TRITON RiskVision Setup Guide
3
Introducing TRITON RiskVision
RiskVision positioned upstream from a web proxy
When RiskVision is positioned closer to the Internet egress point:
RiskVision sees origin server responses before they are processed by the web
proxy. This allows unrestricted application of the real-time analytic features.
If the downstream proxy blocks outbound requests, however, RiskVision will not
see those requests and cannot analyze or log them.
In this configuration, because outbound traffic goes through the downstream proxy
before being seen by RiskVision, the source IP address of all requests is the web proxy
IP address.
To address this issue, configure the downstream proxy to add
X-Forwarded-For
to
HTTP headers. RiskVision automatically parses the X-Forwarded-For information
and includes both the source IP address (the proxy) and the forwarded for IP address
(the client) in its reporting output.
