Skip to main content
Many Wirespeed integrations accept logs from firewalls, network devices, and other sources through a forwarder. After you add the integration, Wirespeed prepares that forwarder and shows the connection details you need.

​
Set up a forwarder

  1. Login to Wirespeed and navigate to Integrations > Add Integration
  2. Select the integration for your vendor or log source and click Integrate
  3. Set a Source Name so you can tell multiple instances of the same vendor apart in Integrations
  4. Wirespeed prepares the forwarder after the integration is added
  5. Forwarder Details opens automatically when setup finishes while you remain on the integration page
  6. Copy the IP address or domain and the listener port(s) shown there
  7. Configure your vendor or source to send logs using those details
  8. Confirm logs appear in Events
Each integration page covers any vendor-specific steps, protocol choices, or formats.

​
Understanding the connection details

Forwarder Details shows an IP address or domain and one or more listener ports. Your devices send logs to that destination. The port identifies which Wirespeed integration the logs belong to, so they appear under the correct vendor in Events.

​
Syslog over TLS

Enable Enable TLS on TCP socket only when the vendor will send TCP syslog over TLS. Wirespeed presents a Let’s Encrypt certificate. Browsers already trust that chain. Many firewalls and appliances (including Cisco ASA) do not, and may need a CA imported as a trustpoint before secure syslog will connect.

​
Root CA

Import the Let’s Encrypt root as the trustpoint: ISRG Root X1 Use the root when you can. Intermediate CAs change more often; if you install one of those instead, you may have to update the appliance again later.

​
Intermediate chain

Use this only if the device will not accept a root trustpoint and requires the issuing CA. Replace the placeholders with the domain and TLS port from Forwarder Details:
chain.pem contains the intermediate CA. Import that file on the device.

​
When do I need multiple forwarders?

Different vendors or services need separate integrations — and therefore separate forwarders. For example, a SonicWall firewall and a Cisco Meraki deployment each get their own connection details. Multiple devices of the same vendor can usually share one forwarder. Several FortiGate firewalls, for example, can all send to the same IP and port. Use device name, source IP, or other fields in the logs to tell appliances apart. If you want separate groups of the same vendor (for example, firewalls in different regions), add another integration of that type and give each a distinct Source Name. Each integration gets its own forwarder and appears separately in Events.