IIS 7 and Above
X-Forwarded-For Under Same Column as c-ip
Last post Jul 22, 2019 06:09 PM by Kyle74
Jul 18, 2019 03:28 PM|Kyle74|LINK
Our security team would like things to go back to where things were back pre-8.5 with Advanced Logging.
Previously, we used to have X-Forwarded-For moved into c-ip column.
How do we replicate this with IIS 10?
Thank you for your time
Jul 18, 2019 04:21 PM|Rovastar|LINK
As far as I know. They was never a built in feature, you have to run a module to do with.
Here is the one I use.
Jul 18, 2019 04:32 PM|Kyle74|LINK
Any idea if this will work with IIS 10?
The article is pretty old and testing is a bit limited
Jul 19, 2019 10:02 AM|Able|LINK
I suggest that you could follow the steps in the link to add the X-Forwarded-For Header and Configuring IIS Logging.
Here is the link ,I hope it could help you.
Jul 19, 2019 01:07 PM|Kyle74|LINK
Thank you for your reply.
Unfortunately this does not pertain to my question.
I'm trying to merge the column for XFF into the Client IP field or at least move them together side by side.
Our security team doesn't like how the columns are separate and so far apart.
Unfortunately again, Log Parser isn't an option.
Jul 19, 2019 08:18 PM|Rovastar|LINK
Yes it works in IIS10.
Sadly that solution is just for adding X-Forwarded-For as an additional column in the IIS logs. Whereas the solution module solution replaces the c-ip field with what is in the X-Forwarded-For header so IIS more natively has this value which is sometimes
Jul 22, 2019 06:09 PM|Kyle74|LINK
I'll give that module a shot, thank you Rovastar!