Forum Discussion
cymru81
Altocumulus
AltocumulusXFF
We have enabled the option to include XFF ip in the header for a VS. We generate alerts from a pool member of one of the VS' that aid debugging etc. When the XFF address comes through, its in this format:
HTTP_X______________ = xxxxxxxxxxx, xxxxxxxxxxx
Anyone have any suggestions this has worked fine in the past!
cymru81I did not manage to unfortunately. Be interested if M@rk solution works for you or if you can find a way though!
ohmyguardNimbostratus
Did you find a solution to this problem? Do you know if M@rk and aaperson:s solutions did work?
I have the same issue and I did notice that the XFF-header only comes out as "HTTP_X______________ = xxxxxxxxxxx, xxxxxxxxxxx" when set by the F5. If I manually send a request containing XFF-request header to the server (that does not go via the loadbalancer) the header key/value turns out just fine.
To me it seems like this behavior is due to some settings in F5 and not IIS. Unfortunately I do not know whats causing this yet.
aapersonCirrus
Agree with M@rk. For an IIS Web server back end you must first enable Advanced Logging in IIS. Then add the xff field to the log. You do that by editing the Advanced Logging fields in IIS and going to "Add field".
M_2After you enable XFF at LTM , you need to configure the backend web server to log it as per your required format. something like below in your web server config file
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined