Its doing it because you configured it to do so.

group commands in the configurations are translating the source IPs.

Since your services & VIPs are on the same subnet, source natting is required for clients sitting in the same subnet.

Syed Iftekhar Ahmed

We had just discovered this recently.

Is it possible to log the real source IPs?

Thanks for the input.

Seeing as the issue is with the group commands, is there any way to achieve local VIP access without the use of groups (different subnet?), or if not to export the real source IPs in the form of an X-Forwarded-For or other HTTP variable?

Its possible with ACE to insert headers but X-forwarded-for cannot be inserted for HTTP traffic on CSS.

The only option to get the Source IP is to redesign your topology such that its totally routed.

Your VIPs should be listening on a different Layer 3 network than the Services.

Syed Iftekhar Ahmed

Thanks Syed.

Do you have an example of how this would look in our situation? I'm having trouble locating Cisco documentation on this.

Much appreciated,

Mark