Can I send flow data with IPFIX?

Short answer

Yes. On the Load Balancer → Actions screen, IPFIX Log Sending is selected as the Action Type, Collector Address (IPv4 address and UDP port) and Send Type (Enterprise or Standart) are entered, and the action is added to the HTTP vService. For each HTTP transaction, an IPFIX record is sent to the collector over UDP while the response is processed; the record carries 21 fields such as source and destination address and port, Host, path, method, status code, User-Agent and byte counts (fields sent). The action takes no conditions, is applied to all requests, and only one is added to a vService.

Problem: HTTP Traffic Does Not Appear in the Flow Collector

The network team does traffic analysis in an IPFIX collector (e.g. Graylog); the HTTP transactions passing through TR7 are also required to be sent to the same collector as flow records.

Solution

Flow records are sent with the IPFIX Log Sending action added to the HTTP vService. The sending is independent of the log lines going to syslog and of the Log Forwarding settings; the two can work together (relationship with other log mechanisms).

IPFIX Log Sending

• How it works The action collects the information of each HTTP transaction in the request and response stages; while the response is processed, it produces an IPFIX record and sends it to the collector over UDP. Each request passing through a keep-alive connection is a separate record.
• Where it is openedLoad Balancer → Actions → Action Type = IPFIX Log Sending
• Requirement Access from TR7 to the UDP port of the collector (e.g. 4739); an IPv4 collector address
• vService type HTTP
• Setting change Adding the action and changing Collector address or Send type are applied without open connections being dropped.

Step-by-Step Configuration

1

Adım 1 Open the action form

On the Load Balancer → Actions screen, the Add button is clicked (how to add).

2

Adım 2 Define the collector

Action Name is entered and Action Type = IPFIX Log Sending is selected. The IPv4 address and UDP port of the collector are entered in the Collector Address field (e.g. 192.0.2.60 and 4739). As the Send Type, Enterprise is selected for collectors such as Graylog that can load the TR7 field definition, and Standart for general IPFIX collectors. When Enterprise is selected, the link to the Graylog definition file appears in the form (Graylog integration). There is no condition field in the action.

3

Adım 3 Save the action

The Add button is clicked.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is right-clicked and Edit is selected.

5

Adım 5 Add the action to the vService

The action is selected in the Actions field in the Details panel. The action does not work unless it is added to the vService.

6

Adım 6 Save

The Save button is clicked. The change is applied without open connections being dropped; the progress is followed from the sync indicator at the bottom right of the screen. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1CollectorCollector server

A request is sent to the vService and the record is searched for in the collector; the arrival of the packets can also be seen on the collector server.

Command: tcpdump -ni any udp port 4739

ExpectedOne flow record for each HTTP request

Common Mistakes

Cookie content is sent as plain text

The httpCookie field in the records carries the entire cookie header and is sent over UDP without encryption. The collector is positioned in a secure management network and its access is restricted (sending behavior).

• Entering an IPv6 collector address. The address is accepted, but no record is sent and no warning is produced either; the collector is defined with an IPv4 address.
• Looking for the action in an L7 TCP or Network vService. IPFIX Log Sending works only in an HTTP vService.
• Trying to add a second IPFIX action to the same vService. One IPFIX action is added per vService.
• Expecting a warning for lost records. Sending is done over UDP without waiting for acknowledgment; a record that does not reach the collector is lost silently, and the request and response flow is not affected.
• Assuming that Ip log masking also masks IPFIX. IPFIX records carry the real client address (Can I mask IP addresses in the logs for KVKK / GDPR?).

How it is done in the documentation

• IPFIX Log Sending · IPFIX Log Sending Action Add Form
• IPFIX Log Sending · The IPFIX Fields Sent
• IPFIX Log Sending · Sending Behavior

Related questions

• How do I send logs to a SIEM (Syslog)?
• Can I monitor TR7 metrics with Prometheus / Grafana?
• Can I mask IP addresses in the logs for KVKK / GDPR?