Chat now with support
Chat with Support

Foglight Experience Monitor 5.8.1 - Installation and Administration Guide

Installing and configuring Multi-appliance clusters Configuring the appliance Specifying monitored web traffic Transforming monitored URLs Managing applications Foglight components and the appliance Using the console program Troubleshooting the appliance Appendix: Third party software Appendix: Dell PowerEdge system appliance

Using X-Forwarded-For

Using X-Forwarded-For

The X-Forwarded-For (XFF) HTTP header is a method for identifying the originating IP address of a client connecting to a web server through an HTTP proxy.

Without the use of XFF or another similar technique, any connection through the proxy reveals only the originating IP address of the proxy server. This makes the detection and prevention of abusive accesses significantly harder than if the originating IP address was available.

You can use a product such as Big-IP to translate the source IP address of the incoming packet to the original client IP address or what is referred to as a Secure Network Address Translation (SNAT).

A SNAT provides a secure mechanism for translating internal, non-routable addresses into routable addresses. When the BIG-IP system translates the source IP address of the incoming packet to the SNAT address, the web server sees the request as originating from the SNAT address, not the original client IP address.

 
* 
NOTE: If the web servers are required to log the original client IP address for requests, the SNAT address translation behavior can become problematic.

To configure the BIG-IP system to insert the original client IP address in an X-Forwarded-For HTTP header, you can use one of the following methods:

•
Enable Insert XForwardedFor in the HTTP profile
•
iRule

For more information, see these topics:

•
Enabling the insert X-Forwarded-For in the HTTP profile
•
iRule
•
Configuring the web server to extract the IP address from the HTTP header

Enabling the insert X-Forwarded-For in the HTTP profile

Enabling the insert X-Forwarded-For in the HTTP profile

To configure the BIG-IP system to insert the original client IP address in an X-Forwarded-For HTTP header, perform the following procedure:

1
Log in to the BIG-IP Configuration utility.
2
Click Local Traffic.
3
Click Profiles.
4
Click HTTP from the Services list.
5
Click Create.
6
Type a name for the HTTP profile.
7
Select the Insert XForwarded For check box.
A list appears.
8
Select Enabled from the list.
9
Click Finished.
You must now associate the new HTTP profile with the virtual server.

iRule

To configure the BIG-IP system to insert the original client IP address in an X-Forwarded-For HTTP header using an iRule, perform the following procedure:

1
Log in to the BIG-IP Configuration utility.
2
Click Local Traffic.
3
Click iRules.
4
Click the Create.
5
Type a name in the Name field.
6
Copy and paste the following iRule in the Definition field:
when HTTP_REQUEST {
HTTP::header insert X-Forwarded-For [IP::remote_addr]
}
7
Click the Finished.
You must now associate the new iRule with the virtual server.

Configuring the web server to extract the IP address from the HTTP header

Once you have configured the BIG-IP system to insert the original client IP address in an HTTP header using an X-Forwarded-For HTTP header, you must also configure the web server to extract the IP address from the HTTP header, and log the IP address to the web server log file.

 
* 
IMPORTANT: For specific details about using HTTP header information in log files, see the documentation provided by the vendor for your specific web server.
Apache web server

You can configure an Apache™ web server to extract the IP address from the X-Forwarded-For HTTP header and log the IP address to the web server log file by adding the appropriate logging directives to the Apache httpd.conf file. For example:

LogFormat "%v %{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" X-Forwarded-For
CustomLog /var/log/apache/www.example.com-xforwarded.log X-Forwarded-For

For more information about Apache logging, see the Apache documentation.

Microsoft IIS web server

You can configure the Microsoft® IIS web server to extract the IP address from the X-Forwarded-For HTTP header and log the IP address to the web server log file. To do so, you will need to download and install the IIS X-Forwarded-For ISAPI Log Filter from http://devcentral.f5.com.

The IIS ISAPI filter will look for the X-Forwarded-For HTTP header in the HTTP request. If the IIS ISAPI filter finds an X-Forwarded-For HTTP header in the HTTP request, it will replace the client IP address in the W3SVC log traces with the value of the X-Forwarded-For HTTP header.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating