Does ip-filter Policy Expression validate actual Client IPs when the requests are funnelled through AppGateway/Front Door?

Question

We are planning to use ip-filter policy expression to restrict client IPs that can access an APIM. We have the current setup

ExternalClient1 - Front Door - Application Gateway - APIM
ExternalClient2 - Application Gateway - APIM

Just curious, if ip-filter expression can verify the actual ClientIPs even if the requests are funneled via AppGateway and/or FrontDoor (or)
does ip-filter expression can only verify the AppGateway or FrontDoor IPs?

Please Clarify.

Thanks
Kumar

Answer 1

Hi, @Kumar

In general, when using an L7 reverse proxy, the client IP address will be the Front Door or Application Gateway instance IP address.

Therefore, I think it is necessary to use the HTTP header X-Forwarded-For to determine the client IP address on the backend.

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-http-headers-protocol

In that case, I think you should check using the check-header policy instead of ip-filter.

https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#CheckHTTPHeader