Bypass WAF for X-forwarder IP in XC

[vikas_Patil]

We use the F5 XC and want to bypass the WAF rules if traffic comming from specific IP address in X-forwarder-for field,

X-forwarder-for Field contail Multiple IP address and if any of the IP matches to the list , XC should bypass the WAF rules

E.g. Http header x-forwarded-for : 1.1.1.1; 2.2.2.2 , requirement is to bypass WAF Rule for the IP 1.1.1.1 

[Samir]

if you have list of known X-forwarder-for Source IP then create iRule and bypass WAF Policy. This can be possible.

[vikas_Patil]

Actually we want to do it on WAAP, and Irule option is not available

[Sudhir_Patamsetti]

@VikasB , You can use "trusted client rules" to "bypass WAF" . Navigate to http load balancer --> common security controls ---> trusted client rules 

[Nikoolayy1]

@vikas_Patil  did you manage to make this work?

Maybe to match a specific ip address when there are many in the HTTP XFF header you can use regex. To match a single IP address you can try the regex (1\.1\.1\.1)  where 1.1.1.1 is the IP address and soon I will publish an F5 community article about this as I played with the feature a little.

[Nikoolayy1 · Accepted solution]

Here is the article after I played with the features of the F5 XC:

https://community.f5.com/t5/community-articles/f5-xc-distributed-cloud-http-header-manipulations-and...

[Nikoolayy1]

As @Sudhir_Patamsetti mentioned there is this option that I have not used yet but it is interesting if it will work with multiple ip addreesses in the HTTP header. If the rule has the option to select something like "contains" in the value of a specific HTTP header then it shouldn't be an issue. If you see issues you may need to modify your proxy devices to also add another header that has just one ip address and use that in the Distributed Cloud XC rules.