X-Forwarded-For through proxy and F5

You are right I believe the proxy needs to be decrypting to modify the http header, and insert the XFF. The client SHOULDN'T be inserting its own XFF, though it could it can do whatever it wants.

If I understand right, this is the simplified issue:

-some requests to the f5 already have XFF, as they are proxies -some requests to the f5 are from regular clients -f5 is using SNAT, so XFF needs to be inserted

I think if you create a list of proxy IPs that already insert XFF for you and 'regular' clients then the newer iRule I posted should lead you toward the fix.