Quarantining an attacker's proxy doesn’t block traffic from the proxy
Technical Articles ID:
KB94928
Last Modified: 9/28/2021
Environment
McAfee Network Security Manager (NSM) 10.x, 9.x
Problem
When you enable xff parsing, the proxy server triggers a Signature because the proxy has the quarantine action applied to it. But the proxy IP address isn’t quarantined. When you view the quarantine list, you don't see the proxy IP listed and the server's traffic isn’t blocked.
Solution
This action is as designed. If you enable XFF header parsing on your Sensor, quarantining an attacking host uses the original source IP address, not the IP address from the IP header.
