Forum Discussion

cymru81's avatar
cymru81
Icon for Altocumulus rankAltocumulus
Dec 17, 2019

XFF

We have enabled the option to include XFF ip in the header for a VS. We generate alerts from a pool member of one of the VS' that aid debugging etc. When the XFF address comes through, its in this format:

 

HTTP_X______________ = xxxxxxxxxxx, xxxxxxxxxxx

 

Anyone have any suggestions this has worked fine in the past!

4 Replies

  • M_2's avatar
    M_2
    Icon for Altocumulus rankAltocumulus

    After you enable XFF at LTM , you need to configure the backend web server to log it as per your required format. something like below in your web server config file

    LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

  • Agree with M@rk. For an IIS Web server back end you must first enable Advanced Logging in IIS. Then add the xff field to the log. You do that by editing the Advanced Logging fields in IIS and going to "Add field".

  •  Did you find a solution to this problem? Do you know if M@rk and aaperson:s solutions did work?

     

    I have the same issue and I did notice that the XFF-header only comes out as "HTTP_X______________ = xxxxxxxxxxx, xxxxxxxxxxx" when set by the F5. If I manually send a request containing XFF-request header to the server (that does not go via the loadbalancer) the header key/value turns out just fine.

     

    To me it seems like this behavior is due to some settings in F5 and not IIS. Unfortunately I do not know whats causing this yet.

  • I did not manage to unfortunately. Be interested if M@rk solution works for you or if you can find a way though!