---
url: https://docs.realmsec.info/integration/forcepoint_ngfw.md
---

# Forcepoint NGFW

![Forcepoint NGFW Architecture](../images/forcepoint_ngfw.png)

### Send Forcepoint NGFW Logs to Realm

Realm integrates with Forcepoint Next Generation Firewall (NGFW), enabling intelligent routing and analysis of firewall event logs. The Forcepoint Security Management Center (SMC) Log Server forwards logs to an on-premises Realm Collector, which then relays them to Realm Cloud over a secure connection.

> **Note:** Realm supports CEF output from Forcepoint only. When configuring log forwarding in the SMC, ensure the **Format** is set to `CEF`.

## Prerequisites

* Administrative access to the Forcepoint SMC Management Client.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Collector IP address or FQDN.
* Logging is enabled on the relevant access control rules. In the SMC Management Client, ensure the **Log Level** of your access control rules is not set to `None`. To include byte-volume data (the `in`/`out` fields), set the **Connection Closing** option to **Log Accounting Information** on the relevant rules. See Forcepoint's [Define logging options for Access rules](https://help.forcepoint.com/ngfw/en-us/7.0.0/GUID-2A50734F-A30C-44FB-B92A-7E885DE450C9.html).

## Setup Forcepoint NGFW Source in Realm

1. Log in to the Realm console.
2. Go to **Sources > Add > Forcepoint NGFW** and add a new Source.
   > **Name:** `Forcepoint NGFW`
3. Under **Transport**, select **Collector** as the transport method.
4. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description. **Click Continue**
5. Add a Forcepoint NGFW stream to the Collector.

   > **Stream Name:** Choose a name for this stream\
   > **Port:** Select a unique port for this collector\
   > **Timezone:** Select the timezone your Forcepoint logs are set to

   > **Note:** Take note of the port you assigned to the Forcepoint NGFW stream. You will need it when configuring the SMC to forward syslog messages to Realm.
6. Click **Create Stream**.

## Forward SMC Logs to Realm

Configure the SMC Log Server to forward firewall logs to the Realm Collector.

1. In the SMC Management Client, go to **Dashboard > Servers / Devices**.
2. Right-click the **Log Server** from which you want to forward logs, then select **Properties**.
3. Click the **Log Forwarding** tab, then click **Add**.
4. Configure the forwarding rule:

   > **Target Host:** `<IP address or FQDN of the Realm Collector>`\
   > **Service:** `TCP`\
   > **Port:** `<port assigned to the Forcepoint NGFW stream in Realm>`\
   > **Format:** `CEF`\
   > **Data Type:** Firewall log data\
   > **Filter:** Optional — limit which log entries are forwarded

   > **Note:** The **Format** field must be set to `CEF`. Other formats are not supported by Realm.
5. Click **OK**. The rule activates immediately.
6. If a firewall governs traffic between the Log Server and the Collector host, add a rule permitting outbound traffic on the configured port from the Log Server IP to the Collector IP.

## Support

For additional details, refer to the official Forcepoint documentation:

* [Add log forwarding rules to Log Servers](https://help.forcepoint.com/ngfw/en-us/7.0.0/GUID-4C98583A-7BA4-4028-AD85-6D20B58EC420.html)
* [Forwarding log data from Log Servers to external hosts](https://help.forcepoint.com/ngfw/en-us/7.0.1/GUID-1856F6D5-AC49-4A41-8EE0-766BAB088E39.html)
* [Enable TLS protection for log or audit data forwarding](https://help.forcepoint.com/ngfw/en-us/7.0.1/GUID-D8B51C4D-AEAF-4108-B602-D38246F7F5BC_2.html)
* [Forcepoint NGFW Documentation](https://support.forcepoint.com/s/article/Next-Generation-Firewall-NGFW-Documentation)

If you encounter any issues or require assistance, contact Realm support.

## Event Metadata

The following additional metadata fields will be included with the events:

| Field Name | Value |
| ---------- | --------------- |
| \_sourceCategory | `forcepoint/ngfw` |