class and v9.1.2

You can use matchclass in 9.x or 10.x to evaluate an IP address or string against a class.

 

 

You might also consider adding the three IP addresses to an address type datagroup (aka class) and then use matchclass again to check the XFF header value against the datagroup.

 

 

Be aware that it's likely that attackers could bypass your logic though using obfuscation techniques:

 

 

http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&postid=30900

 

 

Aaron