Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is IPFIX; which data does TR7 send with IPFIX?
Short answer
IPFIX (IP Flow Information Export) is the protocol, standardized by the IETF, that carries flow records from an exporter to a collector (RFC 7011); it is derived from NetFlow v9, and the fields of each record are defined with templates. In TR7, IPFIX is used with the IPFIX Log Sending action added to an HTTP vService: for each HTTP transaction passing through the vService, a record is sent with UDP to the IPv4 address in the Collector Address field. The record carries fields such as the source and destination address and port, Host, path, method, status code, User-Agent and byte counts (IPFIX fields sent); the field definitions are selected with Send Type as the TR7-specific Enterprise (default) or Standard, with IANA standard numbers. This data is used for vService-based traffic analysis in systems such as Graylog, Splunk or ELK.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Load Balancer → Actions → Add | Action Type = IPFIX Log Sending | Sending the record of the HTTP transactions to the collector |
| Same form | Collector Address (IPv4 address and UDP port) | The address and port of the collector (usually 4739) |
| Same form | Send Type: Enterprise (default) / Standard | TR7-specific field names (IANA Enterprise ID 57011) or standard IPFIX field numbers |
| Load Balancer → vService → Details | Adding the action to the Actions list | HTTP vService only; one per vService, without a condition |
- Setup and verification steps: Can I send flow data with IPFIX?
- The collector address must be IPv4; an IPv6 address is accepted by the form, but no record is sent (Collector Address).
Common Misconceptions
- "IPFIX sends all of the device traffic." The action sends only the transactions of the HTTP vService it is added to.
- "The IPFIX record of TR7 is a network flow." The record is produced per HTTP transaction; each request passing over a keep-alive connection is a separate record.
- "IPFIX replaces Syslog." IPFIX is a structured traffic record; device events and audit records are sent with Syslog (What is Syslog; how are TR7 logs forwarded with Syslog?).
How it is done in the documentation
