Forum Discussion
Cameron_Merrick
Aug 06, 2018Altostratus
X-Forwarded-For: Multiple IP's Chained | Need Original IP | iRules and HTTP Profile?
Hello,
I am at a loss. I am a security engineer and one of my jobs is managing the SIEM, which I am building out currently. One of the log sources is, of course, the F5 ASM logs. The problem, h...
Stanislas_Piro2
Aug 07, 2018Cumulonimbus
try this code
when HTTP_REQUEST {
set FIRST_XFF [[getfield [lindex [HTTP::header values X-Forwarded-For] 0] "," 1]]
HTTP::header insert X-Forwarded-For [IP::remote_addr]
HTTP::header remove X-Forwarded-For
HTTP::header remove X-Forwarded-For-Raw
HTTP::header remove CF-Connecting-IP
HTTP::header insert X-Forwarded-For FIRST_XFF
HTTP::header insert X-Forwarded-For-Raw $FIRST_XFF
HTTP::header insert CF-Connecting-IP $FIRST_XFF
}
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects