Forum Discussion
Syslog virtual server
- Aug 18, 2025
Hello nurairtt91
To resolve your RPF issue, you'll need to enable SNAT on the F5 virtual server while preserving the original source IP within the syslog payload itself.
This requires your syslog collector to be capable of extracting the source IP from the message content rather than relying on packet headers.
The optimal solution would be configuring your devices to include their own IP addresses directly in the log messages.
However, if this isn't feasible, you can implement payload manipulation on the F5 using an iRule to inject the original source IP into each syslog message before forwarding to the collector.
You can try this irulewhen CLIENT_ACCEPTED { set original_source [IP::client_addr] } when CLIENT_DATA { TCP::collect } when SERVER_DATA { set syslog_data [TCP::payload] set modified_data "OriginalIP:$original_source $syslog_data" TCP::payload replace 0 [TCP::payload length] $modified_data TCP::release }
Hi Aswin_mk
You are right but as you mention only if it uses HTTP.
Will not work for classic syslog traffic
Yes, is the irule will be able to add the source ips in any tcp/udp traffic? (The communications when SNAT enabled for any of the tcp or udp traffic, did you try this in layer 4 traffic?
- Injeyan_KostasAug 18, 2025
Nacreous
The irule should be able to prepend "OriginalIP:$original_source" to original payload but for TCP traffic
So if syslog server isable to extract "OriginalIP" value should be okfor UDP is see there is already a similar topic Irule to insert source IP in UDP payload | DevCentral
- Aswin_mkAug 18, 2025
MVP
Thank you. Looks good
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com