SonicWall

You can configure a **SonicWall® firewall to forward syslog logs to the ThreatDefence Syslog Forwarder for security monitoring.

---

Requirements

• A deployed and activated ThreatDefence Syslog Forwarder VM

• Administrator access to the SonicWall firewall

---

Step 1. Configure an Address Object for the ThreatDefence Syslog Forwarder

1. Sign in to your SonicWall device with administrator permissions.

2. Navigate to: Object → Match Objects → Addresses → Address Objects

3. Click Add Address Object and configure:

   • Name — Enter a descriptive name (e.g., TD Syslog Forwarder)

   • Zone Assignment — Select the appropriate zone

   • Type — Select Host

   • IP Address — Enter the IP address of your TD Syslog Forwarder

4. Click Save.

---

Step 2. Configure Syslog Forwarding

1. In the SonicWall menu, go to: Device → Log → Syslog

2. Open the Syslog Servers tab.

3. Click + Add and configure:

   • Name or IP Address — Select the address object created in Step 1

   • Syslog Format — Select Enhanced

   • Port — Use the appropriate port (as per the Syslog Onboarding Guide)

4. Click Add.

---

Step 3. Enable Firewall Rule Change Logging

1. Go to: Device → Log → Settings

2. Under the Firewall section, click Security Policy

3. Enable GUI, Alert, Syslog, and Email logging for:

   • Rule Deleted

   • Rule Modified

   • Rule Added

4. Click Accept

---

Step 4. Enable SSL VPN Logging

1. Go to: Device → Log → Settings

2. Under the Users category, click Authentication Access

3. Ensure Syslog is enabled for all entries

   • Important: Confirm that Successful SSL VPN User Login (ID: 1080) has Syslog enabled

4. Click Save.

---

Step 5. (Optional) Enable Configuration Auditing

1. Go to: Device → Log → Settings → Configuration Auditing

2. For each entry, set the Priority column to Warning for:

   • Configuration Change Succeeded

   • Configuration Change Failed

   • Chassis Settings Change.

---

Step 6. Provide Details to ThreatDefence

Once configuration is complete, provide the following details to ThreatDefence Support at 📧 [email protected]:

• Firewall make/model and OS version

• Source IP address and used port number.