X-Forwarded-For through proxy and F5

As for the remote sites using proxies, each one NEEDS to insert the XFF. Verify they are doing this with tcpdump on the frontend of the f5.

Then since the VS is performing SNAT, it is inserting the IP of the proxy source as the XFF. You need to use an iRule to append the header with an additional XFF received from the proxy.

As you have disparate configurations at your remote sites, you probably need to change the behavior per source IP, as the f5 inserting the proxy IP after SNAT will not help you out, you want the XFF that the proxy is sending toward the f5 maintained when forwarded to the backend servers, so use append.

This will append the XFF if it exists, or insert a new one if it does not-

when HTTP_REQUEST {

if { [string tolower [HTTP::header names]] contains "x-forwarded-for"}{
    set XFF [HTTP::header X-Forwarded-For]
    append XFF ","
    lappend XFF [IP::remote_addr]
} else {
    set XFF [IP::remote_addr]
}

HTTP::header replace "X-Forwarded-For" $XFF

}