Does this support non-HTTP traffic blocking?

[bganderson]

It's my understanding that the PA behind the ELB will not be able to see the original client IP (other than X-Forwarded-For for HTTP traffic), so is this solution only for HTTP based traffic or is there something I'm not understanding?

[vinayvenkat]

Hi @bganderson Looks like you are talking about two different scenarios if I understand your question.

1. So the architecture for using the ELB is primarily for HTTP/HTTPS traffic.
2. To answer the second question, yes will be able to see the original client IP by using the XFF header. However, to enforce using the original IP from the XFF, you will need to map that IP into a userid field before setting up the policy.
   Hope this helps and apologies for the slow response.