Client IP, SNAT and XFF

How the real client IP is carried to the Backend Service and what needs attention while doing this.

• Why do my backend servers see all requests as coming from TR7's IP?LB-09-001
• What is SNAT, and why is it used by default?LB-09-002
• How do I see the real client IP on the backend?LB-09-003
• How is X-Forwarded-For enabled; what do I need to do on the backend side (Apache / Nginx / IIS logs)?LB-09-004
• What is the difference between X-Forwarded-For and Proxy Protocol?LB-09-005
• How do I pass the real client IP for non-HTTP TCP services?LB-09-006
• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?LB-09-007
• What is the difference between the "Real IP from" options in the Trusted Proxy profile (X-Forwarded-For (last / most trusted), X-Forwarded-For (first), Custom Header)?LB-09-008
• Do TR7 and the backends have to be on the same L2 network?LB-09-009
• What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?LB-09-010
• Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?LB-09-011
• Is it possible to work without SNAT (transparent mode); what are the requirements?LB-09-012
• What is Direct Server Return (DSR); what preparation is needed on the server side?LB-09-013
• Why does return traffic have to flow through TR7 in Route Mode?LB-09-014
• Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?LB-09-015
• What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?LB-09-016