XFF and the ASM module

ok, now it is getting more clear. i wanted to see if i missed this originally but your question seems quite different at the start.

i tested with "Insert X-Forwarded-For" enabled on the HTTP profile and sending a request which already has a X-Forwarded-For header. in that case the BIG-IP nicely adds it's XFF header so there is two in the end.

if this is not the case with you then the iRule might be the issue. can you share that iRule here? perhaps satanize some stuff if it points back to your organization.

also if this works out like you want will depend on the financial package, as pointed out two (or more) XFF headers are allowed, but it will depend on the application to pick the first, last, ...

so still in my opinion there is little need to add the XFF header on the BIG-IP, but lets first see why you don't get two.