Azure API Management - How to get original IP when APM is behind WAF

We have below technical stack

• Imperva WAF
• API Management
• WebApi in WebApp

This is current implementation

• Client IPs are authenticated at WAF level
• WAF IPs are whitelisted at APIM
• APIM IP is whitelisted at WebApp level

Everything is working fine and as expected.

Now when i went to APIM -> Analytics -> Request, i see WAF IPs are listed here and not the client ones. So in this case we will not be able to track who is using what

I know we have option to track thru subscription key, but that is not enough.

Can anybody please suggest how to configure to get correct IPs?

After raising support request to Microsoft, we got what we want

This is how we accomplished

• When Imperva WAF calls APIM endpoint, it also passes Incap-Client-IP in header
• Within APIM -> APIs -> All APIs -> Settings -> Enter header property you want to add in request log of App Insights
• Under request log -> custom dimension -> you can see InCap-Client-IP property is added in App Insights

Now we can export this in csv format and can track usage based on client IP.