IRULE to Set APM Session variable for X-Forwarded-For

You can get the XFF header in ACCESS_SESSION_STARTED event, and evaluate the value in the irule.

when ACCESS_SESSION_STARTED {
    set xforwardedfor [HTTP::header values {X-Forwarded-For}]
    ACCESS::session data set session.custom.xforwardedfor $xforwardedfor
    switch $xforwardedfor {
        "1.1.1.1" -
        "2.2.2.2" -
        "3.3.3.3" {
            ACCESS::session data set session.custom.xff_known_ip 1
        }
        default {
            ACCESS::session data set session.custom.xff_known_ip 0
        }
    }
}

Then check the value in the empty box

expr { [mcget {session.custom.xff_known_ip}] == 1 }