【MVS】F5 BIG-IP LTM HTTP XFF頭插入配置說明

【MVS】F5 BIG-IP LTM HTTP XFF頭插入配置說明

F5 BIG-IP LTM虛服務配置SNAT時，客戶端真實的源地址轉換為F5設備上配置的地址，導致後端服務器無法獲取真實的客戶端地址，無法滿足溯源等安全側要求。可以在HTTP請求報文頭中插入X-Forwarded-For字段來實現溯源功能，具體操作如下。

Enable the Insert X-Forwarded-For option in the HTTP profile

To configure the BIG-IP system to insert the original client IP address in an X-Forwarded-For HTTP header, perform the following procedure:

1. Log in to the Configuration utility.
2. Go to Local Traffic > Profiles.
3. For Services, select HTTP.
4. Select Create.
5. Enter a name for the HTTP profile.
6. Select the Insert X-Forwarded-For check box.

   Note: Older versions of BIG-IP software may display the option as Insert XForwarded For instead of Insert X-Forwarded-For.

7. For Insert X-Forwarded-For, select Enabled.
8. Select Finished.

   You must now associate the new HTTP profile with the virtual server.

   

實際操作效果如下：

• 地址轉換前

• SNAT地址轉換後