Applies To:

Show Versions Show Versions

Manual Chapter: IPFIX Templates for AFM Events
Manual Chapter
Table of Contents   |   << Previous Chapter

IPFIX Templates for AFM Events

Overview: IPFIX Templates for AFM Events

The IP Flow Information Export (IPFIX) Protocol is a logging mechanism for IP events. This appendix defines the IPFIX Information Elements (IEs) and Templates used to log F5’s Application Firewall Manager (AFM) events. An IE is the smallest form of useful information in an IPFIX log message, such as an IP address or a timestamp for the event. An IPFIX template is an ordered collection of specific IEs used to record one IP event, such as the acceptance of a network packet.

About IPFIX Information Elements for AFM events

Information Elements (IEs) are individual fields in an IPFIX template. An IPFIX template describes a single Advanced Firewall Manager™(AFM™) event.

IANA-defined IPFIX Information Elements

IANA maintains a list of standard IPFIX Information Elements (IEs), each with a unique Element Identifier. The F5® AFM™ IPFIX implementation uses a subset of these IEs to publish AFM events. This subset is summarized in the table.

Information Element (IE) Size (Bytes) IANA ID
destinationIPv4Address 4 12
destinationIPv6Address 16 28
destinationTransportPort 2 11
ingressVRFID 4 234
observationTimeMilliseconds 8 323
protocolIdentifier 1 4
sourceIPv4Address 4 8
sourceIPv6Address 16 27
sourceTransportPort 2 7

IPFIX enterprise Information Elements

IPFIX provides for enterprises to define their own Information Elements. F5® currently uses the following non-standard IEs for AFM™ events:

Information Element (IE) Size (Bytes)
aclPolicyName Variable
aclPolicyType Variable
aclRuleName Variable
action Variable
attackType Variable
bigipHostName Variable
bigipMgmtIPv4Address 4
bigipMgmtIPv6Address 16
contextName Variable
contextType Variable
destinationGeo Variable
deviceProduct Variable
deviceVendor Variable
deviceVersion Variable
dosAttackEvent Variable
dosAttackId 4
dosAttackName Variable
dosPacketsDropped 4
dosPacketsReceived 4
dropReason Variable
errdefsMsgNo 4
flowId 8
ipfixMsgNo 4
ipintelligencePolicyName Variable
ipintelligenceThreatName Variable
messageSeverity 1
msgName Variable
partitionName Variable
saTransPool Variable
saTransType Variable
sourceGeo Variable
transDestinationIPv4Address 4
transDestinationIPv6Address 16
transDestinationPort 2
transIpProtocol 1
transRouteDomain 4
transSourceIPv4Address 4
transSourceIPv6Address 16
transSourcePort 2
transVlanName Variable
vlanName Variable
Note: IPFIX, unlike NetFlow v9, supports variable-length IEs, where the length is encoded within the field in the Data Record. NetFlow v9 collectors (and their variants) cannot correctly process variable-length IEs, so they are omitted from logs sent to those collector types.

About individual IPFIX templates for each event

F5® uses IPFIX templates to publish AFM™ events.

Network accept or deny

This IPFIX template is used whenever a network packet is accepted or denied by an AFM™ firewall.

Information Element (IE) Size (Bytes) Notes
aclPolicyName Variable This IE is omitted for NetFlow v9.
aclPolicyType Variable This IE is omitted for NetFlow v9.
aclRuleName Variable This IE is omitted for NetFlow v9.
action Variable This IE is omitted for NetFlow v9.
bigipHostName Variable This IE is omitted for NetFlow v9.
bigipMgmtIPv4Address 4  
bigipMgmtIPv6Address 16  
contextName Variable This IE is omitted for NetFlow v9.
contextType Variable This IE is omitted for NetFlow v9.
observationTimeMilliseconds 8  
destinationGeo Variable This IE is omitted for NetFlow v9.
destinationIPv4Address 4  
destinationIPv6Address 16  
destinationTransportPort 2  
deviceProduct Variable This IE is omitted for NetFlow v9.
deviceVendor Variable This IE is omitted for NetFlow v9.
deviceVersion Variable This IE is omitted for NetFlow v9.
dropReason Variable This IE is omitted for NetFlow v9.
msgName Variable This IE is omitted for NetFlow v9.
errdefsMsgNo 4  
flowId 8  
ipfixMsgNo 4  
protocolIdentifier 1  
messageSeverity 1  
partitionName Variable This IE is omitted for NetFlow v9.
ingressVRFID 4  
saTransPool Variable This IE is omitted for NetFlow v9.
saTransType Variable This IE is omitted for NetFlow v9.
sourceGeo Variable This IE is omitted for NetFlow v9.
sourceIPv4Address 4  
sourceIPv6Address 16  
sourceTransportPort 2  
transDestinationIPv4Address 4  
transDestinationIPv6Address 16  
transDestinationPort 2  
transIpProtocol 1  
transRouteDomain 4  
transSourceIPv4Address 4  
transSourceIPv6Address 16  
transSourcePort 2  
transVlanName Variable This IE is omitted for NetFlow v9.
vlanName Variable This IE is omitted for NetFlow v9.

DoS device

Information Element (IE) Size (Bytes) Notes
action Variable This IE is omitted for NetFlow v9.
bigipHostName Variable This IE is omitted for NetFlow v9.
bigipMgmtIPv4Address 4  
bigipMgmtIPv6Address 16  
contextName Variable This IE is omitted for NetFlow v9.
observationTimeMilliseconds 8  
destinationIPv4Address 4  
destinationIPv6Address 16  
destinationTransportPort 2  
deviceProduct Variable This IE is omitted for NetFlow v9.
deviceVendor Variable This IE is omitted for NetFlow v9.
deviceVersion Variable This IE is omitted for NetFlow v9.
dosAttackEvent Variable This IE is omitted for NetFlow v9.
dosAttackId 4  
dosAttackName Variable This IE is omitted for NetFlow v9.
dosPacketsDropped 4  
dosPacketsReceived 4  
msgName Variable This IE is omitted for NetFlow v9.
errdefsMsgNo 4  
flowId 8  
ipfixMsgNo 4  
messageSeverity 1  
partitionName Variable This IE is omitted for NetFlow v9.
ingressVRFID 4  
sourceIPv4Address 4  
sourceIPv6Address 16  
sourceTransportPort 2  
vlanName Variable This IE is omitted for NetFlow v9.

IP intelligence

Information Element (IE) Size (Bytes) Notes
action Variable This IE is omitted for NetFlow v9.
attackType Variable This IE is omitted for NetFlow v9.
bigipHostName Variable This IE is omitted for NetFlow v9.
bigipMgmtIPv4Address 4  
bigipMgmtIPv6Address 16  
contextName Variable This IE is omitted for NetFlow v9.
contextType Variable This IE is omitted for NetFlow v9.
observationTimeMilliseconds 8  
destinationIPv4Address 4  
destinationIPv6Address 16  
destinationTransportPort 2  
deviceProduct Variable This IE is omitted for NetFlow v9.
deviceVendor Variable This IE is omitted for NetFlow v9.
deviceVersion Variable This IE is omitted for NetFlow v9.
msgName Variable This IE is omitted for NetFlow v9.
errdefsMsgNo 4  
flowId 8  
ipfixMsgNo 4  
ipintelligencePolicyName Variable This IE is omitted for NetFlow v9.
ipintelligenceThreatName Variable This IE is omitted for NetFlow v9.
protocolIdentifier 1  
messageSeverity 1  
partitionName Variable This IE is omitted for NetFlow v9.
ingressVRFID 4  
saTransPool Variable This IE is omitted for NetFlow v9.
saTransType Variable This IE is omitted for NetFlow v9.
sourceIPv4Address 4  
sourceIPv6Address 16  
sourceTransportPort 2  
transDestinationIPv4Address 4  
transDestinationIPv6Address 16  
transDestinationPort 2  
transIpProtocol 1  
transRouteDomain 4  
transSourceIPv4Address 4  
transSourceIPv6Address 16  
transSourcePort 2  
transVlanName Variable This IE is omitted for NetFlow v9.
vlanName Variable This IE is omitted for NetFlow v9.
Table of Contents   |   << Previous Chapter

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)