For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mhd90_359601's avatar
mhd90_359601
Icon for Nimbostratus rankNimbostratus
Dec 12, 2018

Values in X-Forwarded-For when SNAT is enable

Hi I have a case where user has pointed out that the X-Forwarded-For has F5 self ip. F5 has automap enabled. Is this expected behaviour? The VS has tcp profile, so nothing being done by F5 to the htt...
application delivery
BIG-IP
LTM
DaveS_377638's avatar
DaveS_377638
Icon for Cirrus rankCirrus
Dec 13, 2018

I suggest you look at the server that is the node for the VS that is setting this header. Since the LTM is set for SNAT/automap, the self IP address will be the client address seen by that server.

 

DaveS_377638's avatar
DaveS_377638
Icon for Cirrus rankCirrus
Dec 14, 2018

XFF is used to indicate the originating IP address. The configuration details you've given for the LTM means it's not including the header so it must be the back end server that is doing it, confirmed by the address being the LTM self address.

 

Is this expected behaviour - it will be if server is configured for XFF insertion.