Azure App Service - Get Public Client IP (not RFC1918)

%3CLINGO-SUB%20id%3D%22lingo-sub-1098228%22%20slang%3D%22en-US%22%3EAzure%20App%20Service%20-%20Get%20Public%20Client%20IP%20(not%20RFC1918)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1098228%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20currently%20looking%20at%20the%20%22AppServiceHTTPLogs%22%20from%20an%20App%20Service.%20This%20App%20Service%20is%20publicly%20accessible%20over%20the%20internet.%20When%20I%20watch%20the%20logs%2C%20I'm%20not%20able%20to%20get%20the%20Private%20IP%20from%20the%20customer%2C%20would%20it%20be%20possible%20somehow%20to%20get%20the%20IP%20of%20the%20customer%20accessing%20my%20App%20Service.%3CBR%20%2F%3EAt%20the%20moment%2C%20I%20only%20see%26nbsp%3B%3CSPAN%3ERFC1918%26nbsp%3BIPs%20in%20the%20cIP%20field.%3CBR%20%2F%3E%3CBR%20%2F%3EKind%20Regards%2C%3CBR%20%2F%3EThomas%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1098228%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApp%20Services%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMonitoring%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%20%26amp%3B%20Compliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1124359%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20App%20Service%20-%20Get%20Public%20Client%20IP%20(not%20RFC1918)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1124359%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F528908%22%20target%3D%22_blank%22%3E%40sramadugu%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFirst%2C%20let%20me%20thank%20you%20for%20helping%20me.%3CBR%20%2F%3EUnfortunately%2C%20I'm%20not%20able%20to%20see%20the%20forward%20those%20logs%20towards%20Azure%20Sentinel%20or%20external%20SIEM%20(from%20what%20I%20see)%2C%26nbsp%3B%20and%20I%20also%20only%20see%20%220.0.0.0%22%20as%20client_IP.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20686px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F166725i5DAAB3FBC9E6745D%2Fimage-dimensions%2F686x108%3Fv%3D1.0%22%20width%3D%22686%22%20height%3D%22108%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20Regards%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThomas%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1123540%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20App%20Service%20-%20Get%20Public%20Client%20IP%20(not%20RFC1918)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1123540%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F308071%22%20target%3D%22_blank%22%3E%40thomasdefise%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eif%20you%20enable%20application%20insights%20on%20the%20app%20level.%20you%20will%20get%20the%20client%20IP%20and%20also%20many%20other%20details%20on%20your%20app%20usage%20and%20behavior.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello,

 

I'm currently looking at the "AppServiceHTTPLogs" from an App Service. This App Service is publicly accessible over the internet. When I watch the logs, I'm not able to get the Private IP from the customer, would it be possible somehow to get the IP of the customer accessing my App Service.
At the moment, I only see RFC1918 IPs in the cIP field.

Kind Regards,
Thomas

3 Replies

@thomasdefise 

if you enable application insights on the app level. you will get the client IP and also many other details on your app usage and behavior. 

Hello @sramadugu,

 

First, let me thank you for helping me.
Unfortunately, I'm not able to see the forward those logs towards Azure Sentinel or external SIEM (from what I see),  and I also only see "0.0.0.0" as client_IP.

 

clipboard_image_0.png

 

Kind Regards,

 

Thomas

@thomasdefise 

the default behavior of app insights doesn't capture the IP, but you can follow the below doc to override the default and capture the IP. 

 

https://docs.microsoft.com/en-us/azure/azure-monitor/app/ip-collection