Deployment of X-forwarder on all VIP

Enabling this via profile won't cause an interuption. Via iRule shouldn't if you don't make any mistakes.

Yes you can script this. But some experience with them is probably useful before just doing that in production.

Hi lttarvina,

first read this: K4816 - Enabling the Insert X-Forwarded-For option in the HTTP profile 

lets say all your virtuals have the default http profile, named http. And, following the process described above, you create a new profile called pr_http_xff. This command should replace the profile called http with your new profile pr_http_xff on all virtuals.

tmsh list ltm virtual one-line | grep "profiles.*\ http\ " | awk '{ print $3 }' | xargs -I vs_name tmsh modify ltm virtual vs_name profiles add { pr_http_xff } profiles delete { http http }

This is the same what boneyard suggests, but not for one but for many virtuals.

I took this from my notes and didn't test it in my lab. Therefore: handle with care.
If you have DSC cluster, run on the standby unit and sync. If you have a test environment, test it there.

KR
Daniel

Thank you boneyard and Daniel_Wolf for your answers to my queries. I have another question. I found this knowledge-based article for verifying the X-Forwarded-For Header Inserted by the BIG-IP.

Using an irule to verify the X-Forwarded-For Header Inserted by the BIG-IP (f5.com)

My questions are as follows: 

1) Please explain the meaning of 10.10.10.10 in the script.

2) Is it possible to run the script written on the KB article and apply it to all 187 virtual servers at once without erasing the iRules that were previously configured on the above-mentioned virtual servers? The newly configured iRule overwrites the previously configured ones when I run the command below.

tmsh list ltm virtual one-line | grep "profiles.*\ http\ " | awk '{ print $3 }' | xargs -I vs_name tmsh modify ltm virtual vs_name rules { X-Forwarded-For-Verify }

Hi lttarvina,

first let us understand why you want to apply this iRule to all your virtuals? Do you understand what this iRule does?

Let me start by answering your first question. The 10.10.10.10 is the client IP address.

If I use tmsh to look at the connection table for my virtual server (vs_nginx_http) I will see this output:

root@(big-ip)(cfg-sync Standalone)(Active)(/Common)(tmos)# show sys connection virtual-server vs_nginx_http
Sys::Connections
192.168.57.1:39236 192.168.57.80:80 10.0.2.246:39236 10.0.2.80:80 tcp 6 (tmm: 1) none none
Total records returned: 1

So my client IP address is 192.168.57.1, [IP::client_addr].
My virtual server IP address is 192.168.57.80, [IP::local_addr] in a client-side iRule event.
My SNAT IP address is 10.0.2.246, also [IP::local_addr] but in a server-side iRule event.
And the IP of the node / pool member is 10.0.2.80 [IP::server_addr].

The iRule you are looking at will add a log entry every time someone with the IP 10.10.10.10 invokes a request on any virtual server that has this iRule attached.
If you have a busy system and you get a lot of requests from whatever IP you insert into this iRule, you will create A LOT of log entries.
What exactly are you trying to achieve? Maybe addint the iRule to only one virtual is enough, for troubleshooting something?

KR
Daniel