Quarantining an attacker's proxy doesn’t block traffic from the proxy

Technical Articles ID: KB94928
Last Modified: 9/28/2021

Environment

McAfee Network Security Manager (NSM) 10.x, 9.x

Problem

When you enable xff parsing, the proxy server triggers a Signature because the proxy has the quarantine action applied to it. But the proxy IP address isn’t quarantined. When you view the quarantine list, you don't see the proxy IP listed and the server's traffic isn’t blocked.

Solution

This action is as designed. If you enable XFF header parsing on your Sensor, quarantining an attacking host uses the original source IP address, not the IP address from the IP header.

Affected Products

Network Security Manager 9.2.x
Network Security Manager 9.1.x
Network Security Manager 10.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
Portuguese Brasileiro

Knowledge Center

Quarantining an attacker's proxy doesn’t block traffic from the proxy

Environment

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Quarantining an attacker's proxy doesn’t block traffic from the proxy

Environment

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title