Identifying original client IP for security events behind NSX Load Balancer

Products

• VMware NSX

Issue/Introduction

Symptoms:

When monitoring security events (such as brute force attacks) for servers behind an NSX Load Balancer, logs show the source IP address of the NSX Load Balancer or the Tier-1 gateway rather than the originating client IP.

Environment

VMware NSX

Cause

• The NSX Load Balancer utilizes Source Network Address Translation (SNAT) to ensure symmetrical return traffic.
• This translates the original client source IP to the load balancer's IP before forwarding traffic to the backend server.

Resolution

To identify the originating client IP address, use one of the following methods:

Method 1: Insert X-Forwarded-For (XFF) Header

If the NSX Load Balancer is operating at Layer 7 (HTTP/HTTPS Virtual Server):

1. Navigate to Networking > Load Balancing > Profiles.
2. Edit the Application Profile assigned to the virtual server.
3. Set X-Forwarded-For to Insert.
4. Configure the backend server (e.g., IIS/Exchange) to log the XFF header instead of the source IP.

Method 2: Identify Origin via Access Logs

If you cannot modify the application, enable access logs on the NSX Edge LB to correlate the session:

1. Enable Access Log on the Virtual Server in the NSX UI.
2. SSH into the active Edge node and search /var/log/syslog for the internal SNAT IP and port.
3. The access log entry will show the mapping between the Client.Ip (original) and Snat.Ip (LB/Router IP).

Additional Information

Troubleshooting NSX Native Load Balancer:

https://knowledge.broadcom.com/external/article/376344/troubleshooting-nsx-native-load-balancer.html