ForcePoint NGFW Integration

​

Overview

• Malicious IPs
• Malicious URLs

​

Compatibility

​

Prerequisites

• A valid OneFirewall Alliance account.
• ForcePoint running 6.5 or later (7.0 recommended).
• Console access.
• Internet access from the gateway to OneFirewall’s feed URLs.
• HTTPS inspection must allow outbound connections to threat feed URLs, if required by policy.

​

Step 1: Generate API Token

1. Log into your OneFirewall Alliance dashboard.
2. Go to the API Access section.
3. Click Generate JWT Token.
4. Save the token securely — it authenticates feed requests.

​

Step 2: Configure IP Address List and URL List

​

Configure the external feeds

​

Install Docker and Docker Compose

# On Debian/Ubuntu
sudo apt update
sudo apt install -y docker.io
sudo systemctl enable --now docker

# Install Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/download/$(curl -s https://api.github.com/repos/docker/compose/releases/latest | jq -r '.tag_name')/docker-compose-$(uname -s)-$(uname -m)" \
  -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

​

Prepare your deployment directory

mkdir -p ~/wcf-agent-forcepoint
cd ~/wcf-agent-forcepoint

1. Download the WCF Agent Docker image into this folder.
2. Obtain your config.json from OneFirewall’s Install Agent page.
3. Place config.json in ~/wcf-agent/onefirewall/config.

​

Create docker-compose.yml

version: '3'
services:
  onefirewall-wcf-agent-forcepoint-ngfw:
    image: registry.onefirewall.com/onefirewall-wcf-agent-forcepoint:v4
    restart: always
    environment:
      - IS_TEST=False
    volumes:
      - ./storage/logs:/var/tmp/
      - ./storage/data:/opt/onefirewall/data/
      - ./onefirewall/config:/opt/onefirewall/config/:ro

​

Launch the agent

docker compose up -d
docker-compose logs -f onefirewall-wcf-agent-forcepoint-ngfw

​

Notes

• OneFirewall uses JWT-based Bearer Authentication.
• Feeds refresh automatically and are optimized for ForcePoint NGFW SMC 7.0 integration.
• All feed types can be used simultaneously, in different rules or combined policies.