Thursday, April 23, 2026

F5+ASM+XFF header

 When using ASM with conjunction with LTM+XFF sometimes based on the traffic path XFF header would have multiple IP address.

Example -
X-Forwarded-For: 8.8.8.8 4.4.4.2 10.137.255.232

Real value of XFF header is furthest left IP which is 8.8.8.8, But F5 selects the middle IP 4.4.4.2 because it's most "Trusted" in the context of RFC so we have to make sure that the leftmost one is selected via iRule.