Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Which IPS devices support X-Forwarded-For & True-Client-IP?

    • Updated:
    • Product/Version:
    • TippingPoint IPS N-series All
    • TippingPoint IPS NX-series All
    • TippingPoint IPS S-series All
    • TippingPoint SMS All
    • TippingPoint TPS All
    • TippingPoint Virtual SMS
    • TippingPoint Virtual TPS All
    • Platform:
Summary
Support for X-Forwarded-For & True-Client-IP.
Details
Public

X-Forwarded-For (XFF) and True-Client-IP (TCIP) support is available on the following TippingPoint devices;

  • S-Series (10/110/330) with TOS v3.6.1 or higher
  • N-Platform (660N, 1400N, 2500N, 5100N, 6100N) with TOS v3.6.1 or higher
  • NX-Platform (2600NX, 5200NX, 6200NX, 7100NX, 7500NX) with TOS v3.6.0 or higher
  • TPS Series (440T, 2200T), all TOS
  • Security Management System (SMS) with SMSv3.6.0 or higher

Note 1: In the SMS, XFF and TCIP settings is configured through the SMS Profile area, and is displayed in the SMS Events area.


HTTP Uniform Resource Identifier (URI)support is available on the following TippingPoint devices;

  • N-Platform (660N, 1400N, 2500N, 5100N, 6100N) with TOS v3.8.0 or higher
  • NX-Platform (2600NX, 5200NX, 6200NX, 7100NX, 7500NX) with TOS v3.8.0 or higher
  • TPS Series (440T, 2200T), all TOS
  • SSecurity Management System (SMS) with SMSv4.1.0 or higher

Note 2: Enabling HTTP context information can impact system performance.

Note 3: In the SMS, the HTTP URI setting is configured through the SMS Profile area, and is displayed in the SMS Events area.

Note 4: In the SMS Events area, an icon appears if any additional information about an event is detected (the Capture Additional Event Information feature must be enabled). If the additional event information option has been selected, this panel provides the client IP address and hostname information associated with any HTTP URI. XFF and TCIP technology captures a client IP address before it can be overwritten by a forwarding proxy IP address. In addition to the previous XFF and TCIP data, the Additional Info field includes the attacker’s HTTP method, HTTP host, and HTTP URI information. When you click the icon, a dialog displays any of the additional information that was captured. The data collected with this feature is used for logging purposes only. Additional information for this panel includes values for the following possible categories:

  • X-Forwarded-For
  • True-Client-IP
  • URI Method
  • URI Hostname
  • URI
Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
TP000085780
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.