In settings.php I've done the following:
/* Turn on reverse proxy */
$settings['reverse_proxy'] = TRUE;
/* Set reverse proxy (load balancer) address */
$settings['reverse_proxy_addresses'] = ['172.17.21.5']; //test-bnc4-web1
/* Enabled trusted headers */
$settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;
I'm still not getting the correct client IP in the log when a user fails to login because of an invalid username. It is reporting the second IP address in $_SERVER['X_FORWARDED_FOR'] where $_SERVER['X_FORWARDED_FOR'] = '167.160.79.230, 149.32.195.197' The first IP is the correct one. The second is a switch.
This is important if an IP gets blocked.