For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Duncan_Proffitt's avatar
Duncan_Proffitt
Icon for Altostratus rankAltostratus
Apr 26, 2018

XFF and the ASM module

WE are experiencing a situation where the F5 is denying traffic due to an XFF that it doesnt understand.   The F5 receives traffic from a certain server that has already added an XFF on to the IP ...
application delivery
ASM Advanced WAF
LTM
Duncan_Proffitt's avatar
Duncan_Proffitt
Icon for Altostratus rankAltostratus
Apr 30, 2018

@boneyard I understand what you are saying about is one XFF enough. But the client wants more than one added. It is possible and this is from the F5 docs.

 

Many servers and applications expect only a single X-Forwarded-For header, per request. However, the BIG-IP system appends a new X-Forwarded-For header to the existing set of HTTP headers, even if there is an existing X-Forwarded-For header in the request. Both approaches are valid according to the Internet Engineering Task Force (RFC2616, Section 4.2)

 

But the financial package is complaining because it is only seeing the ipaddress of the Verisign piece of kit, not the XFF header that includes the internet users address.