Query on source IP preservation for syslog traffic through F5 virtual server

Hi yadvendra,

Setting the SNAT option to “none” may be helpful. Since UDP syslog is unidirectional, logs can usually reach the SIEM without SNAT, provided that the SIEM does not send a response.

Another option: If the devices sending logs include their own IP addresses in the log by adding them as the “source” parameter, this parameter can be evaluated during the parsing process on the SIEM side.