Fallback mode

Forcepoint Web Security Endpoint enters Fallback mode when connectivity to the cloud service is interrupted. The fallback mode is configured in the web policy on the Cloud Security Gateway portal. The fallback mode is set per policy and different policies can have different fallback modes.

Administrators can configure the fallback behavior in the package builder. Two fallback modes are available:

  • Allow (Fail-Open): Web traffic is temporarily uninspected. You can continue browsing the internet until connectivity is restored. This will be the default mode.

  • Block (Fail-Closed): Web traffic is blocked while the cloud service is unreachable. Attempting to access a website displays an Access Blocked page. Non-web connections are refused. This option can be configured in the package builder. Please refer Forcepoint Web Security Proxy Connect Endpoint in the install guide.

    Note: In Block mode, access to local Wi-Fi login pages (captive portals), such as those at hotels or airports is still permitted so you can connect to a network and restore service.
Events that might trigger Fallback mode include:
  • Changing between Wi-Fi and Ethernet
  • Connecting to a virtual private network (VPN)
  • Being assigned a new IP address
  • Losing internet connectivity

Once the network issue is resolved, Forcepoint Web Security Endpoint is automatically re-enabled.