Forum Discussion

Algebraic_Mirror's avatar
Algebraic_Mirror
Icon for Cirrostratus rankCirrostratus
Apr 09, 2018

How can I get the X-Forwarded-For IP to show up in APM Reports?

What is the best way to get the X-Forwarded-For address of a client to show up in APM reports? For example, in v13.1, if you go to Access -> Overview -> Reports, and choose a 1 hour time period, it shows you all the sessions from the last hour. One of the columns is "Client IP" address, and right now the same IP is logged for clients because they are going through an edge device that uses SNAT. That is where I'd like to see the X-Forwarded-For IP.

 

It would also be great if it could be used as the client IP in the session variables, such as session.user.clientip, so that I consistently see that everywhere.

 

APM
application delivery
security

2 Replies

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 10, 2018

    Hello,

    First of insert X-Forwarder for in your Front Reverse Proxy.

    Then add the following Irule in your VS that host your apm policy:

    when HTTP_REQUEST { 
if {[HTTP::header exists X-Forwarded-For]}{
set userip [HTTP::header X-Forwarded-For]
ACCESS::session data set session.user.clientip $userip
}
}

    I don't test this irule, let me now if it's work for your. Regards

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 10, 2018

    Hello, You right we can optimise this Irule, try this:

    when HTTP_REQUEST {

if { [HTTP::cookie exists MRHSession] and [HTTP::cookie exists LastMRH_Session] } {
       set apm_cookie [HTTP::cookie MRHSession]
       if { (![ACCESS::session exists -sid $apm_cookie]) or ([ACCESS::session exists -sid $apm_cookie] and [ACCESS::session data get -sid $apm_cookie session.policy.result] == "in_progress" ) or ([ACCESS::session exists -sid $apm_cookie] and [ACCESS::session data get -sid $apm_cookie session.policy.result] == "not_started" ) } {

        if {[HTTP::header exists X-Forwarded-For]}{
            set userip [HTTP::header X-Forwarded-For]
            ACCESS::session data set session.user.clientip $userip
        }

       }
    }
}

    you can also test this irula by removing this condition:

    (![ACCESS::session exists -sid $apm_cookie])

    Let me now it it's work for you or if you need explanation about this irule

    regards