Forum Discussion

Dicky_Moe_13167's avatar
Dicky_Moe_13167
Icon for Nimbostratus rankNimbostratus
Aug 15, 2013

Clien IP address / NAT

Hi Guys!   We have a Citrix Gateway server sitting behind an LTM, and we would like to have the capability of knowing which is the client IP. The problem is that LTM is doing a NAT and the GW serv...
application delivery
devops
iRules
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Aug 15, 2013

Assuming you mean SNAT, this would be a pretty big undertaking to insert the client's true source into an ICA packet. Not impossible, but then you also have to consider how you'd extract it on the ICA server side. Could you:

 

  1. Capture and log the client IP at the Web Interface (via HTTP XFF header)?
  2. Capture and log the client IP (and activity) to syslog?
  3. Deploy Access Policy Manager (APM) and maybe push the client IP to Citrix via Smart Access filters?

Otherwise, to keep the client IP at layer 3 and remove the SNAT, you must guarantee that the Citrix servers cannot route around the BIG-IP.