Forum Discussion
Cameron_Merrick
Aug 06, 2018Altostratus
X-Forwarded-For: Multiple IP's Chained | Need Original IP | iRules and HTTP Profile?
Hello,
I am at a loss. I am a security engineer and one of my jobs is managing the SIEM, which I am building out currently. One of the log sources is, of course, the F5 ASM logs. The problem, h...
JG
Aug 07, 2018Cumulonimbus
This is a case of multiple XFF headers and you can't really know which contains the end-user address unless you know the addresses of the intermediate systems to filter them out. To log all the addresses locally, you can do:
when HTTP_REQUEST {
if { [HTTP::header values "X-Forwarded-For"] ne "" } {
log local0. "[HTTP::header values \"X-Forwarded-For\"]"
}
}
You will need to make some changes for remote logging.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects