# APM - How to configure logging of snat addresses for network access and app tunnels

**URL:** <https://community.f5.com/t/apm-how-to-configure-logging-of-snat-addresses-for-network-access-and-app-tunnels/69744>\
**Category:** Technical Forums\
**Tags:** security, big-ip-access-policy-manager-apm, log, snat, nat, logging\
**Created:** [May 17, 2022, 1:08pm UTC](https://community.f5.com/t/apm-how-to-configure-logging-of-snat-addresses-for-network-access-and-app-tunnels/69744 "2022-05-17T13:08:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fwendlandt](https://avatars.discourse-cdn.com/v4/letter/f/e8c25b/32.png) [@fwendlandt](https://community.f5.com/u/fwendlandt)\
**Post date:** [May 17, 2022, 1:08pm UTC](https://community.f5.com/t/apm-how-to-configure-logging-of-snat-addresses-for-network-access-and-app-tunnels/69744/1 "2022-05-17T13:08:46Z")

</div>

Hello everyone,

we are using BIG-IP Access Policy Manager to enable administrative access to systems via App Tunnel and Network Access resources.

For security reasons, we need to be able to map requests logged on backend resources/systems&nbsp; (e.g. in SSH audit logs) to the session or user accessing said backend resource via App Tunnel or Network Access in APM.

Currently, the following request information is logged.

Network Access:  
May 17 14:42:00 tmm0 tmm[22565]: 01580002:5: /APM/ap\_rmgw:Common:c1237463: allow ACL: #app\_tunnel\_/APM/Some\_App-Tunnel@c1237463:15 packet: tcp 192.168.12.18:58680 → 10.0.0.1:22

App Tunnels:  
May 17 14:41:10 tmm1 tmm1[22565]: 01580002:5: /APM/ap\_rmgw:Common:c6787463: allow ACL: #app\_tunnel\_/APM/Some\_App-Tunnel@c6787463:0 packet: tcp 89.229.152.144:63252 → 10.0.0.1:2

For Network Access requests, an IP address of the lease pool configured in the Network Access resource is logged as the client IP. For App Tunnel requests, the public IP of the client accessing APM is logged as the client IP.

In our setup, both requests will be NATed by APM before hitting the target system (through a snat pool in case of a Network Access request, through the active appliances backend IP in case of App Tunnels). Therefore, the APM self IPs (snat pool/appliance backend) will be logged on the target host, leading to us not being able to correlate logs in APM with logs on the target systems.

Is there any way to log the SNAT/NAT addresses and ports used to access target systems through APM?

I’ve tried using [ACCESS\_ACL\_ALLOWED](https://clouddocs.f5.com/api/irules/ACCESS_ACL_ALLOWED.html) in an iRule to log additional information, unfortunately this event only seems to trigger on Portal Access resources, not when using App Tunnels or Network Access resources.

Thank you,

Fabian

---

<div class="post-metadata">

**Author:** ![lnxgeek](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/lnxgeek/32/7442_2.png) [@lnxgeek](https://community.f5.com/u/lnxgeek)\
**Post date:** [September 28, 2023, 6:01pm UTC](https://community.f5.com/t/apm-how-to-configure-logging-of-snat-addresses-for-network-access-and-app-tunnels/69744/2 "2023-09-28T18:01:02Z")

</div>

If you turn up logging of the access profile you will be able to log the user and which lease ip it gets assigned and the actions performed. I have only used debug, but it migth be possible to go lower than that. All the lines are prefixed with the session id, so you should be able to correlate on that to identify a user.

You can also look here: [https://community.f5.com/t5/technical-forum/userid-to-leasepool-ip-mapping/td-p/60728](https://community.f5.com/topic/60728)

for inspiration regarding the actual logging with an iRule.