A method, executed by a computer system comprising a firewall and a security service, the method comprising: receiving, by the firewall, a packet from a network device; processing, by the firewall, the packet received from the network device; monitoring, by the firewall, a source address indicated in a source address field of the packet received from the network device, wherein the source address corresponds to the network device; when the source address is the same for a threshold number of packets, the firewall determining that it is downstream from the network device and the firewall determining that a X-Forwarded-For, XFF, field of the packet received from the network device should be recorded; when the firewall determines that the XFF field should be recorded, the firewall recording an original source address in the XFF field of the packet received from the network device in addition to the source address in the source address field of the packet received from the network device to an entry in a network traffic database, wherein the original source address corresponds to a client device (101, 102) which transmitted the packet prior to the network device; retrieving, by the security service, the entry from the network traffic database; analyzing, by the security service, the client device based, at least in part, on the original source address in the entry; determining, by the security service, based on the analyzing, that the client device (101, 102) belongs to a group of devices (101, 102) controlled by a first policy; and applying, by the security service, the first policy to the packet and other network traffic from the client device. receiving, by the firewall, a packet from a network device; processing, by the firewall, the packet received from the network device; monitoring, by the firewall, a source address indicated in a source address field of the packet received from the network device, wherein the source address corresponds to the network device; when the source address is the same for a threshold number of packets, the firewall determining that it is downstream from the network device and the firewall determining that a X-Forwarded-For, XFF, field of the packet received from the network device should be recorded; when the firewall determines that the XFF field should be recorded, the firewall recording an original source address in the XFF field of the packet received from the network device in addition to the source address in the source address field of the packet received from the network device to an entry in a network traffic database, wherein the original source address corresponds to a client device (101, 102) which transmitted the packet prior to the network device; retrieving, by the security service, the entry from the network traffic database; analyzing, by the security service, the client device based, at least in part, on the original source address in the entry; determining, by the security service, based on the analyzing, that the client device (101, 102) belongs to a group of devices (101, 102) controlled by a first policy; and applying, by the security service, the first policy to the packet and other network traffic from the client device.