Azure API Management - How to get original IP when APM is behind WAF

Question

We have below technical stack

• Imperva WAF
• API Management
• WebApi in WebApp

This is current implementation

• Client IPs are authenticated at WAF level
• WAF IPs are whitelisted at APIM
• APIM IP is whitelisted at WebApp level

Everything is working fine and as expected.

Now when i went to APIM -> Analytics -> Request, i see WAF IPs are listed here and not the client ones. So in this case we will not be able to track who is using what

I know we have option to track thru subscription key, but that is not enough.

Can anybody please suggest how to configure to get correct IPs?

Answer 1

I believe you can find your answer in here. You merely need to configure your server to retrieve the correct IP from the relevant header.

Quoting the relevant part:

Original Client IP is required In case your application requires a real client IP address, please make sure you have enabled retrieval of this value from either: "X-Forwarded-For" or "Incap-Client-IP" header. When working with Imperva your server will see Imperva IPs instead of real client IPs. However, Imperva inserts by default the original client IP address into two HTTP headers: "X-Forwarded-For" and Imperva header "Incap-Client-IP".

But notice, you should take the first IP in a given XFF value, otherwise, the use of the second header real-client-IP might be affected by 3rd party proxies, etc.

Hope that helps.