Azure Firewall masked ips

Question

Azure Firewall masked ips

Maneesh Patha 20

We hosted the APIs in one of our virtual machines and linked the Azure firewall to the subnet of the virtual machine. The issue now is that in IIS logs, we cannot see the customers' public ips and can only see the Azure firewall private ips as the customer's source ips. Customers public ips are masked with the azure firewall private ips.

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-12T05:29:14.0333333+00:00

@Maneesh Patha

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-17T11:04:13.5166667+00:00

@Maneesh Patha

Could you please provide an update on this post?

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

1 answer

Your answer

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-12T05:29:14.0333333+00:00

@Maneesh Patha

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-17T11:04:13.5166667+00:00

@Maneesh Patha

Could you please provide an update on this post?

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 1

KapilAnanth-MSFT 49,611 Microsoft Employee Moderator

@Maneesh Patha

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to preserve the client IP for web requests coming in via Azure Firewall.

I wouldn't say that the IP is "masked" by Azure Firewall instances' IP.

The correct term here is "NATed".

This is by design

As you now, DNAT rules perform a NAT translation, the source IP changes along with it to Firewall's private IPs.
This is an expected behavior and unfortunately, we cannot override this.

For Web traffic, the recommended Load Balancing and WAF protection is offered by Azure Application Gateway WAF SKU

App Gateway, still does NAT and translates the source IP
However, the original client IP is preserved in "X-Fowarded-For" header
Also, App Gateway provides additional security features if Web Application Firewall is enabled.

In case your environment requires that you have Azure Firewall,

Then you can consider placing the Azure App gateway in front of Firewall
This scenario is well explained here

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Maneesh Patha 20 Reputation points

2023-07-06T07:36:43.2866667+00:00

@KapilAnanth-MSFT

Currently we are using Front door along with WAF in place of application gateway. I tried to add "X-Forwarded-For" header in Front door configuration. But I am not getting any option to add this header.

Can you please help me out to overcome this problem.

Thanks,

Maneesh
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-06T12:54:11.7933333+00:00
@Maneesh Patha

Are you using Azure Front Door in front of a Firewall?

or

Just Azure Front Door?

You do not have to configure anything additionally for this.

Front Door automatically adds the XFF Header to the requests.

Refer : https://learn.microsoft.com/en-us/azure/frontdoor/front-door-http-headers-protocol#from-the-front-door-to-the-backend

You should be able to see the XFF in the backend logs.

Is it not the case?

Are you not seeing the XFF headers in your API VM logs?

Cheers,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Maneesh Patha 20 Reputation points

2023-07-07T06:31:28.0833333+00:00

@KapilAnanth-MSFT

I am using Azure Front Door in front of a Firewall.

I am checking in VM IIS logs to find out public IPs of the customers. But in IIS logs I can see only Firewall private IP as Source IP.

Thanks,

Maneesh
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-07-10T09:17:10.9533333+00:00

@Maneesh Patha

That is strange.

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Share via

Azure Firewall masked ips

1 answer

Your answer