For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_L1's avatar
Dan_L1
Icon for Nimbostratus rankNimbostratus
Mar 16, 2014

F5 LTM+AVR

Hello,

 

I'm trying to figure out if it's possible to collect source IP addresses (client's connections) via F5 AVR provisioned with LTM. GTM is running on a separate device. So far I haven't been able to find how to do it, even after checking the box for client ip addresses (in avr settings), etc.

 

Anyone familiar/have an idea? I couldn't find much on devcentral or Google for it.

 

Thanks!

 

application delivery
application visibility and reporting
avr
deployment
LTM

3 Replies

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Mar 18, 2014

    Dan,

     

    If in Collected Entities you've selected Client IP Addresses it means that in Statistics - Analytics - Transactions (as an example), then you can filter on a Client IP address here as the information is known by Analytics.

     

    If you want to "collect" IP addresses then I think the only way is to configure Traffic Capturing in the AVR profile. Then you'll see the IP addresses in System - Logs - Captured Transactions log. However, you can't export this data so you'd need to configure the profile to log to an external Syslog server, for example.

     

    Anyway, this is what i know about AVR, hope it's correct.

     

    N

     

  • Dan_L1's avatar
    Dan_L1
    Icon for Nimbostratus rankNimbostratus
    Mar 16, 2014
    Yes it is attached, it is gathering stats, etc. I just don't see where I can see raw source IP addresses that are connecting to the VIP, no charts related to it etc. This is on 11.4.1 HF2.
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Mar 16, 2014
    just to be sure, you did attach the AVR profile to the virtual server? which TMOS version are you on?