Oddities in XForwardedFor?

It's possible that a client or previous network device is inserting an XFF header. It's also possible that the BIG-IP is inserting an invalid value (bug?). nmenant's example should help you determine what's happening. If you get a runtime error from the example when trying to use the HTTP::header command in the HTTP_REQUEST_SEND event, you could try forcing the HTTP::header command into the clientside context using 'clientside {HTTP::header "X-Forwarded-For"}'.

If you are using the client IP address for anything more important than reporting, it would be good to use an iRule to remove any existing instances of the header you're going to insert before you actually insert the new header. Here's an example:

when HTTP_REQUEST {
    Remove all instances of the custom header
   while {[HTTP::header exists X-Forwarded-For]}{
      HTTP::header remove X-Forwarded-For
   }
    Insert a new XFF header with the client IP address as a value
   HTTP::header insert X-Forwarded-For value [IP::client_addr]
}

Aaron