> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# WatchGuard Firebox

> Ingest logs from WatchGuard Firebox

Wirespeed can ingest WatchGuard Firebox Syslog logs from any source within your organization. Email addresses, IPs, and important dates are automatically identified and extracted.
If you would like additional information extracted, please use the "Ask Wirespeed" button on the left-hand navigation and talk with our support team.

1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select WatchGuard Firebox and click **Integrate**
3. After you have clicked Integrate, select **Ask Wirespeed** on the left-hand navigation and ask the support team to provide you with an `ip:port` combination to provide to your source application
4. Events will begin showing up shortly

## Understanding IP:Port

When you set up a syslog integration, Wirespeed provides you with an **IP address** and a **port number** (e.g., `203.0.113.10:12345`). The IP address is the Wirespeed endpoint your devices will
send logs to, and the **port** is how Wirespeed identifies which service or vendor the incoming logs belong to.

You can think of each port as corresponding to a **vendor** or **service**. When logs arrive on a given port, Wirespeed knows which integration they belong to and displays them under the correct
vendor name in the **Events** tab.

### When do I need multiple ports?

**Different vendors or services** require separate ports. For example, if you have both a SonicWall firewall and a Cisco Meraki deployment, each would get its own `ip:port` so they appear as
distinct vendors in Events.

**Multiple devices of the same vendor** can typically share a single port. For example, if you have several WatchGuard Firebox devices, all sending WatchGuard Firebox syslog, they can all target the
**same** `ip:port`. The logs will appear under a single vendor entry in Events, and you can filter by device name, source IP, or other identifiers within the logs to distinguish between individual
appliances.

<Tip>If you have distinct groups of the same vendor that you'd like to track separately (e.g., firewalls in different regions), you can optionally request separate ports for each group. To do this,
add another **WatchGuard Firebox** integration via Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) and request a new `ip:port` from the support team.
Each additional integration gets its own port, giving you separate vendor entries in the Events tab for easier filtering. However, this is not required — a single port works fine as long as the
logs contain identifiers like device name or IP address.</Tip>