Just came across this when troubleshooting CWA client detection. If you have configured storefront load balancing behind a CSW on the same VPX as the gateway - it looks like the VPX uses the CSW IP (and not the storefront fqdn) for the internal routing of the gateway --> CSW --> VIP traffic. Which means that doing something like this is in the CSW policy is not a good idea if you want client detection to work: HTTP.REQ.HOSTNAME.EQ("sf.company.com") Confirmed to be working if I put the SF VIP as the default load balancing server on the CSW, or create a new csw policy: CLIENT.IP.DST.EQ(ip_of_csw). Have yet to find a solution for when you have multiple SF-VIPs behind the same CSW.