Which components use the IP resolved by Trusted Proxy (log, condition, WAF, Bot & DDoS Protection)?

Short answer

Trusted Proxy changes the client address when HTTP request processing begins; for this reason, all the components that run afterwards see the resolved IP: logs, conditions based on the client IP (Conditions), WAF, Bot & DDoS Protection (Bot Protection and CAPTCHA, source IP counters of L7 DDoS Protection such as Source IP Request Protection, and Country Control, IP Reputation Protection, Quarantine), Ip Log Masking and the X-Forwarded-For header added to the Backend Service. L4 DDoS Protection and Firewall, which work without reading the HTTP header, on the other hand, continue to see the CDN's IP (The components that use the resolved address).

Components

Component	Address it sees
HTTP Logs and the other vService logs (client address, location), reports	Resolved IP
Conditions based on the client IP	Resolved IP
WAF	Resolved IP
L7 DDoS Protection (Source IP Request / Connection / Error Protection, Country Control) and Quarantine	Resolved IP
Bot Protection and CAPTCHA, IP Reputation Protection	Resolved IP
Ip Log Masking action	Resolved IP (masking is applied on top of it)
X-Forwarded-For added to the Backend Service	Resolved IP
L4 DDoS Protection and firewall	CDN's IP (works without reading the HTTP header)
%PROXY_SRC Smart Variable (Connection Info - Real client IP (trusted proxy))	CDN's IP (the connection address before the resolution)

How Does It Work?

• In the first processing step of the request, TR7 stores the connection address separately, then, for connections coming from the trusted network, makes the address in the header the client address.
• All the subsequent steps that use the client address (conditions, WAF, Bot & DDoS Protection counters, logs) see this new address.
• The proxy address before the resolution is kept in the %PROXY_SRC Smart Variable and can be used in logs, reports and conditions; this variable is filled only when a profile is assigned. The resolved address of the client is in the Client IP Address (%SRCIP) variable (Connection Info).

Common Misconceptions

• "Firewall and L4 DDoS rules also see the real IP." These work without reading the HTTP header; they see the CDN's IP.
• "The Real client IP (trusted proxy) variable is the resolved address." This variable (%PROXY_SRC) carries the proxy address before the resolution; the resolved address is in the Client IP Address (%SRCIP) variable.
• "It also works on L7 TCP and Network vServices." The Trusted proxy field exists only in the HTTP vService form.

How it is done in the documentation

• Trusted Proxy · The Components That Use the Resolved Address
• Trusted Proxy · Supported vService Types
• Smart Variables · Connection info

Related questions

• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?
• What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?
• How do I see the real client IP on the backend?