---
title: "SonicWall"
url: "https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/dell/sonicwall/"
last_modified: "2026-05-12T12:48:47+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# SonicWall

SonicWall:
Delivers firewall, VPN, and deep packet inspection to protect networks from cyber threats and intrusions.

The following sections show you how to configure [SonicWall firewalls](https://www.sonicwall.com/products/firewalls/) to send their log data to Axoflow.

**CAUTION:**

Make sure to set data forwarding on your appliances/servers as described in this guide. Different settings like alternate message formats or ports might be valid, but can result in data loss or incorrect parsing.

## Prerequisites

- You have administrative access to the firewall.
- The date, time, and time zone are correctly set on the firewall.
- You have an [AxoRouter deployed and configured](https://axoflow.com/docs/axoflow/0.86/provisioning/axorouter/index.md) with a [Syslog connector](https://axoflow.com/docs/axoflow/0.86/data-sources/syslog/index.md) that has parsing and classification enabled (by default, every AxoRouter has such connectors). This device is going to receive the data from the firewall.
- You know the IP address the AxoRouter. To find it:

  1. Open the AxoConsole.
  2. Select the **Routers** or the **Topology** page.
  3. Select on AxoRouter instance that is going to receive the logs.
  4. Check the **Networks > Address** field.

## Steps for SonicOS 7.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the [official SonicWall documentation](https://www.sonicwall.com/support/technical-documentation).

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.
2. Register the address of your AxoRouter as an Address Object.

   1. Select **MENU > OBJECT**.
   2. Select **Match Objects > Addresses > Address objects**.
   3. Click **Add Address**.
   4. Configure the following settings:

      - **Name**: Enter a name for the AxoRouter, for example, `AxoRouter`.
      - **Zone Assignment**: Select the correct zone.
      - **Type**: Select **Host**.
      - **IP Address**: Enter the IP address of your AxoRouter: `%axorouter-ip%`
   5. Click **Save**.
3. Set your AxoRouter as a syslog server.

   1. Navigate to **Device > Log > Syslog**.
   2. Select the **Syslog Servers** tab.
   3. Click **Add**.
   4. Configure the following options:

      - **Name or IP Address**: Select the Address Object of AxoRouter.
      - **Server Type**: Select **Syslog Server**.
      - **Syslog Format**: Select **Enhanced**.

      If your Syslog server does not use default port 514, type the port number in the **Port** field.

      By default, AxoRouter accepts data on the following ports (unless you’ve modified the default connector rules):

      - 514 UDP and TCP for RFC3164 (BSD-syslog) and RFC5424 (IETF-syslog) formatted traffic. AxoRouter automatically recognizes and handles both formats.
      - 601 TCP (RFC 3195 - Reliable Delivery for syslog) for RFC5424 (IETF-syslog) and RFC3164 (BSD-syslog) formatted traffic. AxoRouter automatically recognizes and handles both formats.
      - 6514 TCP for TLS-encrypted syslog traffic (RFC 5425).
      - 4317 TCP for [OpenTelemetry log data](https://axoflow.com/docs/axoflow/0.86/data-sources/opentelemetry/index.md).
      - 5085 TCP for the [Windows Event Collector (WEC)](https://axoflow.com/docs/axoflow/0.86/data-sources/wec/index.md) service.
      - 9900 TCP for the Splunk HEC receiver (optional, only if you forward Splunk HEC traffic to AxoRouter).

      To receive data on other ports or other protocols, configure other [connector rules](https://axoflow.com/docs/axoflow/0.86/data-sources/connector-rules/index.md) for the AxoRouter host.

      For TLS-encrypted syslog connections, create a new [connector rule](https://axoflow.com/docs/axoflow/0.86/data-sources/connector-rules/index.md) or edit an existing one, and configure the keys and certificates needed to encrypt the connections. For details, see [Syslog](https://axoflow.com/docs/axoflow/0.86/data-sources/syslog/index.md).

      > **Note:**
      > When you create a [connector rule](https://axoflow.com/docs/axoflow/0.86/data-sources/connector-rules/index.md) on a new port, open that port in the firewall of of every corresponding AxoRouter as well.

      ![SonicWall add syslog server screen](https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/dell/sonicwall/syslog-addsyslog_hu_5efb1d14332b7fac.webp)
4. Add the source to AxoConsole.

   1. Open the AxoConsole and select **Topology**.
   2. Select **Add Item > Source**.

      ![Add Source](https://axoflow.com/docs/axoflow/0.86/img/add-source_hu_47110bad1427b1fb.webp)

      - If the source is actively sending data to an AxoRouter instance, select **Detected**, then select your source(s) and select **Add Selected Source(s)**.
      - Otherwise, select the vendor and product corresponding to your source from the **Predefined** sources, then enter the parameters of the source, like **IP address** and **FQDN**.

        ![Add Source parameters](https://axoflow.com/docs/axoflow/0.86/img/add-source-config_hu_fc34536e87d6ce37.webp)
      > **Note:**
      > During [log tapping](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md), you can add hosts that are actively sending data to an AxoRouter instance by clicking **Register source**.
   3. (Optional) Add [custom labels](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/hosts/add-host-metadata/index.md) as needed.
   4. Select **Add**.
   5. (Optional) **Add Path** manually. That’s needed only when AxoConsole can’t detect the path based on the IP address and the FQDN, and you haven’t yet configured the source to send data to the router. If you’ve added the source from the **Detected** list, you can skip this step, as the path is created automatically.

      Create a path between the source and the AxoRouter instance.

      If you’ve added the source from the **Detected** list, you can skip this step, as the path is created automatically.

      1. Select **Topology > Add Item > Path**.

         ![Add a new path](https://axoflow.com/docs/axoflow/0.86/img/data-management/flow-management/paths/add-path_hu_bedfdb7f0050673a.webp)
      2. If not set automatically, select the beginning of the path in the **Source host** field.
      3. Select the target router or aggregator this source is sending its data to in the **Target host** field, for example, `axorouter`.
      4. Select the **Target connector**. The connector determines how the destination receives the data (for example, using which protocol or port).
      5. Select **Add**. The new path appears on the **Topology** page.

         ![The new path](https://axoflow.com/docs/axoflow/0.86/img/data-management/flow-management/paths/path-created_hu_8e6634dca1ed0d1a.webp)

## Steps for SonicOS 6.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the [official SonicWall documentation](https://www.sonicwall.com/support/technical-documentation).

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.
2. Register the address of your AxoRouter as an Address Object.

   1. Select **MANAGE > Policies > Objects > Address Objects**.
   2. Click **Add**.
   3. Configure the following settings:

      - **Name**: Enter a name for the AxoRouter, for example, `AxoRouter`.
      - **Zone Assignment**: Select the correct zone.
      - **Type**: Select **Host**.
      - **IP Address**: Enter the IP address of your AxoRouter: `%axorouter-ip%`
   4. Click **Add**.
3. Set your AxoRouter as a syslog server.

   1. Navigate to **MANAGE > Log Settings > SYSLOG**.
   2. Click **ADD**.
   3. Configure the following options:

      - **Syslog ID**: Enter an ID for the firewall. This ID will be used as the hostname in the log messages.
      - **Name or IP Address**: Select the Address Object of AxoRouter.
      - **Server Type**: Select **Syslog Server**.
      - Enable the **Enhanced Syslog Fields Settings**.
   4. Click **OK**.
4. Add the source to AxoConsole.

   1. Open the AxoConsole and select **Topology**.
   2. Select **Add Item > Source**.

      ![Add Source](https://axoflow.com/docs/axoflow/0.86/img/add-source_hu_47110bad1427b1fb.webp)

      - If the source is actively sending data to an AxoRouter instance, select **Detected**, then select your source(s) and select **Add Selected Source(s)**.
      - Otherwise, select the vendor and product corresponding to your source from the **Predefined** sources, then enter the parameters of the source, like **IP address** and **FQDN**.

        ![Add Source parameters](https://axoflow.com/docs/axoflow/0.86/img/add-source-config_hu_fc34536e87d6ce37.webp)
      > **Note:**
      > During [log tapping](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md), you can add hosts that are actively sending data to an AxoRouter instance by clicking **Register source**.
   3. (Optional) Add [custom labels](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/hosts/add-host-metadata/index.md) as needed.
   4. Select **Add**.
   5. (Optional) **Add Path** manually. That’s needed only when AxoConsole can’t detect the path based on the IP address and the FQDN, and you haven’t yet configured the source to send data to the router. If you’ve added the source from the **Detected** list, you can skip this step, as the path is created automatically.

      Create a path between the source and the AxoRouter instance.

      If you’ve added the source from the **Detected** list, you can skip this step, as the path is created automatically.

      1. Select **Topology > Add Item > Path**.

         ![Add a new path](https://axoflow.com/docs/axoflow/0.86/img/data-management/flow-management/paths/add-path_hu_bedfdb7f0050673a.webp)
      2. If not set automatically, select the beginning of the path in the **Source host** field.
      3. Select the target router or aggregator this source is sending its data to in the **Target host** field, for example, `axorouter`.
      4. Select the **Target connector**. The connector determines how the destination receives the data (for example, using which protocol or port).
      5. Select **Add**. The new path appears on the **Topology** page.

         ![The new path](https://axoflow.com/docs/axoflow/0.86/img/data-management/flow-management/paths/path-created_hu_8e6634dca1ed0d1a.webp)

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.vendor) | `dell` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.product) | `sonicwall` |

You can use the labels as:

- **Filter labels** on the [Analytics page](https://axoflow.com/docs/axoflow/0.86/metrics/analytics/index.md),
- in the **Filter By Label** field during [log tapping](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `dell:sonicwall` | `netfw` |

Tested with: [Dell SonicWall Add-on for Splunk technical add-on](https://splunkbase.splunk.com/app/6203/)

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/0.86/destinations/google/secops/index.md), Axoflow sets the following log type: `SONIC_FIREWALL`.

## Sending data to Microsoft Sentinel

When sending the data collected from this source to a [Microsoft Sentinel destination](https://axoflow.com/docs/axoflow/0.86/destinations/microsoft/sentinel/index.md), Axoflow normalizes the data and sends it to the following table: `Syslog`.