What’s the best way to handle persistence when doing a double hop dmz where frontend vips talk to another netscaler vip for their backend? The backend virtual server can’t use source IP because that’s always going to be the SNIP of the frontend.

It's tricky and I couldn't find a good answer to this one. I had to remove the double hop in this case. It was for Storefront actually.

I was thinking maybe x-forwarded-for

Yes and after you use a Token method, it could work. Let me know that's nice.