Log Analysis on IIS showing App Director IP as source, need actual originating source IP

Question

I have two webservers hosting around 70 websites with load balancing done through Radware App Director.

I have an issue with Log Analysis. All the requests to the 70 odd sites are routed through App Director and as a result the source IP in the IIS Log files shows the IP of APP Director rather than the IP of the actual source of where the request is sent to the web site.

It's causing problems tracking the originating source IP when resolving issues with the specific sites.

Is there any solution to resolve this log anomaly so that the source IP in the IIS log reflects the IP of the actual source rather than the App Director's IP?

Answer 1

I don't have any personal experience with Radware's products but many load-balancers that act like proxies have functionality built-in where they pass a custom HTTP Request header called X-Forwarded-For. The X-Forwarded-For header contains the end-user source IPs. It's possible that this header is already being sent to your servers--a simple wireshark trace and inspection of the request headers would confirm whether the X-Forwarded-For header is being passed along.

F5 has a freely available isapi filter than you can load in IIS that will replace the source IP in the IIS logs with the source IP pulled from the x-forwarded-for header. Radware may have one available as well but F5' is not F5 product-specific.