# userID to LeasePool IP Mapping **URL:** \ **Category:** Technical Forums\ **Tags:** big-ip-access-policy-manager-apm, syslog, network-access, security\ **Created:** [September 2, 2015, 5:27pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374 "2015-09-02T17:27:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Greg\_130338](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@Greg\_130338](https://community.f5.com/u/Greg_130338)\ **Post date:** [September 2, 2015, 5:27pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/1 "2015-09-02T17:27:27Z")
Hey all, I finally have my SSLVPN route domain working to force all my vpn traffic through our internal network. I am not translating any of the source addresses so each leased address in the lease pool for my vpn clients are visible on the network. My goal now is to configure syslog to point to some of our syslog collectors and associate the authenticated user with the leased address. So far, in reviewing the APM logs, I cannot find one log that contains both the leased address and the userID. I have two separate logs with the info, myuserID being my account and 192.168.9.8 being the leased IP in the pool. Sep 2 13:12:08 JHHCF5-2 info apd[7160]: 01490007:6: a9dbfe8b: Session variable ‘session.logon.last.username’ set to ‘myuserID’ Sep 2 13:12:28 JHHCF5-2 notice tmm3[13010]: 01490549:5: a9dbfe8b: Assigned PPP Dynamic IPv4: 192.168.9.8 Tunnel Type: VPN\_TUNNELTYPE\_DTLS NA Resource: /Common/jhhc\_test\_vpn\_ap\_na\_res Client IP: 10.1.12.9 Has anyone done this? As an example I would like to integrate it with my palo alto URL filtering engine which can be configured to parse logs to associate userID with source IP. Any help is appreciated! ---
**Author:** ![Seth\_Cooper](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@Seth\_Cooper](https://community.f5.com/u/Seth_Cooper)\ **Post date:** [September 2, 2015, 6:48pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/2 "2015-09-02T18:48:40Z")
Hi Greg, You best bet on this one is to use the session id (a9dbfe8b) and correlate the two log lines. I’m not sure what collector you are using but I believe most SIEM solutions should provide the ability to index and run reports. If you are just using syslog you could always run a script to parse the logs pull the information and insert it into a database that you can run reports from. Seth ---
**Author:** ![mrichter](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@mrichter](https://community.f5.com/u/mrichter)\ **Post date:** [December 17, 2015, 12:00am UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/3 "2015-12-17T00:00:13Z")
I know this is a little old, but I believe I’ve done something similar to you and the way I did this is with an iRule sending data directly to a custom syslog parser on PA. The main issue I’ve found is that for whatever reason, you cannot access the VPN client IP via methods I would have thought useful (ACCESS\_POLICY\_AGENT\_EVENT or ACCESS\_POLICY\_COMPLETED) as it’s not available until after these events have been completed. > **[404 Page not found | BIG-IP Documentation](https://techdocs.f5.com/kb/en-us/solutions/public/12000/700/sol12706.html)** > > Usage information and technical documentation for BIG-IP and other related F5 products The only way I’m aware of to do this is referenced in [this article](https://devcentral.f5.com/questions/how-do-i-record-the-ip-assigned-to-a-client-after-login) Essentially, you need to tie this iRule to your APM VIP: ```tcl when CLIENT_ACCEPTED { ACCESS::restrict_irule_events disable } when HTTP_REQUEST { if { [HTTP::uri] starts_with "/myvpn?sess=" } { after 5000 { set user [ACCESS::session data get "session.logon.last.username"] set vpnip [ACCESS::session data get "session.assigned.clientip"] log x.x.x.x "F5_PA_UID_Event uid:$user vpnip:$vpnip" } } } ``` With this you can setup a custom syslog parser on your PA(s) and map the user to the VPN assigned IP. ---
**Author:** ![DevBabu](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@DevBabu](https://community.f5.com/u/DevBabu)\ **Post date:** [August 23, 2018, 1:55pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/4 "2018-08-23T13:55:08Z")
In Version 12 I don’t see the URI “/myvpn?sess=”. I see following URI “/isession?sess=”. ---
**Author:** ![Marco\_Bayarena\_1](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@Marco\_Bayarena\_1](https://community.f5.com/u/Marco_Bayarena_1)\ **Post date:** [December 18, 2018, 1:22pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/5 "2018-12-18T13:22:28Z")
There is a way to capture the end of session (logout, time-out or other reason) with this irule? I need this so the firewall will release the ip-to-username mapping. ---
**Author:** ![BASH1](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@BASH1](https://community.f5.com/u/BASH1)\ **Post date:** [January 15, 2019, 9:15pm UTC](https://community.f5.com/t/userid-to-leasepool-ip-mapping/10374/6 "2019-01-15T21:15:25Z")
If your Palo is scanning the syslog entries as noted above… you can write a log line entry in the ACCESS\_POLICY\_COMPLETED event. This will catch the logouts, timeouts, and disconnects (disconnects will hit this event via idle timeout). Advantage to using this event is that the APM session variables are still avalible. If you are using a sideband to call the Palo’s API, you will need to be creative; perhaps write the info to a table and make the API call in a different event. Note: “This event is triggered outside of flow context (similar to RULE\_INIT) when a session goes away. The iRule commands which require a flow context (for e.g. TCP, HTTP and SSL commands) can not be used in this event.”