Forum Discussion

jba3126's avatar
jba3126
Icon for Cirrostratus rankCirrostratus
Apr 10, 2015

How to preserve existing X-Forward-For Header when using SNAT

First question is does SNAT alter an existing X-Forward-For header?

 

We have a web service that goes DMZ LTM -> XML Security Device -> PBN LTM /with SNAT. The application has IP based role restrictions and is failing. I believe this is happening because either the SNAT in the PBN is re-writing the X-Forward-For header or the application is not properly reading the X-Forward-For header. Many thanks in advance for your help in answering!

 

/Jeff

 

application delivery
LTM
microsoft
snat
x-forwarded-for

3 Replies

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2015

    Jeff, SNAT doesn't modify that. Unless you have HTTP profile with "Insert X-Forwarded-For" enabled or an iRule which does it.

    You can log what is send out of the BigIP by attaching iRule to the virtual server

    when HTTP_REQUEST_SEND {
  clientside {
        foreach x [HTTP::header names] {
           log local0. "Request header($x) = [HTTP::header $x]"
        }
    }
}
  • M_2's avatar
    M_2
    Icon for Altocumulus rankAltocumulus
    Apr 11, 2015

    First question is does SNAT alter an existing X-Forward-For header?

     

    I have seen a setup like below where snat was altering client address.

     

    Client > l4 ltm (snat2vip) > l7 ltm (xff cconfigured) > server

     

    In the above case untill i remove snat in l4 my server was unable to see client address.

     

    -sam

     

  • Antony2015's avatar
    Antony2015
    Icon for Altostratus rankAltostratus
    Apr 13, 2015

    Jeff,

     

    Plz try to apply the below irule in PBN LTM /with SNAT and let me know the result.

     

    rule X-Forwarded-For { when HTTP_REQUEST { if {[HTTP::header exists X-Forwarded-For]}{ HTTP::header replace X-Forwarded-For "[HTTP::header X-Forwarded-For], [IP::client_addr]" } else {

     

    HTTP::header insert X-Forwarded-For [IP::client_addr] } }