Passing original IP information for source NAT translated traffic

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L2 Linker

Passing original IP information for source NAT translated traffic

I don't know the feasibility of this on the PAN. I've seen this done by means of custom scripts on load balancers. But, I thought it might be better to ask here since there are always more than one person with the same issue.

 

The current situation:

  • I have a PAN firewall between the Internet and my HA-Proxy server.
  • The source traffic arrives at the ingress of my PAN firewall from the Internet.
  • The traffic is forwarded to the destination HA proxy server by means of a destination translation NAT rule that also enforces a source NAT. 
  • The source NAT translates the original source IP to the interface IP of the firewall.
  • Given the uniqueness of the environment, we can not get rid of the source NAT.
  • The HA-proxy server has a separate direct Internet access for outbound connectivity that doesn't go through the PAN firewall. However, the inbound connections from the Internet are source NAT'd through the PAN firewall.

My current requirement:

  • The HA-Proxy should be able to correlate or have knowledge about the original source IP address.

So, anyone out there who has run into a similar scenario before? Any hacks?
Lets brainstorm this out! 

Thank you!

 

Tags (3)
Highlighted
Community Team Member

Hi @DelvinC ,

 

I can't think of a built-in feature that will do this for you.

First thing that came to mind was to use x-forward-for but that's a different scenario/setup than yours and can't be used for this I'm afraid. 

 

Other users might have ideas or scripts.

 

Good luck !

-Kiwi.

 
Tags (1)
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!