Where is the X-Forwarded-For setting IPS Logs, Firewall Logs

Anyone have anything on this? I have a ton of outbound traffic hitting my Red Interface and my IPS is saying its coming from the Red Interface. I need the True Source IP (Intranet Client Original Source), and I realize that I have to be able to flip on a setting to read that in the HTTP payload, but no idea where I can find it.