user logging with NAT

[cebetant]

IS their a way to have logs on end user activity with a one arm design using source IP NAT.

On the end systems all connections comes from this NAT address.

[pknoops]

What type of hardware are we talking about here. CSM, CSS ?

[cebetant]

CSS

[pknoops]

There is no way to log end user activity except with the use of specific ACL's where you could keep track of how many hits a particular, very specific, ACL gets hit when using source/dest ip's in it. This is probably not really feasible, but the only way possible at this point on the CSS.

Regards

Pete..

[cebetant]

Bad news... You ask the first question because CSM could do it in some way?

[pknoops]

No, the CSM does not do it either, but the ACL option is not available in the CSM, so I did not want to mix things up.

Regards

Pete..

[Gilles Dufour]

The CSM has the HTTP header insert function that let's you insert the original client ip address into the HTTP header.

HTTP servers can then extract this value to determine the origin.

Regards,

Gilles.