Manual Chapter : IPFIX Templates for PEM Events

Applies To:

Show Versions Show Versions

BIG-IP PEM

  • 12.1.6, 12.1.5, 12.1.4, 12.1.3, 12.1.2, 12.1.1, 12.1.0
Manual Chapter

IPFIX Templates for PEM Events

Overview: IPFIX templates for PEM events

The IP Flow Information Export (IPFIX) Protocol is a logging mechanism for IP events. This appendix defines the IPFIX Information Elements (IEs) and templates used to log F5® Policy Enforcement Manager™ (PEM™) events. An IE is the smallest form of useful information in an IPFIX log message, such as an IP address or a timestamp for the event. An IPFIX template is an ordered collection of specific IEs used to record one IP event, such as the acceptance of a network packet. In PEM, the IPFIX publisher delivers PEM records at the session, flow, and transaction level.

About IPFIX Information Elements for PEM events

Information Elements (IEs) are individual fields in an IPFIX template. An IPFIX template describes a single Policy Enforcement Manager™(PEM™) event.

IANA-defined IPFIX Information Elements

IANA maintains a list of standard IPFIX Information Elements (IEs), each with a unique Element Identifier. The F5® PEM™ IPFIX implementation uses a subset of these IEs to publish PEM events. This subset is summarized in the table.

Information Element (IE) ID Size (Bytes)
destinationIPv4Address 12 4
destinationIPv6Address 28 16
destinationTransportPort 11 2
ingressVRFID 234 4
protocolIdentifier 4 1
sourceIPv4Address 8 4
sourceIPv6Address 27 16
sourceTransportPort 7 2

IPFIX enterprise Information Elements

IPFIX provides for enterprises to define their own Information Elements. F5® currently uses the following non-standard IEs for PEM™ events:

Information Element (IE) ID Size (Bytes)
3gppParameters 12276 - 57 Variable
applicationCategoryId 12276 - 48 2
concurrentFlows 12276 - 59 2
downlinkVolume 12276 - 88 8
durationSec 12276 - 60 2
lastRecordSent 12276 - 63 8
newFlows 12276 - 64 2
observationTimeSeconds 12276 - 90 8
recordReason 12276 - 66 1
recordType 12276 - 54 1
reportId 12276 - 55 4
reportVersion 12276 - 56 Variable
subscriberId 12276 - 71 Variable
subscriberIdType 12276 - 72 Variable
successfulTransactions 12276 - 68 4
terminatedFlows 12276 - 69 2
timestampMsec 12276 - 91 2
totalTransactions 12276 - 73 2
uplinkVolume 12276 - 89 8
Information Element (IE) ID Size (Bytes)
applicationCategoryId 12276 - 48 2
downlinkVolume 12276 - 88 8
flowStartMilliSeconds 12276 - 50 2
flowStartSeconds 12276 - 51 8
flowStopMilliSeconds 12276 - 52 2
flowStopSeconds 12276 - 53 8
observationTimeSeconds 12276 - 90 8
recordType 12276 - 54 1
reportId 12276 - 55 4
reportVersion 12276 - 56 Variable
subscriberId 12276 - 71 Variable
subscriberIdType 12276 - 72 Variable
timestampMsec 12276 - 91 2
totalTransactions 12276 - 73 2
uplinkVolume 12276 - 89 8
urlCategoryId 12276 - 87 2
vlanId 12276 - 92 2
Information Element (IE) ID Size (Bytes)
applicationCategoryId 12276 - 48 2
classification 12276 - 49 Variable
downlinkVolume 12276 - 88 8
httpHostname 12276 - 74 Variable
httpHostnameTruncated 12276 - 75 1
httpResponseCode 12276 - 76 2
httpUrl 12276 - 77 Variable
httpUrlTruncated 12276 - 78 1
httpUserAgent 12276 - 79 Variable
httpUserAgentTruncated 12276 - 80 1
recordType 12276 - 54 1
reportId 12276 - 55 4
reportVersion 12276 - 56 Variable
skippedTransactions 12276 - 82 2
subscriberId 12276 - 71 Variable
subscriberIdType 12276 - 72 Variable
transactionNumber 12276 - 81 2
transactionStartMilliSeconds 12276 - 83 2
transactionStartSeconds 12276 - 84 8
transactionStopMilliSeconds 12276 - 85 2
transactionStopSeconds 12276 - 86 8
uplinkVolume 12276 - 89 8
urlCategoryId 12276 - 87 2
vlanId 12276 - 92 2
Note: IPFIX, unlike NetFlow v9, supports variable-length IEs, where the length is encoded within the field in the Data Record. NetFlow v9 collectors (and their variants) cannot correctly process variable-length IEs, so they are omitted from logs sent to those collector types.

About individual IPFIX templates for each event

F5® uses IPFIX templates to publish PEM™ events.

Session logs

This IPFIX template is used for session records used for HSL reporting.

Information Element (IE) ID Size (Bytes) Notes
reportId 12276 - 55 4  
observationTimeSeconds 12276 - 90 8  
timestampMsec 12276 - 91 2  
recordType 12276 - 54 1  
subscriberId 12276 - 71 Variable This IE is omitted for NetFlow v9.
subscriberIdType 12276 - 72 Variable This IE is omitted for NetFlow v9.
3gppParameters 12276 - 57 Variable This IE is omitted for NetFlow v9.
applicationCategoryId 12276 - 48 2  
lastRecordSent 12276 - 63 8  
uplinkVolume 12276 - 89 8  
downlinkVolume 12276 - 88 8  
concurrentFlows 12276 - 59 2  
newFlows 12276 - 64 2  
terminatedFlows 12276 - 69 2  
totalTransactions 12276 - 73 2  
successfulTransactions 12276 - 68 4  
durationSec 12276 - 60 2  
recordReason 12276 - 66 1  
reportVersion 12276 - 56 Variable This IE is omitted for NetFlow v9.

Flow logs

This IPFIX template is used for flow records used for HSL reporting.

Information Element (IE) ID Size (Bytes) Notes
reportId 12276 - 55 4  
observationTimeSeconds 12276 - 90 8  
timestampMsec 12276 - 91 2  
recordType 12276 - 54 1  
subscriberId 12276 - 71 Variable This IE is omitted for NetFlow v9.
subscriberIdType 12276 - 72 Variable This IE is omitted for NetFlow v9.
sourceIPv4Address 8 4  
sourceIPv6Address 27 16  
sourceTransportPort 7 2  
destinationIPv4Address 12 4  
destinationIPv6Address 28 16  
destinationTransportPort 11 2  
protocolIdentifier 4 1  
applicationCategoryId 12276 - 48 2  
urlCategoryId 12276 - 87 2  
flowStartSeconds 12276 - 51 8  
flowStartMilliSeconds 12276 - 50 2  
flowStopSeconds 12276 - 53 8  
flowStopMilliSeconds 12276 - 52 2  
totalTransactions 12276 - 73 2  
uplinkVolume 12276 - 89 8  
downlinkVolume 12276 - 88 8  
reportVersion 12276 - 56 Variable This IE is omitted for NetFlow v9.
ingressVRFID 234 4  
vlanId 12276 - 92 2  

Transaction logs

This IPFIX template is used for transactional records used for HSL reporting.

Information Element (IE) ID Size (Bytes) Notes
reportId 12276 - 55 4  
recordType 12276 - 54 1  
reportVersion 12276 - 56 Variable This IE is omitted for NetFlow v9.
transactionNumber 12276 - 81 2  
subscriberId 12276 - 71 Variable This IE is omitted for NetFlow v9.
subscriberIdType 12276 - 72 Variable This IE is omitted for NetFlow v9.
sourceIPv4Address 8 4  
sourceIPv6Address 27 16  
sourceTransportPort 7 2  
destinationIPv4Address 12 4  
destinationIPv6Address 28 16  
destinationTransportPort 11 2  
protocolIdentifier 4 1  
ingressVRFID 234 4  
vlanId 12276 - 92 2  
applicationCategoryId 12276 - 48 2  
urlCategoryId 12276 - 87 2  
classification 12276 - 49 Variable This IE is omitted for NetFlow v9.
transactionStartSeconds 12276 - 84 8  
transactionStartMilliSeconds 12276 - 83 2  
transactionStopSeconds 12276 - 86 8  
transactionStopMilliSeconds 12276 - 85 2  
uplinkVolume 12276 - 89 8  
downlinkVolume 12276 - 88 8  
skippedTransactions 12276 - 82 2  
httpResponseCode 12276 - 76 2  
httpHostnameTruncated 12276 - 75 1  
httpHostname 12276 - 74 Variable This IE is omitted for NetFlow v9.
httpUserAgentTruncated 12276 - 80 1  
httpUserAgent 12276 - 79 Variable This IE is omitted for NetFlow v9.
httpUrlTruncated 12276 - 78 1  
httpUrl 12276 - 77 Variable This IE is omitted for NetFlow v9.