Symantec SEP - Network Threat Protection - strategy for load balancers

Hey all,

Looking for a best practice, guideline, or "how you did it" in terms of the Network Threat Protection as part of SEP. The problem is we have hosts behind load balancers and when scanners or legit attacks get detected/blocked they are reported as coming from the Load Balancer(s).

Will X-Forward help this situation? Are there other things we can do to get the true source?

Thanks!