Allowing source IPs to be visible behind a BIG-IP

Hi,

Do you know how the orginating ip address was previously being seen?
What i think you are stuggling with here is the SNAT, from the f5 being a full proxy.

Doing what the support engineer suggests will mean that the return traffic will always be from the pool members not the f5 which will mean you network and applications will have to be able to cope with that. (not always easy, and secruity wise that has issues)

You've said this was a tcp Virtual Server, now is this actually a HTTP application? (so you could turn the http profile on?)
What you could do / or may have been done in the past is that the application on the aplication servers is looking for the X Forword For parameter, this is added to the HTTP header as it leaves the f5 with the orginating IP that came into the f5. You need to turn on the http profile, and inside the profile there is a tick box to turn it on.

That's the simplest method to achieve what you are looking for, there are other solutions like proxy protocol but that would need the backend applciation to support it as well and as you are just in a replacement process i doubt that's been there,

I would try to find out how its been monitored in the past and try to work back, i'd be amazed if the f5 can't reproduce it.

Hello,

You can do as stated by the support engineer.

Also, to resolve the connectivity of outside devices ,you can configure a forwarding IP virtual server for communication of internal servers to outside.

Thanks,

The support engineer is correct. However that assumes that the BigIP will actually act as the default gateway.

You have several choices

• Insert host routes to the BigIP for the clients instead of default gateway
• Use policy routing and only route traffic to the clients FROM tyhe service port via the BigIP
• Actually turn the BigIP into your default gateway

That's assuming you're not picking up the original IP via X-Forwarded-For headers or something that you haven't enabled.