How can I log the actual client IP address in IIS7 or Windows Server 2008 when using a Barracuda Web Application Firewall?

Solution #00004607

Scope:

Applies to all Barracuda Web Application Firewalls.

Answer:

To log the actual client IP instead of the VIP of the Barracuda Web Application Firewall in the IIS logs, install the x-forwarded-for DLL on the IIS 7server. By default, the WAF forwards the clients IP address as the header X-Forwarded-For:

1. Open IIS Manager and navigate to the level you want to manage.
2. In Features View, on the server or site Home page, double-click ISAPI Filters.
3. Add the X-Forwarded-For dll file from the XForwardedFor2008.zip file. Make sure you choose the correct processor.
4. Restart the WWW services on the IIS server.

Link to this page:

https://campus.barracuda.com/solution/50160000000IAcdAAG