For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jasonralph_4089's avatar
jasonralph_4089
Icon for Nimbostratus rankNimbostratus
Dec 08, 2009

Capture IP of Client Traffic

Hello,

 

I am searching for advise on how I can view the IP of the client that generates the http request. When I run apache server-status on our web servers I am seeing the F5 virtual IP which makes sense since the F5 is sending the traffic to the web server. Is there software that I can use, or a F5 feature that allows an admin to view the original client requests behind the F5?

 

 

Sorry if this is not descriptive enough. And this is my first post here so bear with me.

 

 

Jason
management
monitoring

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 08, 2009
    Hi Jason,

     

     

    You can enable the XFF option on a custom HTTP profile to log the original client IP LTM sees on Apache. Try searching AskF5.com or these forums for X-Forwarded-For for related info:

     

     

    SOL4816: Using the X-Forwarded-For HTTP header to preserve the original client IP address for traffic translated by a SNAT

     

    https://support.f5.com/kb/en-us/solutions/public/4000/800/sol4816.html

     

     

    Aaron
  • jasonralph_4089's avatar
    jasonralph_4089
    Icon for Nimbostratus rankNimbostratus
    Dec 08, 2009
    Thanks for the link. I will be sure to have a look and attempt to implement.

     

     

    Jason
  • appz_guy_5833's avatar
    appz_guy_5833
    Icon for Nimbostratus rankNimbostratus
    Jan 08, 2010
    We actually needed to do the same thing: get the client ip.

     

     

    However, we had a non-HTTP application - basically a custom TCP application. Therefore, we could not use the solution of adding something to the HTTP headers.

     

     

    We had to do the following in order to get the client ip address to our custom TCP application:

     

     

    1. Create a IP forwarding virtual server..you can use this link here to see the details of how: https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html -- you can do all of that configuration via the GUI.

     

     

    In the GUI you would go to "Local Traffic" -> "Virtual Servers" -> "Profiles"

     

    Click on "Protocol" -> "Fast L4"

     

    Create a new custom profile with the parent being "Fast L4"

     

    Make sure "Loose Initiation" is checked - you will need to make sure custom is checked.

     

    Make sure "Loose Close" is checked - you will need to make sure custom is checked.

     

     

    Create a new virtual server

     

    For the type pick "Forwarding (IP)"

     

    For the Destination click on "Network" and enter 0.0.0.0 for the address and 0.0.0.0 for the mask

     

    For the service port pick "All Ports"

     

    In the protocol profile, pick the custom "Fast L4" profile you created above.

     

     

     

    2. Set the default gateway of the web server (in our case, the application server) to point to the IP address of the BIG-IP.

     

     

    Once we did that we saw the client ip address correctly on our application server.