How To: Log the Original Client IP via IIS Advanced Logging (X-Forwarded-For or X-MS-Forwarded-Client-IP)

Version Affected: Not applicable — this is an Internet Information Services (IIS) configuration change and is not tied to a specific SecureAuth Identity Provider (IdP) version.

 

Overview

This article explains how to install the IIS Advanced Logging module and configure it to capture the original client IP address forwarded by a load balancer or reverse proxy — either via the standard X-Forwarded-For request header, or via X-MS-Forwarded-Client-IP, the header some Microsoft/Azure load balancers use instead. The steps are identical either way; only the header name you choose in step 6 differs.

Install and Configure IIS Advanced Logging

1. Download and install the IIS Advanced Logging module from the Microsoft Download Center. Installing the module doesn't require a reboot, but you will need to reset IIS once the new logging field below has been created.
2. In IIS Manager, select the server or site and open the new Advanced Logging icon that the module added.
   
   
    
3. In the Actions pane, click Enable Advanced Logging.
   
   
    
4. Click Edit Logging Fields.
   
   
    
5. Click Add Field.
   
   
    
6. In the Add Logging Field dialog, give the field an ID of your choice (for example, ClientSourceIP), set Source type to Request Header, and set Source name to x-forwarded-for — or x-ms-forwarded-client-ip if you're behind a Microsoft/Azure load balancer that sets that header instead.
   
   
    
7. Click Add Log Definition.
   
   
    
8. On the Log Definition screen, add whatever other fields you want in this log, then click Select Fields and make sure the field you created in step 6 is included.
   
   
    
9. In the Select Logging Fields dialog, check the field you created — the standard header and the Microsoft-specific header appear here as separate selectable fields if you've added both. Once you're done, reset IIS for the new field to start appearing in the log.
   
   

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.