Forum Discussion

Nirmalraajan_26's avatar
Nirmalraajan_26
Icon for Nimbostratus rankNimbostratus
Apr 28, 2016

Log source IP address

Hi

 

We have a FTP and SFTP Server farm load-balanced by GTM and LTM appliances. since it is FTP (port 21) and SFTP (port 22), the clients/source that tries to connect to the Wide IP (gslb site) pass through the GTM and LTM (based on the load-balancing methods) ends up in any of the server nodes as designed.

 

However, since the LTM VIP is the one that connects to the Server nodes (within the pool), these End Server Nodes see the LTM VIP IP as the source IP and has no trace of the actual connecting source IP Addresses.

 

we did some research and it looks like the source IP can be traced/logged through the http headers for http traffic and not possible for FTP or SFTP Traffic.

 

Can someone please suggest any option where, 1. Either the Destination Servers can retrieve and log the Source IP Addresses 2. Or atleast if the LTM can log the Source IP address with Time stamps.

 

thank you in advance!

 

-- Nirmal

 

application delivery
BIG-IP
LTM
passive ftp
sftp
  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Apr 28, 2016

    Hello,

    You can log the client IP using an irule. For example : 

    when CLIENT_ACCEPTED {
  log local0. "[virtual] - client ip=[IP::client_addr]"
}

    You can add several info to the log if required