Forum Discussion

DB's avatar
DB
Icon for Nimbostratus rankNimbostratus
May 29, 2009

X-Forwarded For equivelent for SMTP?

I'm running SMTP through LTM to Exchange 2008 servers, but due to my network architecture I have to autosnat the source IP to that of the F5. My Exchange servers therefore lose visibility of the original IP address of the sender. If this were a Web service, I could use XForwarded for with an ISAPI filter to stick the original IP address into Web Server log files, and I'm wondering if anyone knows of a way to do an equivelent sort of thing for SMTP mail. Purpose is to try and catch the originator of specific emails when they arrive with malware/virus in them.

 

 

I've so far set up a Clone Pool sending the mail to a server that's not listening on port 25, then monitoring that traffic with an external Packet Capture "sniffer". Very cumbersome and difficult to manage/maintain. If there was a way I could deliver the original IP address to my Exchange servers, my email guys could worry about tracking IPs that sent worms, and get my Network team out of that business.

 

 

Thanks for any and all help.
config
design

5 Replies

Sort By
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Jun 03, 2009
    You could insert the IP in the optional comments field, assuming exchange can access it there.

     

     

    Comments: [IP::client_addr]

     

     

    Here are some links to get you started:

     

     

    SMTP Proxy Click here

     

    TCP::collect Click here

     

    TCP::payload Click here
  • slomah_85788's avatar
    slomah_85788
    Icon for Nimbostratus rankNimbostratus
    Jun 18, 2009
    hi citizen_elah,

     

     

    I am facing the same problem, can you explain more please,

     

     

    where I have to create Comments: [IP::client_addr],

     

     

    I appreciate your support,

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 19, 2009
    Citizen_elah was suggesting you could collect the TCP payload and then modify it to insert a custom header (like Comments or X-someheader-name) which contains the original client IP address. You'd need to be wary of collecting more than 4Mb of data though. And this would still require the mail server to actually do something with the custom header. It would probably be a lot easier to change the default gateway on the mail server to the BIG-IP...

     

     

    SOL6578: TMM will crash if an iRule collects more than 4MB of data

     

    https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6578.html

     

     

    If you're on 9.2.5+, you could potentially do this using a stream profile and STREAM::expression iRule (Click here).

     

     

    SOL6741: Large payloads with use of the Stream profile cause the BIG-IP LTM system to crash (fixed in 9.2.5)

     

    https://support.f5.com/kb/en-us/solutions/public/6000/700/sol6741.html

     

     

    Aaron
  • slomah_85788's avatar
    slomah_85788
    Icon for Nimbostratus rankNimbostratus
    Jun 19, 2009
    Thanks hoolio,

     

    It looks like that I have to change to the default gateway on the mail server to the BIG-IP, or I'll try either npath or vlan group.
    • The-messenger's avatar
      The-messenger
      Icon for Cirrostratus rankCirrostratus
      Mar 02, 2017

      I'm still pretty new to Big-IP, only a year or so but I've worked in the messaging world for many years. This issue of getting the original client ip is not new to the messaging world but for many reasons setting the f5 as the default gateway is not a good solution.

       

      • the source ip is needed in the message tracking logs but the ip of the f5 device is also needed in the logs. If your logs show inaccurate information you could have trouble with email discoveries. Messaging logs should show both the f5 and the sending server address.

      We really need an x-header value! SMTP is capable of working with x-header values, every filtering system out there uses x-headers to react to messages, log messages and more. A stream rule could be the answer.