profile window

In the Details list, the Trusted Proxy box is checked; the profile window is opened with Add in the drop-down list of the Trusted Proxy Profile field.

3

Adım 3 Define the profile

Trusted Proxy Profile Name, Real IP from (Header Name if needed) and Trusted Networks are entered as in steps 2–4 of Method 1.

4

Adım 4 Save the profile

The Add button in the window is clicked; the profile is selected in the field automatically.

5

Adım 5 Save

The vService form is saved with Save. In a cluster, the change is transferred to the peer device as in Method 1.

Verification

1Attacker addressWAF Event Logs

The Request & Location tab of a record created after the profile is assigned is examined.

ExpectedAttacker IP shows the visitor's address

Method 3: WEB-CLI

• How it works The profile is created with lb trusted-proxy add, its ID is obtained with lb trusted-proxy list and it is assigned to the vService with lb service update.
• Where it is openedWEB-CLI → lb trusted-proxy · lb service
• Requirement WEB-CLI access; the IP ranges published by the CDN
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Create the profile

Every source and every network is written with its own index number (source definitions). In place of 198.51.100.0/24 in the example, the range published by the CDN is written; a second range is added with --sources.0.trustedNetworks.1.ip and --sources.0.trustedNetworks.1.cidr:

lb trusted-proxy add name cdn-proxy --sources.0.type customHeader --sources.0.headerName CF-Connecting-IP --sources.0.trustedNetworks.0.ip 198.51.100.0 --sources.0.trustedNetworks.0.cidr 24

The command gives no output when it succeeds.

2

Adım 2 Get the profile ID

The --trustedProxy field takes the ID of the profile; the ID is read from the id column of the list:

lb trusted-proxy list

3

Adım 3 Assign the profile to the vService

In place of <vService>, the ID of the vService is written, and in place of <profile-id>, the ID from step 2:

lb service update id <vService> --trustedProxy <profile-id>

In a cluster, the change is transferred to the peer device as in the interface.

Verification

1AssignmentTR7 side

The vService record is displayed.

Command: lb service show <vService>

ExpectedThe profile ID in the trustedProxy row

In the WAF Event Logs records created after the profile is assigned, Attacker IP shows the visitor's address.

Common Mistakes

Entering the whole internet in the Trusted Networks field

If a range such as 0.0.0.0/0 is entered, every client can write any address it wants in the header and escape the WAF's blacklist and IP-based rules, or get another address blacklisted. Only the ranges of the CDN or of the proxy in front are entered (What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?).

• Blacklisting from Event Logs without assigning the profile. Since Attacker IP is the CDN address, all the CDN traffic is blocked; first the profile is assigned, then the visitor address in the new records is added to the list.
• Not keeping the CDN ranges up to date. When the CDN adds a new range, the header is not read in requests coming from these ranges and the WAF sees the CDN address again; the list is reviewed regularly.
• Taking the X-Forwarded-For option on the vService for the real IP resolution. The X-Forwarded-For option on the vService only adds a header to the request going to the Backend Service; the real IP is resolved from the incoming header by the Trusted Proxies profile.
• Defining Teacher by IP without a profile. Behind a CDN, the Teacher IP does not match; until the profile is assigned, the Teacher identity is defined with a header or cookie (What should the name of the Teacher Header or cookie be (TR7-LEARN); which name is used for Conditional Learning (TR7-ANALYZE)?).
• Checking only the profile if the CDN address still appears in the records. The header name, the Real IP from selection and whether the address the request comes from is within Trusted Networks are checked together (The logs show the proxy / CDN IP instead of the client IP; what should I do?).

How it is done in the documentation

• Trusted Proxy · The Components That Use the Resolved Address
• Trusted Proxy · Real IP from
• HTTP vService · Trusted Proxy
• Event Logs · Request & Location Tab
• WEB-CLI · Examples

Related questions

• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?
• Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?
• The logs show the proxy / CDN IP instead of the client IP; what should I do?