Forum Discussion
DaveS_377638
Cirrus
I suggest you look at the server that is the node for the VS that is setting this header. Since the LTM is set for SNAT/automap, the self IP address will be the client address seen by that server.
DaveS_377638
Dec 14, 2018Cirrus
XFF is used to indicate the originating IP address. The configuration details you've given for the LTM means it's not including the header so it must be the back end server that is doing it, confirmed by the address being the LTM self address.
Is this expected behaviour - it will be if server is configured for XFF insertion.