Forum Discussion
NimbostratusCheck to see if XFF is present, if so don't insert XFF
External users hit a dns entry on a Netscaler in our dmz. That device inserts the XFF and then passes (pass through mode) the data to an F5 internal to our network. What we are looking to do is if the XFF header is present, don't over write it.
In the case of a connection from outside of the trusted network the XFF header is always the address of the Netscaler passing the connection to the internal F5.
In the case of interanal connections we are looking to have the XFF header inserted as the connection will hit the F5 vip.
So if the internal F5 sees the xFF header inserted by the Netscaler, pass that along as it is so the source of the netscaler doesn't replace the correct on. If there is no XFF the connection is assumed to be internal and the correct XFF header needs to be inserted.
Thanks
JohnKrum
4 Replies
t-roywhen HTTP_REQUEST {
insert XFF if it doesn't exist
if {not [HTTP::header exists "X-Forwarded-For"]} {
HTTP::header insert X-Forwarded-For [IP::client_addr]
}
}
johnkrum_45755I was able to test
when HTTP_REQUEST {
insert XFF if it doesn't exist
if {not [HTTP::header exists "X-Forwarded-For"]} {
HTTP::header insert X-Forwarded-For [IP::client_addr]
}
}
today and if I look at the cookie I see both IP addresses inserted. 198.177.94.250 and 10.129.14.248
auroraSSO=266391041180ICONNECTEMPHAGA BILLY https://caregiverconnect.aurora.org198.177.94.250, 10.129.14.2481364235987888AdqO34nrlPBoHQNreOq+OepatfI=
Any adjustments that I can make to have get this to work?
To be more clear -
1) if the connection is internal to our network the request goes directly to the F5 vip and XFF is inserted
2) if the connection is external to our network the request hits a Netscaler which inserts the XFF and the connection is passed on to the F5 VIP
The iRule should see the XFF and not over write or insert a new one.
Thanks
What_Lies_Bene1Cirrostratus
Sorry but can you clarify the issue please? You mention you are looking at a cookie, I'm not sure what this has to do with XFF HTTP Headers. How are you checking whether the header is inserted or not? Can you confirm the name and case of the header the Netscaler is inserting?
- johnkrum_45755Steve,
Your right, that is inserted in the get. I have a question asking how the developers are pulling that address to build the cookie I displayed above. I could get a packet capture if need be. I will keep you posted.
Thanks,
