Applies To:
Show VersionsBIG-IP AFM
- 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
IPFIX Templates for AFM Events
Overview: IPFIX Templates for AFM Events
The IP Flow Information Export (IPFIX) Protocol is a logging mechanism for IP events. This appendix defines the IPFIX Information Elements (IEs) and Templates used to log F5’s Application Firewall Manager (AFM) events. An IE is the smallest form of useful information in an IPFIX log message, such as an IP address or a timestamp for the event. An IPFIX template is an ordered collection of specific IEs used to record one IP event, such as the acceptance of a network packet.
About IPFIX Information Elements for AFM events
Information Elements (IEs) are individual fields in an IPFIX template. An IPFIX template describes a single Advanced Firewall Manager™(AFM™) event.
IANA-defined IPFIX Information Elements
IANA maintains a list of standard IPFIX Information Elements (IEs), each with a unique Element Identifier. The F5® AFM™ IPFIX implementation uses a subset of these IEs to publish AFM events. This subset is summarized in the table.
Information Element (IE) | ID | Size (Bytes) |
---|---|---|
destinationIPv4Address | 12 | 4 |
destinationIPv6Address | 28 | 16 |
destinationTransportPort | 11 | 2 |
ingressVRFID | 234 | 4 |
observationTimeMilliseconds | 323 | 8 |
protocolIdentifier | 4 | 1 |
sourceIPv4Address | 8 | 4 |
sourceIPv6Address | 27 | 16 |
sourceTransportPort | 7 | 2 |
IPFIX enterprise Information Elements
IPFIX provides for enterprises to define their own Information Elements. F5® currently uses the following non-standard IEs for AFM™ events:
Information Element (IE) | ID | Size (Bytes) |
---|---|---|
aclPolicyName | 12276 - 26 | Variable |
aclPolicyType | 12276 - 25 | Variable |
aclRuleName | 12276 - 38 | Variable |
action | 12276 - 39 | Variable |
attackType | 12276 - 46 | Variable |
bigipHostName | 12276 - 10 | Variable |
bigipMgmtIPv4Address | 12276 - 5 | 4 |
bigipMgmtIPv6Address | 12276 - 6 | 16 |
contextName | 12276 - 9 | Variable |
contextType | 12276 - 24 | Variable |
destinationGeo | 12276 - 43 | Variable |
deviceProduct | 12276 - 12 | Variable |
deviceVendor | 12276 - 11 | Variable |
deviceVersion | 12276 - 13 | Variable |
dosAttackEvent | 12276 - 41 | Variable |
dosAttackId | 12276 - 20 | 4 |
dosAttackName | 12276 - 21 | Variable |
dosPacketsDropped | 12276 - 23 | 4 |
dosPacketsReceived | 12276 - 22 | 4 |
dropReason | 12276 - 40 | Variable |
errdefsMsgNo | 12276 - 4 | 4 |
flowId | 12276 - 3 | 8 |
ipfixMsgNo | 12276 - 16 | 4 |
ipintelligencePolicyName | 12276 - 45 | Variable |
ipintelligenceThreatName | 12276 - 42 | Variable |
logMsgDrops | 12276 - 96 | 4 |
logMsgName | 12276 - 97 | Variable |
logprofileName | 12276 - 95 | Variable |
messageSeverity | 12276 - 1 | 1 |
msgName | 12276 - 14 | Variable |
partitionName | 12276 - 2 | Variable |
saTransPool | 12276 - 37 | Variable |
saTransType | 12276 - 36 | Variable |
sourceGeo | 12276 - 44 | Variable |
sourceUser | 12276 - 93 | Variable |
transDestinationIPv4Address | 12276 - 31 | 4 |
transDestinationIPv6Address | 12276 - 32 | 16 |
transDestinationPort | 12276 - 33 | 2 |
transIpProtocol | 12276 - 27 | 1 |
transRouteDomain | 12276 - 35 | 4 |
transSourceIPv4Address | 12276 - 28 | 4 |
transSourceIPv6Address | 12276 - 29 | 16 |
transSourcePort | 12276 - 30 | 2 |
transVlanName | 12276 - 34 | Variable |
vlanName | 12276 - 15 | Variable |
About individual IPFIX templates for each event
F5® uses IPFIX templates to publish AFM™ events.
Network accept or deny
This IPFIX template is used whenever a network packet is accepted or denied by an AFM™ firewall.
Information Element (IE) | ID | Size (Bytes) | Notes |
---|---|---|---|
aclPolicyName | 12276 - 26 | Variable | This IE is omitted for NetFlow v9. |
aclPolicyType | 12276 - 25 | Variable | This IE is omitted for NetFlow v9. |
aclRuleName | 12276 - 38 | Variable | This IE is omitted for NetFlow v9. |
action | 12276 - 39 | Variable | This IE is omitted for NetFlow v9. |
bigipHostName | 12276 - 10 | Variable | This IE is omitted for NetFlow v9. |
bigipMgmtIPv4Address | 12276 - 5 | 4 | |
bigipMgmtIPv6Address | 12276 - 6 | 16 | |
contextName | 12276 - 9 | Variable | This IE is omitted for NetFlow v9. |
contextType | 12276 - 24 | Variable | This IE is omitted for NetFlow v9. |
observationTimeMilliseconds | 323 | 8 | |
destinationGeo | 12276 - 43 | Variable | This IE is omitted for NetFlow v9. |
destinationIPv4Address | 12 | 4 | |
destinationIPv6Address | 28 | 16 | |
destinationTransportPort | 11 | 2 | |
deviceProduct | 12276 - 12 | Variable | This IE is omitted for NetFlow v9. |
deviceVendor | 12276 - 11 | Variable | This IE is omitted for NetFlow v9. |
deviceVersion | 12276 - 13 | Variable | This IE is omitted for NetFlow v9. |
dropReason | 12276 - 40 | Variable | This IE is omitted for NetFlow v9. |
msgName | 12276 - 14 | Variable | This IE is omitted for NetFlow v9. |
errdefsMsgNo | 12276 - 4 | 4 | |
flowId | 12276 - 3 | 8 | |
ipfixMsgNo | 12276 - 16 | 4 | |
protocolIdentifier | 4 | 1 | |
messageSeverity | 12276 - 1 | 1 | |
partitionName | 12276 - 2 | Variable | This IE is omitted for NetFlow v9. |
ingressVRFID | 234 | 4 | |
saTransPool | 12276 - 37 | Variable | This IE is omitted for NetFlow v9. |
saTransType | 12276 - 36 | Variable | This IE is omitted for NetFlow v9. |
sourceGeo | 12276 - 44 | Variable | This IE is omitted for NetFlow v9. |
sourceIPv4Address | 8 | 4 | |
sourceIPv6Address | 27 | 16 | |
sourceTransportPort | 7 | 2 | |
sourceUser | 12276 - 93 | Variable | This IE is omitted for NetFlow v9. |
transDestinationIPv4Address | 12276 - 31 | 4 | |
transDestinationIPv6Address | 12276 - 32 | 16 | |
transDestinationPort | 12276 - 33 | 2 | |
transIpProtocol | 12276 - 27 | 1 | |
transRouteDomain | 12276 - 35 | 4 | |
transSourceIPv4Address | 12276 - 28 | 4 | |
transSourceIPv6Address | 12276 - 29 | 16 | |
transSourcePort | 12276 - 30 | 2 | |
transVlanName | 12276 - 34 | Variable | This IE is omitted for NetFlow v9. |
vlanName | 12276 - 15 | Variable | This IE is omitted for NetFlow v9. |
DoS device
Information Element (IE) | ID | Size (Bytes) | Notes |
---|---|---|---|
action | 12276 - 39 | Variable | This IE is omitted for NetFlow v9. |
bigipHostName | 12276 - 10 | Variable | This IE is omitted for NetFlow v9. |
bigipMgmtIPv4Address | 12276 - 5 | 4 | |
bigipMgmtIPv6Address | 12276 - 6 | 16 | |
contextName | 12276 - 9 | Variable | This IE is omitted for NetFlow v9. |
observationTimeMilliseconds | 323 | 8 | |
destinationIPv4Address | 12 | 4 | |
destinationIPv6Address | 28 | 16 | |
destinationTransportPort | 11 | 2 | |
deviceProduct | 12276 - 12 | Variable | This IE is omitted for NetFlow v9. |
deviceVendor | 12276 - 11 | Variable | This IE is omitted for NetFlow v9. |
deviceVersion | 12276 - 13 | Variable | This IE is omitted for NetFlow v9. |
dosAttackEvent | 12276 - 41 | Variable | This IE is omitted for NetFlow v9. |
dosAttackId | 12276 - 20 | 4 | |
dosAttackName | 12276 - 21 | Variable | This IE is omitted for NetFlow v9. |
dosPacketsDropped | 12276 - 23 | 4 | |
dosPacketsReceived | 12276 - 22 | 4 | |
msgName | 12276 - 14 | Variable | This IE is omitted for NetFlow v9. |
errdefsMsgNo | 12276 - 4 | 4 | |
flowId | 12276 - 3 | 8 | |
ipfixMsgNo | 12276 - 16 | 4 | |
messageSeverity | 12276 - 1 | 1 | |
partitionName | 12276 - 2 | Variable | This IE is omitted for NetFlow v9. |
ingressVRFID | 234 | 4 | |
sourceIPv4Address | 8 | 4 | |
sourceIPv6Address | 27 | 16 | |
sourceTransportPort | 7 | 2 | |
vlanName | 12276 - 15 | Variable | This IE is omitted for NetFlow v9. |
IP intelligence
Information Element (IE) | ID | Size (Bytes) | Notes |
---|---|---|---|
action | 12276 - 39 | Variable | This IE is omitted for NetFlow v9. |
attackType | 12276 - 46 | Variable | This IE is omitted for NetFlow v9. |
bigipHostName | 12276 - 10 | Variable | This IE is omitted for NetFlow v9. |
bigipMgmtIPv4Address | 12276 - 5 | 4 | |
bigipMgmtIPv6Address | 12276 - 6 | 16 | |
contextName | 12276 - 9 | Variable | This IE is omitted for NetFlow v9. |
contextType | 12276 - 24 | Variable | This IE is omitted for NetFlow v9. |
observationTimeMilliseconds | 323 | 8 | |
destinationIPv4Address | 12 | 4 | |
destinationIPv6Address | 28 | 16 | |
destinationTransportPort | 11 | 2 | |
deviceProduct | 12276 - 12 | Variable | This IE is omitted for NetFlow v9. |
deviceVendor | 12276 - 11 | Variable | This IE is omitted for NetFlow v9. |
deviceVersion | 12276 - 13 | Variable | This IE is omitted for NetFlow v9. |
msgName | 12276 - 14 | Variable | This IE is omitted for NetFlow v9. |
errdefsMsgNo | 12276 - 4 | 4 | |
flowId | 12276 - 3 | 8 | |
ipfixMsgNo | 12276 - 16 | 4 | |
ipintelligencePolicyName | 12276 - 45 | Variable | This IE is omitted for NetFlow v9. |
ipintelligenceThreatName | 12276 - 42 | Variable | This IE is omitted for NetFlow v9. |
protocolIdentifier | 4 | 1 | |
messageSeverity | 12276 - 1 | 1 | |
partitionName | 12276 - 2 | Variable | This IE is omitted for NetFlow v9. |
ingressVRFID | 234 | 4 | |
saTransPool | 12276 - 37 | Variable | This IE is omitted for NetFlow v9. |
saTransType | 12276 - 36 | Variable | This IE is omitted for NetFlow v9. |
sourceIPv4Address | 8 | 4 | |
sourceIPv6Address | 27 | 16 | |
sourceTransportPort | 7 | 2 | |
transDestinationIPv4Address | 12276 - 31 | 4 | |
transDestinationIPv6Address | 12276 - 32 | 16 | |
transDestinationPort | 12276 - 33 | 2 | |
transIpProtocol | 12276 - 27 | 1 | |
transRouteDomain | 12276 - 35 | 4 | |
transSourceIPv4Address | 12276 - 28 | 4 | |
transSourceIPv6Address | 12276 - 29 | 16 | |
transSourcePort | 12276 - 30 | 2 | |
transVlanName | 12276 - 34 | Variable | This IE is omitted for NetFlow v9. |
vlanName | 12276 - 15 | Variable | This IE is omitted for NetFlow v9. |
Log Throttle
Information Element (IE) | ID | Size (Bytes) | Notes |
---|---|---|---|
bigipHostName | 12276 - 10 | Variable | This IE is omitted for NetFlow v9. |
bigipMgmtIPv4Address | 12276 - 5 | 4 | |
bigipMgmtIPv6Address | 12276 - 6 | 16 | |
observationTimeMilliseconds | 323 | 8 | |
deviceProduct | 12276 - 12 | Variable | This IE is omitted for NetFlow v9. |
deviceVendor | 12276 - 11 | Variable | This IE is omitted for NetFlow v9. |
deviceVersion | 12276 - 13 | Variable | This IE is omitted for NetFlow v9. |
msgName | 12276 - 14 | Variable | This IE is omitted for NetFlow v9. |
errdefsMsgNo | 12276 - 4 | 4 | |
ipfixMsgNo | 12276 - 16 | 4 | |
messageSeverity | 12276 - 1 | 1 | |
contextType | 12276 - 24 | Variable | This IE is omitted for NetFlow v9. |
contextName | 12276 - 9 | Variable | This IE is omitted for NetFlow v9. |
logprofileName | 12276 - 95 | Variable | This IE is omitted for NetFlow v9. |
logMsgName | 12276 - 97 | Variable | This IE is omitted for NetFlow v9. |
logMsgDrops | 12276 - 96 | 4 |