Forum Discussion
vikas_Patil
Nimbostratus
NimbostratusBypass WAF for X-forwarder IP in XC
We use the F5 XC and want to bypass the WAF rules if traffic comming from specific IP address in X-forwarder-for field,
X-forwarder-for Field contail Multiple IP address and if any of the IP matches to the list , XC should bypass the WAF rules
E.g. Http header x-forwarded-for : 1.1.1.1; 2.2.2.2 , requirement is to bypass WAF Rule for the IP 1.1.1.1
Here is the article after I played with the features of the F5 XC:
SamirMVP
if you have list of known X-forwarder-for Source IP then create iRule and bypass WAF Policy. This can be possible.
vikas_PatilActually we want to do it on WAAP, and Irule option is not available
Sudhir_PatamsettiEmployee
VikasB , You can use "trusted client rules" to "bypass WAF" . Navigate to http load balancer --> common security controls ---> trusted client rules
- Nikoolayy1
vikas_Patil did you manage to make this work?
Maybe to match a specific ip address when there are many in the HTTP XFF header you can use regex. To match a single IP address you can try the regex (1\.1\.1\.1) where 1.1.1.1 is the IP address and soon I will publish an F5 community article about this as I played with the feature a little.
- Nikoolayy1
Here is the article after I played with the features of the F5 XC:
- Nikoolayy1
As Sudhir_Patamsetti mentioned there is this option that I have not used yet but it is interesting if it will work with multiple ip addreesses in the HTTP header. If the rule has the option to select something like "contains" in the value of a specific HTTP header then it shouldn't be an issue. If you see issues you may need to modify your proxy devices to also add another header that has just one ip address and use that in the Distributed Cloud XC rules.