Search code examples
azureip-addressazure-api-managementweb-application-firewallx-forwarded-for

Azure API Management - How to get original IP when APM is behind WAF

We have below technical stack

  • Imperva WAF
  • API Management
  • WebApi in WebApp

This is current implementation

  • Client IPs are authenticated at WAF level
  • WAF IPs are whitelisted at APIM
  • APIM IP is whitelisted at WebApp level

Everything is working fine and as expected.

Now when i went to APIM -> Analytics -> Request, i see WAF IPs are listed here and not the client ones. So in this case we will not be able to track who is using what

I know we have option to track thru subscription key, but that is not enough.

Can anybody please suggest how to configure to get correct IPs?

enter image description here

Solution

  • After raising support request to Microsoft, we got what we want

    This is how we accomplished

    • When Imperva WAF calls APIM endpoint, it also passes Incap-Client-IP in header
    • Within APIM -> APIs -> All APIs -> Settings -> Enter header property you want to add in request log of App Insights enter image description here
    • Under request log -> custom dimension -> you can see InCap-Client-IP property is added in App Insights

    enter image description here

    Now we can export this in csv format and can track usage based on client IP.