How NSX for vSphere handles a packet that already contains an X-Forwarded-For (XFF) header

Products

• VMware NSX

Issue/Introduction

To describe how NSX for vSphere handles packets that already contains an X-Forwarded-For header with an IP address.

Resolution

NSX-v Load Balancers can be configured to add the original client IP address in an X-Forwarded-For (XFF) HTTP header field. In case the packet received by the Load Balancer from the client already contains an XFF header with an IP address, then the NSX-v Load Balancer will simply append the new IP to the header. a Pre-existing IP may be coming from an upstream load balancer or a content proxy.

NOTE: The backend web server must be configured to handle multiple IP addresses in the XFF header.
As an additional note, NSX-v allows users to create an applicationRule to add any http header.
For example: http-request add-header x-forwarded-for %ci