Connecting a Firewall or Network Device via Syslog
Overview
If you have a firewall, switch, or other network appliance that can send syslog (Meraki, FortiGate, SonicWall, Cisco, or almost anything else that speaks syslog), you can forward its logs straight into your Ironclad SIEM. Every syslog source in your environment sends to the same destination — the portal identifies which source is yours by the sending IP address (or a DDNS hostname, if your firewall doesn't have a static IP).
This guide walks through adding a syslog source in the portal and pointing your device at it.
Before you start: You'll need admin access to the Ironclad portal, and either the public (WAN) IP address your firewall sends from, or a DDNS hostname that resolves to it. You'll also need access to your firewall's syslog/logging configuration.
Step 1: Open Integrations
- Log in to the Ironclad portal.
- Make sure the correct customer is selected in the scope bar at the top — syslog sources are configured per customer.
- In the left sidebar, under Administration, click Integrations.
Scroll down past the integration cards to the Syslog Sources section.
Step 2: Note your destination
At the top of the Syslog Sources section you'll see a banner:
Send syslog to (TCP/TLS, every source in this environment shares this destination)
Below it is a hostname and port in a copyable box, e.g. gw-e1.decianx.com:60438. Click the copy icon to grab it — you'll need it in Step 4. This value is the same for every syslog source on your environment; it's the IP/hostname matching in Step 3 that tells Ironclad which traffic is yours.
Step 3: Add a syslog source
- Click Add syslog source.
- Fill in the form:
| Field | Required? | What to enter |
|---|---|---|
| Display name (optional) | No | A friendly label like Main office firewall. Purely cosmetic — it has no effect on routing or matching. |
| Sender access | — | Choose Static IP if your firewall's public IP doesn't change, or DDNS hostname if it does and you have a dynamic DNS service pointed at it. |
| Allowed IP | Yes, if Static IP | Your firewall's public (WAN) IP address, e.g. 203.0.113.10. |
| DDNS hostname | Yes, if DDNS | The dynamic DNS hostname that resolves to your firewall, e.g. firewall.dynamic-provider.com. |
| Refresh interval (seconds) | Yes, if DDNS | How often Ironclad re-resolves the hostname. 300 seconds (5 minutes) is a sensible default; allowed range is 30–86400. |
| Connection limit (optional) | No | Max concurrent connections from this source. Leave blank for the default — the relay clamps any value to the 2–100 range automatically. |
- Click Create source.
Optional — filtering noisy messages: If your device sends a lot of low-value chatter, expand Advanced: filtering and add a filter (matching by Contains or Regex). Messages matching a filter are discarded before ingestion. Start with no filters unless you already know you need one — you can always add one later.
Step 4: Point your firewall at the relay
In your firewall's syslog / remote logging configuration, set the destination to the hostname and port you copied in Step 2, using TCP with TLS. The exact menu location varies by vendor (for example, on Meraki this is under Network-wide > General > Reporting; on FortiGate it's under Log & Report > Log Settings > Syslog Server; on SonicWall it's under Log > Syslog) — consult your device's documentation for the precise steps, but the destination and protocol are the same regardless of vendor.
Step 5: Confirm it's working
Back in the portal, your new source will appear in the Syslog Sources table. Watch the Status column:
| Status | What it means |
|---|---|
| Draft | The source was just created and hasn't been picked up yet. Wait a minute and refresh. |
| Pending | Being provisioned. |
| Active | Provisioned and healthy. |
| Disabled | Turned off — either by you (via the Disable action) or intentionally left inactive. |
| Error | Something's wrong — commonly a DDNS hostname that won't resolve. Check for a detail message beneath the status, and double-check the hostname/IP you entered. |
| Conflict | Another source is already claiming this IP or hostname. You'll see a red Conflict label with a warning icon. Check whether the IP/hostname is already registered elsewhere, or whether your firewall's public IP recently changed and an old entry needs to be removed. |
Once the source shows Active and your firewall is sending, you should start seeing events from that device in your Ironclad SIEM dashboard within a few minutes.
Troubleshooting
- Status stuck on Error, DDNS mode: confirm the hostname actually resolves publicly (try it from outside your network) and that it points at the same IP your firewall sends syslog from.
- Status shows Conflict: another syslog source (yours or someone else's) is already registered with that exact IP or hostname. Remove or correct the duplicate entry.
- No events showing up despite Active status: double-check your firewall is actually configured for TCP+TLS (not UDP) to the exact hostname:port from Step 2, and that no outbound firewall rule on your network is blocking the connection.
- Your firewall's public IP changed: edit the syslog source and update the Allowed IP, or switch to DDNS mode if your IP changes often.