To help you enforce security policy on an
endpoint that originates a request when it is behind an upstream
device, such as an explicit HTTP proxy server or load balancer,
the firewall can now use the source IP address contained in the X-Forwarded-For (XFF) field
in the packet HTTP header. With the IP address of the original initiator
of the request, you can ensure that the correct security policy
rules are applied and use other features such as geoblocking, IP blocking,
and DoS protection. For example, if you want to block traffic originating
in North Korea, so you create policy based on North Korean IP addresses.
The firewall can identify those location-based IPs and enforce policy,
even if that traffic passes through a explicit HTTP proxy. Additionally,
the firewall now displays the endpoint IP address and upstream device
IP address in logs to aid troubleshooting and remediation. | 
