Enable Webtier to log the X-FORWARDER-FOR Header in the access logs
3 years ago
Article Number
000068004
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager WebTier
RSA Version/Condition: 8.x
Issue
If there is a load balancer in front of webtiers, when a user logs into the web tier through the load balancer the webtiers always log the IP of the load balancer itself without logging the IP of the device that is accessing the load balancer.

This causes multiple problems with customer who sends logs to Splunk as they will always get that the web tier has been accessed by the load balancer IP not the true IP of the device. 

 
Resolution
1- Make Sure that the loadbalancer are forwarding the X-FORWARDED-FOR header.

2- Go to the webtier folder then go to this directory either on a Linux webtier or a windows webtier
  
---> server ---> config --> config.xml

3- Look for the line in config.xml that contains:
  
<elf-fields>c-ip date time time-taken cs-method cs-uri sc-status bytes</elf-fields>

4- Change it to:
  
<elf-fields>cs(X-Forwarded-For) c-ip date time time-taken cs-method cs-uri sc-status bytes</elf-fields>

When you go to the logs directory and then check the access_logs, you will find out that another column has been added that contains the true IP of the device that has accessed the load balancer.

 
Don't see what you're looking for?