on 12-Feb-2023 05:00
With day-to-day enhancements in security architecture, a request initiated at the source point traverses through multiple hops before it reaches the destination point. By design, if a request passes through any CDN/ Proxy that is present between the real client and the load balancer, we will no longer see the client’s IP address as the source address in the Load Balancer but the CDN/Proxy IP instead. Identification of real Client IP address is sometimes necessary for monitoring, logging, defining allow/deny policies and other purposes.
“Trusted Client IP Header” feature of F5 Distributed Cloud platform solves the above concern and provides the ability to identify the real client IP address that initiated the connection. Security events and request logs will show this real client IP address as the source IP, when this feature is enabled. Trusted Client IP Header feature in F5 Distributed Cloud platform allows the admin to configure Client IP Headers. The admin can define a list of one or more Client IP Headers as Trusted headers.
Below are some key points to be considered while configuring headers list:
Below video provies brief introduction to Trusted Client IP Headers feature:
In this demonstration, we will see how to identify the real client IP address using “Trusted Client IP headers” option in F5 Distributed Cloud platform.
We are using
As shown in the below demo architecture, the request initiated at the client initially reaches to the available F5 CDN server and then the request from CDN hits the load balancer. Load balancer validates the request for configured headers availability, identifies the true client IP address and displays it rather than the CDN IP. The request from load balancer finally hits the backend application.
Here we are using F5 XC CDN between the client and the load balancer. CDN is a server that is used to serve web content quickly. CDN servers are distributed globally, and the main aim is to reduce latency and delay in end-to-end communication and thereby increases the efficiency. Check references for more exploration links.
Note: F5 CDN has provided a dedicated header called “X-F5-True-Client-Ip” to extract the real client address. Customers who are using F5 CDN can use this header to identify the client IP address. Similarly, customer can configure any headers or custom headers to identify the client IP.
As you can see from the above demonstration, with Trusted Client IP Headers option enabled in F5 Distributed Cloud platform, the request logs and security events are getting logged with the real client IP address as the source IP rather than the CDN IP.