title: X-Forwarded-Proto not being passed through AWS ALB Sandwich with Palo Alto VM Firewall
body: <p>We're using Palo Alto's VM Firewall's with ELB's <a href="https://docs.paloaltonetworks.com/vm-series/7-1/vm-series-deployment/set-up-the-vm-series-firewall-in-aws/auto-scale-vm-series-firewalls-with-the-amazon-elb" rel="nofollow noreferrer">sandwich topology</a> and are unable to get the correct X-Forwarded-Proto to make it all the way back to the web server. HTTPS termination is happening on the external load balancer, then running as HTTP through the rest of the stack. Using a single load balancer we have no issue retrieving the correct X-Forwarded-Proto header whether it's HTTP or HTTPS. However, in the sandwich topology we get HTTP as the X-Forwarde-Proto no matter what. </p>
  
  <p>Our primary issue for needing the header is to redirect all requests to HTTPS, which might be able to be done on the PAN Firewall, but that has also proven elusive.</p>