For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dave_Clark_2114's avatar
Dave_Clark_2114
Icon for Nimbostratus rankNimbostratus
Aug 01, 2014

Issue with HTTP profile X-Forwarder-For and AFM

Hopefully it's just an over site on my part, but here it is in a nutshell. Developer wants to see source client-ip at the web server level and traffic is being sent through several f5 platforms.   ...
advanced firewall manager
availability
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Aug 01, 2014

Hi Dave,

 

Is this encrypted HTTPS traffic? If so and you want BIG-IP to insert an XFF header, you'll need to import a valid server cert and key, create a client SSL profile and then add both the client SSL and HTTP profiles to the virtual server. This allows BIG-IP to decrypt the SSL and modify the HTTP headers to insert the XFF header.

 

If this doesn't work for you, please reply with your BIG-IP version, virtual server, client SSL profile and HTTP profile config. You can copy these from the bigip.conf or list the config using tmsh.

 

Aaron