Load Balancing UDP 514 Syslog traffic

Try changing the Allow SNAT drop down on your pool config to

No

Brad, I tried that and it made no difference. Our SNAT would already be done before it even sends the syslog packet to the Pool Member. From everything I have read on DevCentral the only way I can make this work with our SNAT setup is by using an iRule.

Best solution would to get rid of the global SNAT. They are very limiting. Better off selecting SNATing as appropriate. However, try this. It may override your global SNAT and provide the orginal client IP to the backend if I follow the SNAT processing right.

when CLIENT_ACCEPTED {
    snat [IP::client_addr]
}

Thanks Brad, this did the trick

when CLIENT_ACCEPTED {  
     snat [IP::client_addr]  
}  

Actually I don't like the previous answers because they force you to use the F5 as the default gateway which forces you to waist precious packets per second pushing patches and management traffic through the F5. Not to mention the rules you would have to open for monitoring the back end servers since they would be using the F5 as the default gateway.

A better option would be for the F5 to replace the host field in the original syslog message with the source IP of the packet like Syslog-NG does. Another option would be for it to add text to the original syslog message text such as "Original IP=" like Kiwi Syslog does when it relays syslog messages to multiple servers for storage.

There are also custom options mentioned in the various how to's for standard unix/linux RSYSLOG but I have not dug into them just yet.

As you can tell we are also looking to perform this function using F5. I am just learning F5 coming from Cisco ACE. If I find that this feature exists I will try to update this tread.

As simple as this appears, I cannot successfully replicate the above. I've set up a standard VS and use UDP protocol. The traffic makes it to the backend servers, but the hostname presented to the servers is the loadbalancer's hostname and not that of the client. When using the irule as described, no messages are delivered to the syslog servers.

I have not found a solution but, this Irule will break Cisco ACI. It logs all the SNAT IPs and basically puts them in to the ARP database. Then ACI thinks that ever syslog source is in ACI. Then everything in ACI tries to send the traffic to the source IPs it will send it to the F5. Not sure how it works on other systems.

I had a similar issue today. I just disabled SNAT on the VIP, and that resolved the issue. It's UDP after all..If you're using 6514, this may not work for you.

I am actually still having this problem. Without the SNAT ACI is learning the sending hosts on the LTM ports in ACI causing the ACI database to refresh and marking the real one down. Trying to figure this one out.