In a cascaded proxy architecture, the upstream Cisco WSA sees requests originating from the downstream WSA's IP address, not the original client's. To preserve the client's IP identity for logging and policy enforcement on the upstream device, two primary methods can be used.

1. X-Forwarded-For (XFF) Header: The downstream WSA can be configured to insert the XFF HTTP header into requests it forwards. This header contains the original client's IP address, which the upstream WSA can then be configured to parse and use for identification.

2. IP Spoofing: The downstream WSA can be configured to "spoof" the client's IP address. In this mode, the downstream WSA forwards the request to the upstream WSA using the original client's IP address as the source IP in the packet headers.

B. high availability: This feature provides service redundancy and failover through clustering or other mechanisms; it does not relate to identifying client IP addresses in a proxy chain.

C. web cache: This feature improves performance by storing and serving frequently requested content locally. It is not involved in passing client identity information between proxies.

D. via: The Via HTTP header is used to track the path of a request through one or more proxies and for loop detection, not for explicitly identifying the original client's IP address.

1. Cisco AsyncOS 14.5 for Cisco Secure Web Appliance User Guide

"Connecting to Upstream Proxies

" Page 10-10. The guide states

"The Secure Web Appliance can add an X-Forwarded-For header to HTTP requests to identify the original client IP address to the upstream proxy."

2. Cisco AsyncOS 14.5 for Cisco Secure Web Appliance User Guide

"How the Web Proxy Handles Client Connections

" Page 10-11. The guide explains IP spoofing: "When you enable IP spoofing

the Secure Web Appliance spoofs the IP address of the client that initiated the request. The upstream proxy or firewall receives the request with the client’s IP address as the source address."

3. Cisco Content Security Management Appliance Configuration Guide

Release 11.0

"Editing and Duplicating a Web Proxy Profile

" Page 10-11. This document also describes the configuration for adding the X-Forwarded-For header for upstream proxies.