Hello, we have a Load balancing virtual server used for LDAP queries. Every request logged in active directory security logs shows the SNIP as remote IP, anyone knows a way to replace the SNIP by the client IP? I saw USIP, but as the gateway of the back end server must be the netscaler, from my understanding, it's not really an option. Also, https://support.citrix.com/article/CTX205670/how-to-enable-client-ip-in-tcpip-option-of-netscaler, again I'm not sure how It can be implement.. Thank you!

You can try doing the x-forwarded-for as that will include that as a header, but I don't know if the ldap will show that. Otherwise unfortunately USIP is going to be your method. We have had to do that for Cisco ISE.

Don't think you can add headers for LDAP requests. Also, if you end up using USIP, you need to consider routing, so either the LDAP server needs to use NetScaler SNIP as the route back to client or then you need to support the LDAP server responding directly to the client according to its routing table.

We use the x-forwarded-for for HTTP, but for LDAP it's not possible. Thanks, I'll look into USIP!

I would stay away from USIP. What I did for a similar use case is to log on NS via syslog the client IPs and other details required. The dedicated syslog file is available to IT sec and auditing. You just move the auditing on NS when the LDAP VIP is used.

Its this, but very different to http traffic https://support.citrix.com/article/CTX205670/how-to-enable-client-ip-in-tcpip-option-of-netscaler

That's actually what I found, but I'm not sure how I can implement the client IP in TCP/IP to forward the information I need in our SIEM. @jvitech I'm a bit confused what do you mean by "You just move the auditing on NS when the LDAP VIP is used." ?

You log the ldap clientIP, etc on NS via message action and you send the syslog to your SIEM directly from NS or write to a log for auditing. Yes?

14.1 can send management logs to Syslog. auth.log. nsvpn.log. https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/management-logs-splunk-integration.html#additional-information

Thank you it's more clear now!