Getting True Client IP on Fortigate

odsca · ‎10-04-2019

I opened up a ticket to see if it was possible for the Fortigate to see the true client IP, and the support guy said it can. At first, he said the fortigate couldn’t do it until I showed him an article that said that it can:

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41549

He then said yeah, it can, and all I would need to do is turn on IPS on the policy where I allow our CDN provider to our VIPs. Our CDN is already sending the true client IP in the header.

Is that all we really have to do? Turn on IPS on that policy? Only reason I’m having trust issues with that support guy is because he said no at first, then said yes after I showed him the documentation.

I also read that you have to enable "learn client IP" in web-proxy:

config web-proxy global

set learn-client-ip enable

set learn-client-ip-from-header x-forwarded-for

Also, what does it look like in logs? Will the True IP be within the logs? Or will it just show up as Source IP?

I'm a little disappointed that support doesnt truly know the answer.

We are on 6.0.5 btw.

Any insight on this will be greatly appreciated.

Thank you!

Hammad · ‎01-27-2022

Any update on this? Its 2022 and the support still say the same