For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

draco's avatar
draco
Icon for Nimbostratus rankNimbostratus
May 10, 2017

SMTP server-real ip with snat

Dear All   I have a query, we are trying to loadbalance smtp server , will be doing snat .We need to see the real ip. so if we are using smtp profile, we wouldnt be able to get the real ip right? ...
application delivery
BIG-IP
LTM
Ryannnnnnnnn's avatar
Ryannnnnnnnn
Icon for Altocumulus rankAltocumulus
May 10, 2017

Unfortunately smtp doesn't support the xff header in the same sense as http does. You could try and do something fancy with the tcp payload, but ultimately it's probably easier to move the gateway for the network and remove snat.

 

Can i ask why you're unable to move the gateway?

 

draco's avatar
draco
Icon for Nimbostratus rankNimbostratus
May 10, 2017

Hey Ryan

 

But he is saying these steps as well

 

Updated 23-Jan-2007•Originally posted on 23-Jan-2007 by Brian DeKemper 0

Thanks for the info. I went the link you provided and for IIS, it gave me the following steps, but I'm still not getting the source IP passed to the webserver. Any ideas?

 

1: Enable X-Forwarded-For

(I was able to 'enable' the Insert Xforward For in the HTTP profile that I use)

To configure the BIG-IP system to insert the original client IP address in an X-Forwarded-For header, perform the following procedure:

Log in to the BIG-IP Configuration utility.

Click Local Traffic.

Click Profiles.

Click HTTP from the Services drop-down menu.

Click the Create button.

Type a name for the HTTP profile.

Check the checkbox next to Insert XForwarded For.

A drop-down menu appears.

Select Enabled from the drop-down menu.

Click Finished.

 

2: Download the ISAPI Filter and install on IIS webserver

(I was able to download this and I am using the ISAPI filter in the top-level 'RELEASE' folder when I add it to my IIS website. Let me know if I need to use a different ISAPI filter for my Windows 2003, 32-Bit webserver.)

 

You can configure the IIS web server to extract the IP address from the X-Forwarded-For header and log the IP address to the web server log file. To do so, you will need to download and install the IIS X-Forwarded-For ISAPI Log Filter from https://cdn.f5.com/websites/devcentral.f5.com/downloads/F5XForwardedFor.zip.

The IIS ISAPI filter will look for the X-Forwarded-For header in the HTTP request. If the IIS ISAPI filter finds an X-Forwarded-For header in the HTTP request, it will replace the client IP address in the W3SVC log traces with the value of the X-Forwarded-For header.

To download and install the IIS X-Forwarded-For ISAPI Log Filter, perform the following procedure:

Log on to

http://devcentral.f5.com

.

Select iControl Code Share from the Downloads menu.

Download the IIS Proxy X-Forwarded-For Log Filter.

To install the ISAPI filter, add it to your IIS Web Site using the IIS administrative utility.

 

3: Configure iRule

(the IP wasn't showing up in my IIS logs after the first two steps above, so I also setup this iRule for my virtual servers)

 

iRule

To configure the BIG-IP system to insert the original client IP address in a header using an iRule, perform the following procedure:

Log in to the BIG-IP Configuration utility.

Click Local Traffic.

Click iRules.

Click the Create button.

Type a name in the Name field.

Copy and paste the following iRule in the Definition field:

 

when HTTP_REQUEST {

HTTP::header insert ORIG_CLIENT_IP [IP::remote_addr]

}

 

Is this possible?