Okta shows multiple Internet Protocol (IP) addresses in the IP chain when a request passes through one or more proxies before it reaches Okta. Review the expanded System Log event to identify the originating client IP address and any detected proxy IP addresses.

The user observes multiple IP addresses in the IP chain for a System Log event and needs to determine whether proxy servers contributed to the request path.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta System Logs
• IP chain
• IP zones
• Requests that pass through proxy servers

Okta records the IP chain from all network hops between the originating request and Okta. When proxies handle the request, Okta stores multiple IP addresses in the order of client IP address followed by proxy IP addresses.

How is the IP chain interpreted in the Okta System Log?

The following information explains what the IP chain shows and how to interpret multiple IP addresses in a System Log event.

1. Open the relevant event in the System Log.
2. Expand the event details.
3. Review the IP chain value.

The following example shows the IP chain field in an expanded System Log event.

Use the following guidance to interpret the result:

• If the request passes through proxies, Okta stores the addresses in the format client IP, proxy1, proxy2, ....
• If multiple IP addresses appear, Okta detected one or more proxy IP addresses during the request.
• If only one IP address appears, the traffic originated from that IP address only.
• If HTTP headers hide the proxy path, no additional IP addresses appear in the IP chain.

Related References

• How Okta Evaluates the IP Address while Using an IP Zone in a Policy
• Understanding and Configuring IP Zones