Forum Discussion

Kyle74's avatar
Kyle74
Icon for Altocumulus rankAltocumulus
Jul 18, 2019
Solved

X-Forwarded-For merged into c-ip in the Logs

This isn't a directly F5 question, but we do use an F5.   Anyway, our security team wants us to merge the X-Forwarded-For IPs into the c-ip column.   Does anyone know how to do this in IIS?
BIG-IP
devops
cjunior's avatar
cjunior
Icon for Nacreous rankNacreous
Jul 18, 2019

Hi,

The first one has content that shows what you need to do to send XFF header to the server.

The other two, may help you a way to read or replace XFF value on c-ip column.

 

Regards.

  • Kyle74's avatar
    Kyle74
    Icon for Altocumulus rankAltocumulus
    Jul 18, 2019

    My boss shot both ideas down.

     

    Any idea if we can change the column location for the XFF? Maybe have it before or after the Client IP?

    • cjunior's avatar
      cjunior
      Icon for Nacreous rankNacreous
      Jul 19, 2019

      Hum, the ISAPI option was my choice on past.

      Sorry, nothing more on mind at this time.

    • cjunior's avatar
      cjunior
      Icon for Nacreous rankNacreous
      Jul 22, 2019

      I think the best way is you confirm on your webserver log entries.

      Capturing those headers on BIG-IP will just confirm that all was sent.

      Regards.

    • cjunior's avatar
      cjunior
      Icon for Nacreous rankNacreous
      Jul 22, 2019

      If I not wrong, this module replaces the c-ip original value, so, you are able to discard the XFF value on backend. Please, double check it :)

      Cheers