Query on source IP preservation for syslog traffic through F5 virtual server

Hi All,

We have an F5 virtual server that load balances Syslog traffic (UDP/514) to multiple log collectors.

We are considering enabling SNAT Automap on the virtual server, but we still need the Splunk collectors to see the original source IP address of the devices sending the logs.

Since this is UDP Syslog traffic and not HTTP/HTTPS, X-Forwarded-For is not an option.

Has anyone implemented a solution where SNAT is enabled on F5 but the backend SIEM servers can still identify the actual client IP? Any suggestions or best practices would be appreciated.

Thanks.