Forum Discussion
gdoyle
Cirrostratus
CirrostratusX-Fowraded-For with a UDP profile?
Hey, all. I have a request from a customer that they want to see the originating source IP (i.e. not the IP of the VIP) for logs they are receiving. Currently this is setup using a UDP protocol and U...
In order to have any chance at doing this, you will need to do a stream rewrite or a payload and append operation. Since BigIP doesn't have a protocol parser for UDP, and since Syslog is not a request/response protocol, there are only when CLIENT_DATA events.
You will need to map out the current syslog message format and your rule might look very roughly like:
when CLIENT_DATA {
set sNewMsg "SourceIP:[IP::client_addr]:[UDP::payload]"
UDP::payload replace 0 0 $sNewMsg
}
Stephen_Anders1
Employee
EmployeeIn order to have any chance at doing this, you will need to do a stream rewrite or a payload and append operation. Since BigIP doesn't have a protocol parser for UDP, and since Syslog is not a request/response protocol, there are only when CLIENT_DATA events.
You will need to map out the current syslog message format and your rule might look very roughly like:
when CLIENT_DATA {
set sNewMsg "SourceIP:[IP::client_addr]:[UDP::payload]"
UDP::payload replace 0 0 $sNewMsg
}