> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ForcePoint NGFW Integration

## Overview

Integrate OneFirewall Alliance (OFA) threat feeds with ForcePoint NGFW using Security Management Center (SMC) and External Dynamic Feeds. This enables real-time policy enforcement based on live threat data for:

* Malicious IPs
* Malicious URLs

## Compatibility

Compatible with ForcePoint NGFW Software 7.0, 6.11, 6.10, 6.9, 6.8, 6.7, 6.5, managed through Security Management Center (SMC).

## Prerequisites

* A valid OneFirewall Alliance account.
* ForcePoint running 6.5 or later (7.0 recommended).
* Console access.
* Internet access from the gateway to OneFirewall's feed URLs.
* HTTPS inspection must allow outbound connections to threat feed URLs, if required by policy.

## Step 1: Generate API Token

1. Log into your OneFirewall Alliance dashboard.
2. Go to the **API Access** section.
3. Click **Generate JWT Token**.
4. Save the token securely — it authenticates feed requests.

<img src="https://mintcdn.com/onefirewall/WDi-dI7jVFz2iVVH/images/fortigate-1.webp?fit=max&auto=format&n=WDi-dI7jVFz2iVVH&q=85&s=be685734218f716431dbe532b4663e97" alt="" width="2920" height="928" data-path="images/fortigate-1.webp" />

<img src="https://mintcdn.com/onefirewall/WDi-dI7jVFz2iVVH/images/fortigate-2.webp?fit=max&auto=format&n=WDi-dI7jVFz2iVVH&q=85&s=a3d2dea08e78a061078e32523ba21a1b" alt="" width="1460" height="680" data-path="images/fortigate-2.webp" />

## Step 2: Configure IP Address List and URL List

### Configure the external feeds

<img src="https://mintcdn.com/onefirewall/WDi-dI7jVFz2iVVH/images/forcepoint-1.webp?fit=max&auto=format&n=WDi-dI7jVFz2iVVH&q=85&s=e537ec95f9185c8c8e6eba758cbd3fa1" alt="" width="2168" height="1050" data-path="images/forcepoint-1.webp" />

#### Install Docker and Docker Compose

```bash theme={null}
# On Debian/Ubuntu
sudo apt update
sudo apt install -y docker.io
sudo systemctl enable --now docker

# Install Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/download/$(curl -s https://api.github.com/repos/docker/compose/releases/latest | jq -r '.tag_name')/docker-compose-$(uname -s)-$(uname -m)" \
  -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
```

#### Prepare your deployment directory

```
mkdir -p ~/wcf-agent-forcepoint
cd ~/wcf-agent-forcepoint
```

1. Download the WCF Agent Docker image into this folder.
2. Obtain your config.json from OneFirewall's Install Agent page.
3. Place config.json in \~/wcf-agent/onefirewall/config.

#### Create docker-compose.yml

```yaml theme={null}
version: '3'
services:
  onefirewall-wcf-agent-forcepoint-ngfw:
    image: registry.onefirewall.com/onefirewall-wcf-agent-forcepoint:v4
    restart: always
    environment:
      - IS_TEST=False
    volumes:
      - ./storage/logs:/var/tmp/
      - ./storage/data:/opt/onefirewall/data/
      - ./onefirewall/config:/opt/onefirewall/config/:ro

```

<Tip>
  Contact the OneFirewall support team for access to download the WCF Agent binary image.
</Tip>

#### Launch the agent

```
docker compose up -d
docker-compose logs -f onefirewall-wcf-agent-forcepoint-ngfw
```

## Notes

* OneFirewall uses JWT-based Bearer Authentication.
* Feeds refresh automatically and are optimized for ForcePoint NGFW SMC 7.0 integration.
* All feed types can be used simultaneously, in different rules or combined policies.