Forum Discussion

satish_txt_2254's avatar
satish_txt_2254
Icon for Cirrus rankCirrus
Mar 15, 2016

Multiple X-Forwarded-For ip address

We have enabled X-Forwarded-For on F5 and in apache we have added following code LogFormat blah...\"user-agent\": \"%{User-agent}i\", \"client\": \"%{X-Forwarded-For}i\",...blah Now i am doing ex...
application delivery
BIG-IP
f5
security
x-forwarded-for
Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus

Absolutely. In your HTTP profile, make sure Accept XFF is not check. Are you adding X-Forwarded-For via iRule or your HTTP profile?

 

Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Mar 16, 2016
So in your HTTP profile you are right you should enable X-Forwarded-For since you are using SNAT, but you don't want to accept an X-Forwarded-For from someone else. That's what that check box for "Accept XFF" is for. It prevents the forged header from being excepted.