---
title: "firewall.velocloud"
canonical: "https://docs.devo.com/space/latest/283410562/firewall.velocloud"
format: markdown
---
> Macro (toc)

## Introduction

Tags beginning with `firewall.velocloud`** **identify events generated by [VeloCloud](https://docs.vmware.com/en/VMware-SD-WAN/3.3/VMware-SD-WAN-by-VeloCloud-Administration-Guide/GUID-EE8C35B8-FA4E-4C59-9AC2-4FD14509F60C.html).

## Tag structure

The full tag must have 3 levels. The first two are fixed as** **`firewall.velocloud`. The third level identifies the type of events sent.

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| VeloCloud Firewall | `firewall.velocloud.traffic` | `firewall.velocloud.traffic` |

## How is the data sent to Devo?

The data may be sent with a relay.  Example relay rule:

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: firewall.velocloud.traffic
Sent without syslog tag: false
        Stop processing: true
```

## Table structure

These are the fields displayed in this table:

### firewall.velocloud.traffic

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *host* | `str` |  | *vhost* |  |
| *sid* | `str` |  | * * |  |
| *sessionID* | `int8` |  | *id* |  |
| *segmentObjectId* | `int8` |  | * * |  |
| *ruleLogicalId* | `str` |  | * * |  |
| *interface* | `str` |  | * * |  |
| *protocol* | `str` |  | * * |  |
| *srcIp* | `ip4` |  | *sourceIp* |  |
| *srcPort* | `int4` |  | *sourcePort* |  |
| *dstIp* | `ip4` |  | *destIp* |  |
| *dstPort* | `int4` |  | *destPort* |  |
| *dest_name* | `str` |  | *sdwanDestination* |  |
| *action* | `str` |  | * * |  |
| *application* | `str` |  | * * |  |
| *durationSecs* | `int8` |  | * * |  |
| *bytesSent* | `int8` |  | * * |  |
| *bytesReceived* | `int8` |  | * * |  |
| *reason* | `str` |  | * * |  |
| *nat_src* | `ip4` |  | * * |  |
| *nat_spt* | `int4` |  | * * |  |
| *svlan* | `str` |  | * * |  |
| *dvlan* | `str` |  | * * |  |
| *dstDomain* | `str` |  | * * |  |
| *fwPolicyName* | `str` |  | * * |  |
| *eventName* | `str` | ```
(isnull(action) ? "null" : action) + "_" + (isnull(protocol) ? "null" : protocol) + "_" + (isnull(reason) ? "null" : reason)
``` | *reason*<br>*protocol*<br>*action* |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | * * |  |