Howto pick source IP in TCP based traffic like XFF way in HTTP

Hello @ZHTpsonline ,

If you don't use snat on the firewall policy, the source IP address reaches FortiADC. After this, FortiADC applies snat to the package, and the server can't see the real client IP address. According to my research, you have two options for TCP traffic.

First one, you can use TCP option 28 for TCP traffic. This option can add a real client IP address inside the TCP package. You can review this document for TCP option 28 (title Enhanced TCP command).

https://docs.fortinet.com/document/fortiadc/7.4.3/handbook/190300/whats-new

Second one, you can use direct routing mode on VS. But in this scenario, I think the server gateway address should be FortiADC. If its not, Fortigate will drop the packet because of asymmetric routing.

https://docs.fortinet.com/document/fortiadc/7.4.0/server-load-balance-layer-4-deployment-guide/222941/server-load-balance-layer-4