Forum Discussion

Tihomir_Hristov's avatar
Tihomir_Hristov
Icon for Nimbostratus rankNimbostratus
Apr 15, 2015

LTM Connection Loggin

Hey guys,

 

We have recently migrated to F5 HA pairs using SNAT and one of the requirements that came from our Security Group is logging every connection that passes through the F5 Load Balancers. The idea is that they would like to have the original client IP and ports, as well as all mapped F5 SNAT Pool IP and port.

 

The goal being to see something similar to:

 

Built {inbound|outbound} TCP connection_id for interface : real-address / real-port ( mapped-address/mapped-port) [( idfw_user)] to interface : real-address / real-port ( mapped-address/mapped-port) [( idfw_user)] [( user)]

 

Teardown TCP connection id for interface : real-address / real-port [( idfw_user)] to interface : real-address / real-port [( idfw_user)] duration hh:mm:ss bytes bytes [ reason ] [( user)]

 

I have seen two approaches so far - Request Logging Profile (https://devcentral.f5.com/questions/big-ip-114-ltm-connection-logging) and iRule (https://devcentral.f5.com/questions/logging-outgoing-snat-list-connections). I have both of them working, but the issue is that this is not a Global Configuration and would have to be configured for every new Application defined. We have a custom HTTP iApp Tempplate, but still there is a possibility that our Administrators would forget to assign the iRule or Logging Profile to custom iApps built.

 

My Question - is there a way to enable global connection logging on LTM, hopefully including the SNAT mapping?

 

Thanks and appreciate your help.

 

application delivery
design
logging
LTM
management
snat

8 Replies

Sort By
  • Sec-Enabled_658's avatar
    Sec-Enabled_658
    Icon for Cirrostratus rankCirrostratus
    Apr 15, 2015

    Another option may be the AFM module. Within the AFM module you create a global rule that could log each connection source ip/port and destination ip/port. You can set the log format to log the original IP and the NAT'd IP I believe. All this information can be sent to syslog, etc.

     

  • Tihomir_Hristov's avatar
    Tihomir_Hristov
    Icon for Nimbostratus rankNimbostratus
    Apr 15, 2015

    Hello Nathan,

     

    Thank you for the reply. Unfortunately, we are not licensed for AFM and it is not an option. I was thinking in the direction of enabling debug logging some of the LTM sub-modules (IP, network, ...) and finding that information there. I tried enabling notice for IP and debug for network but can't see anything helpful there.

     

    Thanks

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Apr 16, 2015
      Just wild guess, maybe turning on Packet Filters with one rule for all traffic with Action: Accept and Logging: Enabled could be kind of workaround? Piotr
    • Tihomir_Hristov's avatar
      Tihomir_Hristov
      Icon for Nimbostratus rankNimbostratus
      Apr 23, 2015
      Hello Piotr, This is actually a good idea. I gave it a shot but as soon as I enable packet filter logging I start getting log throttling: Apr 23 17:34:02 slb1-f5 notice tmm[9030]: 01250002:5: Per-invocation log rate exceeded; throttling. I am trying to see how to bypass that problem. Thank will keep you guys posted
  • Tihomir_Hristov's avatar
    Tihomir_Hristov
    Icon for Nimbostratus rankNimbostratus
    Apr 29, 2015

    Hey guys,

     

    So I tried the packet filtering rules. The only problem that I see here is the fact that the Packet Filter rules being logged will only show one side of the connection at a time. We would either log the real IP client-side connection or the translated IP server-side connection but there is nothing there to tie the two together. While we have configured our SNAT to try to maintain the source port of the client, there is a possibility in which that would be impossible and then the ability to related the client and server-side connection would be completely lost.

     

    I don't think that this approach would work.

     

    Thanks for the replies and if anybody has another idea I would love to try it out!

     

  • Robert_Luechte2's avatar
    Robert_Luechte2
    Icon for Cirrus rankCirrus
    Apr 29, 2015

    What about High Speed Logging in an iRule? It doesn't log to the local syslog-ng server, so you shouldn't get rate limited. Plus you can create your own log message with all the information you need.

     

    Here is a link to the wiki page:

     

    HSL Logging

     

  • Tihomir_Hristov's avatar
    Tihomir_Hristov
    Icon for Nimbostratus rankNimbostratus
    Apr 29, 2015

    Hey Robert,

     

    HSL in an iRule is definitely an approach that would work on a per-iApp basis. The goal here is to achieve Connection Logging globally for all traffic, so we maintain proper Security policy without running the risk of forgetting to configure logging on certain iApps.

     

    We have also setup a template that configures this for all of our HTTP iApps but still there will be other custom implementations that would allow for mis-configuration and skipping the iRule. We would like to assure that all connections are always being logged.

     

    Thanks

     

  • Jamie_Cravens's avatar
    Jamie_Cravens
    Icon for Nimbostratus rankNimbostratus
    Jun 18, 2015

    I am also looking to globally log all connections and have installed AFM. I did get the logging to work, but a big HOWEVER, it only logs the Source and Destination IP (VIP), it does not log the (S)NAT or Destination Pool Member.