How to see the actual IP when coming from F5 APM module to ASM

Hi,

 

Yes, on your APM you have to enable XFF on your HTTP profile in order to send USER IP to ASM.

 

Then in ASM, you can configured it to trust the XFF header send by APM. Then the system identifies the location using the address from the XFF header instead of the source IP address.

 

All is indicate in this article (step by step), quick and simple:

 

• In your Security Policy, Security > Application Security > Policy > Policy Properties adjust the view from Basic to Advanced
• Check the box next to Trust XFF Header (Navigate to Security -> Application Security -> Policy -> Policy Properties.

https://devcentral.f5.com/articles/the-big-ip-application-security-manager-part-7-geolocation

 

Let me now if you need more details.

 

regards