For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Joe_Fontes_4518's avatar
Joe_Fontes_4518
Icon for Nimbostratus rankNimbostratus
Dec 07, 2006

Apache SSL Logs

I am trying to figure out how to get the correct source IP for the SSL request which has passed through the load balancer.   I wrote an iRule (got most of it from the iRule downloads section) that ...
application delivery
dev
devops
iRules
dennypayne's avatar
dennypayne
Icon for Employee rankEmployee
Dec 13, 2006
If your servers use the BIG-IP as their default gateway, you can preserve the original client IP by not SNAT'ing those connections at the BIG-IP (it preserves client IP by default). The IP header is not encrypted in SSL, so BIG-IP can still SNAT even with SSL connections. But if it is not possible for you to configure the network this way (without SNAT), then hoolio is correct, you will need to decrypt the SSL at the BIG-IP in order to be able to manipulate the data in the rest of the headers (ie, using an X-Forwarded-For header to include the original client IP).

 

 

Denny