Multiple X-Forwarded-For ip address

I need XFF header because i am using SNAT "automap" in F5. I am using HTTP Profile. When i am doing testing and adding forge X-Forwarded-For header using curl -H "X-Forwarded-For: 123.123.123.123" then my apache logs showing two IP address in logs.. I want only single IP instead two

So in your HTTP profile you are right you should enable X-Forwarded-For since you are using SNAT, but you don't want to accept an X-Forwarded-For from someone else. That's what that check box for "Accept XFF" is for. It prevents the forged header from being excepted.

Sorry i got it what you saying `Accept XFF` is already unchecked. then still why it's accepting XFF header?

Your other option is to use an Local Traffic Policy or an iRule to inject the X-Forwarded-For header. But rather than using the "insert" directive you would use "replace". That would ensure only one header could possibly be sent to the backend servers and a forged header won't be accepted. Replace will add the header if it doesn't already exist and over-write the header that was present if the client did try to send a forgery.

That's a good question on that behavior. I was under the impression that would ignore client submitted XXF headers. I will do more research on that behavior and see if that's expected. With that said I would highly recommend the policy or iRule I mentioned above. The irule is very simple. when HTTP_REQUEST { HTTP::header replace "X-Forwarded-For" [IP::client_addr] }

Can you provide me full iRule? also is there any performance impact with iRule?? we are running almost 1000TPS

UPDATED "when HTTP_REQUEST { HTTP::header replace "X-Forwarded-For" [IP::client_addr] }" is the full iRule. The performance hit wouldn't be any more than the HTTP profile inserting the header(which is to say very very minimal).

You rule is giving error, look like format issue... are you sure thats the correct rules.. I think it should start with `when...`

Yep, should start with when. looks like a missed that in the copy paste from one comment to the other.