For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JimW_156953's avatar
JimW_156953
Icon for Nimbostratus rankNimbostratus
Feb 08, 2017

traffic coming over APM XforwardedIP not being recorded by IIS

Environment :

 

  1. IIS windows host : Windows 2008R2 server
  2. f5 : 12.1
  3. Basic virtual server : http only - one server in the pool

Handling a strange issue. virtual server has x-forwarding http profile turned on. It records all x-forwarded IPs expect for the traffic originating from VPN clients who are getting i.e. 192.168.10.0 IP range.

 

Capture on the windows host clearly suggests that X-forwarded stamp is being passed through but IIS logs doesnt have any reference. IIS logs only records the selfIP of the f5 and not X-forwarded stamp. IIS logs configs are set to capture everything.

 

I tried installing f5 recommended isapi filter - no effect.

 

Any pointers will be appreciated.

 

application delivery
LTM

1 Reply

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 08, 2017

    Hi Jim,

    IIS has a very poor support for X-Forwarded-For headers... 😞

    I usually tend to write the original client IP into an additional cookie (via 

    HTTP::cookie insert name "OrigIP" value [IP::client_addr]
    ) and collect those information by turning on IIS cookie logging. Its much easier, doesn require any bits'n'bytes on your servers and may already satisfy your needs... 😉

    If you're still looking for a native 

    X-Forwarded-For
    support, then take a look to the following blog site. The site outlines and compares different techniques which are more or less supported/maintained by Microsoft or F5.

    https://blogs.iis.net/deanc/iis7-8-logging-the-real-client-ip-in-the-iis-hit-logs

    Cheers, Kai