Forum Discussion

Ahmed_Galal's avatar
Ahmed_Galal
Icon for Cirrostratus rankCirrostratus
Oct 07, 2019

Splunk syslog loadbalancing

Hi All,

 

i have 2 Splunk Syslog server using UDP 514, splunk configure incoming logs upon source ip address so when i configured to load balance servers through F5 with automap it created one log file for all devices is there any solution can do X-Forward for UDP traffic in F5.

application delivery
BIG-IP
LTM
  • iaine's avatar
    iaine
    Oct 07, 2019

    Hi

     

    As syslog is fire and forget in nature, you probably don't need to use SNAT as there is no need for a return path. Try disabling SNAT on your VIP in the first instance.

  • iaine's avatar
    iaine
    Icon for Nacreous rankNacreous
    Oct 07, 2019

    Hi

     

    As syslog is fire and forget in nature, you probably don't need to use SNAT as there is no need for a return path. Try disabling SNAT on your VIP in the first instance.

    • Ahmed_Galal's avatar
      Ahmed_Galal
      Icon for Cirrostratus rankCirrostratus
      Oct 08, 2019

      i configure it without SNAT but am facing issue now that firewall detecting that traffic connecting from diffrant zone do you have anything in mind ??