Forum Discussion

joao_beca_32859's avatar
joao_beca_32859
Icon for Nimbostratus rankNimbostratus
Dec 03, 2018

iRule TCP ip source

Hello guys, I have my switches on the LAN configured to send the syslog messages to the VIP (via tcp on port 51514 for example) which in turn send the messages to a pool member (syslog server). My pr...
application delivery
iRules
LTM
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
Dec 03, 2018

Hi,

 

Did you try to disable snat? and switch to UDP instead TCP.

 

because syslog UDP is stateless and don't need 3 way handshake...

 

I have already encountered this type of problem, and I just added Switch source IP in TCP Syslog datagram. Then in my SIEM I retrieve this IP as source IP.

 

hope it help you.

 

regards