Howto pick source IP in TCP based traffic like XFF way in HTTP

[ZH]

We want to keep the source IP intact when TCP traffic goes to load balancer and forward the TCP traffic to the nodes behind load balancer. In HTTP based traffic we can do it via XFF but we dont know how to handle the source IP in TCP based traffic. We are using Fortinet firewall load balancer

[ozkanaltas]

Hello @ZH ,

If you don't use snat on the firewall policy, the source IP address reaches FortiADC. After this, FortiADC applies snat to the package, and the server can't see the real client IP address. According to my research, you have two options for TCP traffic.

First one, you can use TCP option 28 for TCP traffic. This option can add a real client IP address inside the TCP package. You can review this document for TCP option 28 (title Enhanced TCP command).

https://docs.fortinet.com/document/fortiadc/7.4.3/handbook/190300/whats-new

Second one, you can use direct routing mode on VS. But in this scenario, I think the server gateway address should be FortiADC. If its not, Fortigate will drop the packet because of asymmetric routing.

https://docs.fortinet.com/document/fortiadc/7.4.0/server-load-balance-layer-4-deployment-guide/22294...