Forum Discussion

Arun_LK_202176's avatar
Arun_LK_202176
Icon for Nimbostratus rankNimbostratus
May 23, 2018

Capturing the Client Ip address through F5 in AUTO SNAT

This is the Irule.The rule works good for 80.But for ssl we dont get the url. The page is going down. both on pass thru/ ssl offload method in standard.

 

when CLIENT_ACCEPTED { set proxyheader "PROXY TCP[IP::version] [IP::remote_addr] [IP::local_addr] [TCP::remote_port] [TCP::local_port]\r\n" }

 

when SERVERSSL_HANDSHAKE { SSL::respond $proxyheader }

 

1 Reply

  • Arun you might want to create some more detailed questions in the future. not everyone is going to check all your questions to combine the different pieces of the puzzle.

     

    so you started here: https://devcentral.f5.com/codeshare/proxy-protocol-initiator

     

    you state the normal irule works for a HTTP (tcp/80) virtual server, does that mean your backend server accepts the Proxy header?

     

    where do you see the Client IP with that iRule, i assume on the backend server?

     

    you also mention FTP, how is that related?

     

    then a HTTPS virtual server, you mention offload and pass through, what exactly do you mean with those?

     

    offload to me means SSL on client side, no SSL on server side. which would mean you don't need another iRule, the original one from the link should work. notice the different the one sends extra information on regular TCP the server, so fine for HTTP traffic to the pool member. the other sends the extra information within a SSL session, that requires HTTPS traffic to the pool member.

     

    pass through can mean not SSL profiles at all, in that case the iRule can't do anything, it will probably not be attachable.

     

    pass through can mean both client side and server side SSL profiles. in that case the iRule provided to you by Chad Jenison works for me. well as far as i can tell, my test server doesn't support the proxy header so i can just check if sends the data infront of the HTTP request, which it does.

     

    also if you just need the client IP, have you looked in the X-Forwarded-For header? https://support.f5.com/csp/article/K4816

     

    have you checked /var/log/ltm for any tcl / irule errors?