Forum Discussion
ChadBigIP_14663
Nimbostratus
Aug 31, 2013AKAMAI True-Client-IP
I am having issues passing the True-Client-IP from AKAMAI.
They pass the end users IP via a variable called True-CLient-IP
Does anyone know an easy way to be able send the end users IP
to A...
nitass
Employee
Aug 31, 2013How would I do that?
e.g.
[root@ve11a:Active:Changes Pending] config tmsh list ltm virtual bar
ltm virtual bar {
destination 172.28.20.111:80
ip-protocol tcp
mask 255.255.255.255
pool foo
profiles {
tcp { }
}
rules {
myrule
}
source 0.0.0.0/0
source-address-translation {
type automap
}
vs-index 28
}
[root@ve11a:Active:Changes Pending] config tmsh list ltm pool foo
ltm pool foo {
members {
200.200.200.101:80 {
address 200.200.200.101
}
}
}
[root@ve11a:Active:Changes Pending] config tmsh list ltm rule myrule
ltm rule myrule {
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENT_DATA {
if { [TCP::payload] starts_with "GET" } {
set snat_cmd "snat [findstr [TCP::payload] "True-Client-IP" 16 \r\n]"
eval $snat_cmd
}
TCP::release
TCP::collect
}
}
packet trace i.e. source 172.28.20.17 is translated to 1.1.1.1 when sending to pool member/server 200.200.200.101
[root@ve11a:Active:Changes Pending] config ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.20.17(34623) <-> 172.28.20.111(80)
1377937424.0187 (0.0010) C>S
---------------------------------------------------------------
GET / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.20.111
Accept: */*
True-Client-IP: 1.1.1.1
---------------------------------------------------------------
New TCP connection 2: 1.1.1.1(34623) <-> 200.200.200.101(80)
1377937424.0216 (0.0028) C>S
---------------------------------------------------------------
GET / HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 172.28.20.111
Accept: */*
True-Client-IP: 1.1.1.1
---------------------------------------------------------------
anyway, i think using http profile is easier. alternative solution is what kevin suggested.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects