Forum Discussion

JosephT's avatar
JosephT
Icon for Nimbostratus rankNimbostratus
Feb 02, 2008

iRule to preserve client IP address?

Our developers want to put an app (AD4J) behind our load balancers. Our load balancers are single arm'd and we use SNAT automap on the VIP. The AD4J server needs to see the client source IP for it's function, but is seeing the load balancers' IP instead, as expected. And unfortunately, we can't have the servers use the load balancer as their gateway to solve this.

 

 

I've done a lot of searches, but all point back to using x-forwarded for. However, that solution, from what I understand applies to logging. In our case, the AD4J server isn't working with log files. From what I understand, it gets the client ip address through the TCP connection instead of the http header.

 

 

The closest cases I could find to our situation were these:

 

http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&postid=12195

 

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=25&postid=20038&view=topic

 

 

Appreciate any advice.
application delivery
dev
devops
iRules

3 Replies

Sort By
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Feb 18, 2008
    Hi Jtani,

    I had the same request from my client. The following is what I did, which are noted in the links you had above

    
when HTTP_REQUEST {
  HTTP::header insert CLIENT_ADDRESS [IP::client_addr]
}

    The application server simply pulled the information out of the header and was able to determine who the client was.

  • Nicolas_Menant's avatar
    Nicolas_Menant
    Icon for Employee rankEmployee
    Feb 20, 2008
    Then it's not going to be possible with an iRules.

     

     

    You'll need to check in your architecture for workaround like making the BIGIP the default gateway of your servers, etc...
  • David_Homoney's avatar
    David_Homoney
    Icon for Nimbostratus rankNimbostratus
    Feb 20, 2008
    jtani,

     

     

    There is nothing iRules can do to fix this problem. The reason is that in a single armed configuration you need to ensure that the return traffic gets back to the client via the same path. To do this we SNAT and that will change the client IP address at OSI Layer 3. The only two options left for you to do would be to change your architecture so that you are in routed mode or too configure using nPath. You can see more about nPath in the following link.

     

     

    Click here