Forum Discussion

Nath's avatar
Nath
Icon for Cirrostratus rankCirrostratus
May 10, 2017

How to check if XFF is working

Anyone I am looking for a way to check if XFF is working in bigip aside from checking it to Wireshark. Server team keep on claiming that they still see the bigip SNAT IP on their end.   Thank you ...
application delivery
LTM
security
TMSH
xff
Ryannnnnnnnn's avatar
Ryannnnnnnnn
Icon for Altocumulus rankAltocumulus
May 10, 2017

The pool member will still see the SNAT IP as the source IP. However, with XFF enabled the http request header will have the real client ip included as an additional field.

 

Aside from checking the http profile/iRule that you've configured you could capture the server side request to confirm that the field is getting inserted but that would obviously require the use of tcpdump/wireshark.

 

  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    May 10, 2017

    @Ryan i see, so I think all i can do is to check if they configured they server correctly.

     

  • Ryannnnnnnnn's avatar
    Ryannnnnnnnn
    Icon for Altocumulus rankAltocumulus
    May 10, 2017

    Yep, Check out K4816 and look towards the bottom of the page for the section titled Configuring the web server to extract the IP address from the HTTP header for extra info on configuring the web server.