F5 APM - How to do IP Subnet match for IPs in header

add an iRule like that:

when ACCESS_SESSION_STARTED {
	ACCESS::session data set session.custom.xforwardedfor [HTTP::header X-Forwarded-For]
}

then add an Empty Box to your APM Policy, add a branch rule, then check the value against a subnet like that:

expr {[IP::addr [mcget {session.custom.xforwardedfor}] equals "10.0.0.0/8"]}