For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bilal_9919's avatar
Bilal_9919
Icon for Nimbostratus rankNimbostratus
Dec 03, 2011

iRule to change Destination IP

Hello Team,     I am using clone pool to duplicate the syslog packets to syslog-ng. I see packets been duplicated on F5 and forwarded to host on clone pool by wiresharking on syslog-ng and also ...
application delivery
dev
devops
iRules
nitass's avatar
nitass
Icon for Employee rankEmployee
Dec 21, 2011
these are tcpdump and stream content of 2nd syslog server (irule). hostname in message shows client hostname (ve1100). you know since it is in payload, it is not changed by address translation. 172.28.19.80 is f5 selfip. i am not aware of how to change source ip in the ip header.

 

 

so, would it be possible to configure your syslog server to use ip or hostname in syslog message instead of ip in ip header when correlation?

 

 

tcpdump:

 

192011-12-21 14:37:10.05834822.018464172.28.19.80192.168.206.42Syslog223LOCAL0.NOTICE: Dec 20 22:36:24 ve1100 notice tmsh[10730]: 01420002:5: AUDIT - pid=10730 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=list sys db ucs.loadtime one-line\n

 

 

stream content:

 

<133>Dec 20 22:36:24 ve1100 notice tmsh[10730]: 01420002:5: AUDIT - pid=10730 user=root folder=/Common module=(tmos) status=[Command OK] cmd_data=list sys db ucs.loadtime one-line