Forum Discussion

joao_beca_32859's avatar
joao_beca_32859
Icon for Nimbostratus rankNimbostratus
Dec 03, 2018

iRule TCP ip source

Hello guys, I have my switches on the LAN configured to send the syslog messages to the VIP (via tcp on port 51514 for example) which in turn send the messages to a pool member (syslog server). My problem is the logs arrives on the server with the IP source from the VIP (as we use SNAT), and we can't know about the real switch that is triggering the logs. Question: To solve that do I need to configure an iRule? I've seen this iRule below discussed in some discussion, do you think it'll fix my issue?

 

when CLIENT_ACCEPTED { set client [IP::client_addr] }

 

application delivery
iRules
LTM

1 Reply

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Dec 03, 2018

    Hi,

     

    Did you try to disable snat? and switch to UDP instead TCP.

     

    because syslog UDP is stateless and don't need 3 way handshake...

     

    I have already encountered this type of problem, and I just added Switch source IP in TCP Syslog datagram. Then in my SIEM I retrieve this IP as source IP.

     

    hope it help you.

     

    regards