When using ASM with conjunction with LTM+XFF sometimes based on the traffic path XFF header would have multiple IP address.
Example -
X-Forwarded-For: 8.8.8.8 4.4.4.2 10.137.255.232
X-Forwarded-For: 8.8.8.8 4.4.4.2 10.137.255.232
Real value of XFF header is furthest left IP which is 8.8.8.8, But F5 selects the middle IP 4.4.4.2 because it's most "Trusted" in the context of RFC so we have to make sure that the leftmost one is selected via iRule.