Forum Discussion

johnkrum_45755's avatar
johnkrum_45755
Icon for Nimbostratus rankNimbostratus
Mar 20, 2013

Check to see if XFF is present, if so don't insert XFF

External users hit a dns entry on a Netscaler in our dmz. That device inserts the XFF and then passes (pass through mode) the data to an F5 internal to our network. What we are looking to do is if the XFF header is present, don't over write it.

 

In the case of a connection from outside of the trusted network the XFF header is always the address of the Netscaler passing the connection to the internal F5.

 

In the case of interanal connections we are looking to have the XFF header inserted as the connection will hit the F5 vip.

 

So if the internal F5 sees the xFF header inserted by the Netscaler, pass that along as it is so the source of the netscaler doesn't replace the correct on. If there is no XFF the connection is assumed to be internal and the correct XFF header needs to be inserted.

 

 

Thanks

 

JohnKrum

 

application delivery
dev
devops
iRules

4 Replies

Sort By
  • t-roy's avatar
    t-roy
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2013
    when HTTP_REQUEST {

     

    insert XFF if it doesn't exist

     

    if {not [HTTP::header exists "X-Forwarded-For"]} {

     

    HTTP::header insert X-Forwarded-For [IP::client_addr]

     

    }

     

    }
  • johnkrum_45755's avatar
    johnkrum_45755
    Icon for Nimbostratus rankNimbostratus
    Mar 25, 2013
    I was able to test

     

     

    when HTTP_REQUEST {

     

    insert XFF if it doesn't exist

     

    if {not [HTTP::header exists "X-Forwarded-For"]} {

     

    HTTP::header insert X-Forwarded-For [IP::client_addr]

     

    }

     

    }

     

     

    today and if I look at the cookie I see both IP addresses inserted. 198.177.94.250 and 10.129.14.248

     

     

    auroraSSO=266391041180ICONNECTEMPHAGA BILLY https://caregiverconnect.aurora.org198.177.94.250, 10.129.14.2481364235987888AdqO34nrlPBoHQNreOq+OepatfI=

     

     

    Any adjustments that I can make to have get this to work?

     

    To be more clear -

     

    1) if the connection is internal to our network the request goes directly to the F5 vip and XFF is inserted

     

    2) if the connection is external to our network the request hits a Netscaler which inserts the XFF and the connection is passed on to the F5 VIP

     

    The iRule should see the XFF and not over write or insert a new one.

     

     

    Thanks

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Mar 26, 2013

    Sorry but can you clarify the issue please? You mention you are looking at a cookie, I'm not sure what this has to do with XFF HTTP Headers. How are you checking whether the header is inserted or not? Can you confirm the name and case of the header the Netscaler is inserting?

     

  • johnkrum_45755's avatar
    johnkrum_45755
    Icon for Nimbostratus rankNimbostratus
    Mar 26, 2013
    Steve,

     

    Your right, that is inserted in the get. I have a question asking how the developers are pulling that address to build the cookie I displayed above. I could get a packet capture if need be. I will keep you posted.

     

    Thanks,