tracking user sessions when snatting

As skottieb suggested, using an XFF header is the typical way to track the original client IP address for HTTP requests through a device which performs source address translation to ensure symmetric routing. SOL4816 has some additional information on hwo to configure IIS and Apache to log the custom header (Click here). If you are using the XFF header for something other than reporting, you should consider removing any existing XFF headers in the request. You can do this by configuring the HTTP profile's 'Request Header Erase' field with X-Forwarded-For.

 

 

Aaron