Persistence on X-Forwarded-For or Source IP

Question

Hi,&nbsp;
I've got a request to make a persitence across two virtual servers but on different parameters... &nbsp;
The two virtual servers uses the same pool. &nbsp;
The client connects first on vserver1 through a proxy, where X-Forwarded-For is inserted in the HTTP header. Then the client connects to a second vserver, vserver2, without proxy. He must go to the same server as for the first request.&nbsp;
I've tried the following iRule but it doesn't seem to work...&nbsp;
 &nbsp;
when HTTP_REQUEST { &nbsp;
    if {[HTTP::header X-Forwarded-For] != ""} then {  &nbsp;
       persist uie [HTTP::header X-Forwarded-For] 900 &nbsp;
    } else {&nbsp;
       persist uie [IP::client_addr] 900 &nbsp;
    } &nbsp;
 }&nbsp;
 &nbsp;
Any idea on how to achieve this?&nbsp;
 &nbsp;
Regards,&nbsp;
Christophe&nbsp;

nitass · Answer

you enabled match across virtual servers, didn't you? 
&nbsp;  
&nbsp; sol5837: Match Across options for session persistence 
&nbsp; http://support.f5.com/kb/en-us/solutions/public/5000/800/sol5837.html

christophe_lem2 · Answer

It works like a charm, I forgot to enable the Match Across Virtual Servers in my persitence profile...

lester_w__54354 · Answer

This is good EXCEPT if the X-Forwarded-For is a comma-separated list and the intermediate proxies vary.  Consider the following:
REQUEST 1:   X-Forwarded-For:    101.202.11.15, 10.2.5.7
REQUEST 2:   X-Forwarded-For:    101.202.11.15, 10.2.5,18

The iRule shown above will treat request 2 as different.  Any ideas on how to ensure only the 1st IP address in the list is used?

christophe_lem2 · Answer

You may try to replace

persist uie [HTTP::header X-Forwarded-For] 900

by something like this (not tested)
lassign [ split [HTTP::header X-Forwarded-For] "," ] srcIP
persist uie $srcIP 900

Forum Discussion

Persistence on X-Forwarded-For or Source IP

4 Replies

Recent Discussions

import live updates from version x to version y

Tenant image upgrade

iRule editor partition button does not work

F5Access | MacOS Sonoma

Overwriting or adding LTM SSL Traffic cert and key using iControlREST

Related Content

Extracting X-Forwarded-For in Node.js

iRule for AFM IP Intelligence security policy to work with HTTP XFF (X-Forwarded-For) headers

X-Forwarded-For HTTP Module For IIS7, Source Included!

Restricting Access to Virtual from client IP address in X-Forwarder-For HTTP header

Performance L4 VS - HTTPS [X-forwarded-for]