F5 SSL Pass-through with Xforward.

Correct, the LTM has to decrypt the traffic to insert the x-forwarded-for header. There is no way around that.

If you have a requirement that the LTM does not decrypt the traffic, it will be impossible to insert an x-forwarded-for header. These two client requirements are mutually exclusive.

"Proxy SSL Passthrough" is not the same thing as simple "SSL Passthrough." Proxy SSL Passthrough does decrypt the traffic as long as a compatible cipher suite is negotiated between client and server, and falls back to SSL Passthrough when DH/DHE ciphers are negotiated.