Forum Discussion

Kirkulees007_29's avatar
Kirkulees007_29
Icon for Nimbostratus rankNimbostratus
Apr 06, 2018

Logging SNAT connections in Irule

Hello,

 

I need some help on how to log the client actual source ip address and the address they are being SNAT'd to in the below Irule. Any help appreciated.

 

when CLIENT_ACCEPTED { if {[class match [IP::client_addr] equals InternalSubnets] }{ snatpool Snat1 } else { snatpool Snat2 } }

 

Thanks!

 

iRules
LTM
security

1 Reply

Sort By
  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for MVP rankMVP
    Apr 07, 2018

    Something like this, used local_addr to capture snat details.

    when CLIENT_ACCEPTED { 
if {[class match [IP::client_addr] equals InternalSubnets] }{ 
snatpool Snat1
log local0. "Client: [IP::client_addr] equals InternalSubnets, snatpool [IP::local_addr] "
} else { 
snatpool Snat2
log local0. "Client: [IP::client_addr] not part of InternalSubnets, snatpool [IP::local_addr] "
} }