Forum Discussion

Jay_Nelson's avatar
Jay_Nelson
Icon for Nimbostratus rankNimbostratus
May 07, 2017

Can we identify the original src address of a packet after snat automap ????

We have a Perf l4 vip so it seems we can't use xff to identify the original source ip ?? Is there any other way such as connection tables etc to identify the src ?? The issue is our client had an issue with some devices doing logins with bad passwords thus locking everyone out and the src address appeared as our floating ip due to SNAT, so they want us to be able to identify the original src versus the snat ip ?

 

devops
LTM

1 Reply

Sort By
  • kohli9harjeev's avatar
    kohli9harjeev
    Icon for Nimbostratus rankNimbostratus
    May 07, 2017

    Hi,

     

    If you need the IP only,then you use the following irule and forward the logs to any SIEM server for historical data if you want to keep it

     

    when CLIENT_ACCEPTED {

     

    log local0. "IP: [IP::client_addr] accessed the application"

     

    }

     

    Regards