Minimum System Requirements

This section summarizes the minimum infrastructure requirements for deploying Forcepoint Data Classification (FDC) as a standalone solution using the synergy (AI-mesh) classifier. All values represent minimum starting points for a production deployment; additional capacity may be required depending on data volumes, classification policies, and the number of connected endpoints.

Basic Prerequisites

Ensure following prerequisites are met before starting the installation:

  • Domain Name Service (DNS) with public name resolution enabled

  • Network Time Protocol (NTP) configured and active

  • Access to a network-based repository for software update packages

  • Fixed static IPv4 address with subnet mask and default gateway assigned to the server

  • Unique static hostname assigned to the server

  • Root access (or sudo privileges) required for installation and support troubleshooting.

Server Requirements

This section covers everything needed to provision, configure, and prepare the FDC management server before installation begins.

Operating System

The following OS versions are supported. Only Server edition versions are supported - no Desktop Environment should be installed. No other Linux distributions are supported.
Distribution Supported Versions
Ubuntu 24.04 LTS (Noble Numbat) - preferred 22.04 LTS
RHEL 8.x, 9.x
Note: If you are using RHEL, refer to the official K3s documentation for additional OS preparation steps.

Hardware Sizing

Sizing is driven by two values: the number of agents classifying concurrently at peak load, and the total number of idle or connected agents. Select the row that covers your peak concurrent classification count. If you are unsure, assume 20-30% of your total agent population will be active at peak.

Answer two questions before selecting a sizing tier:
  1. How many agents will be classifying concurrently at peak?
  2. Streamline (rule-based) or Traditional / AI-mesh (ML-based)?
FDC only - synergylight (DLP classifier, no AI-mesh)
Concurrent classifying agents (peak) Idle/connected agents vCPU RAM
Up to 500 Up to 8,000 8 32 GB
Up to 1,000 Up to 15,000 16 64 GB
Up to 2,000 Up to 30,000 32 128 GB
Up to 4,000 Up to 60,000 64 256 GB
FDC only - synergy (AI-mesh)
Concurrent classifying agents (peak) Idle/connected agents vCPU RAM
Up to 80 Up to 22,000 24 96 GB
Up to 110 Up to 30,000 32 124 GB
Up to 160 Up to 45,000 48 192 GB
Up to 400 Up to 110,000 120 480 GB
Sizing assumptions:

  • 1 classification per 50 seconds per agent at peak (~0.02 RPS / agent)

  • Latency SLO: 95% of classifications complete in under 5 seconds

  • Maximum of 5 DLP policies enabled

  • 'Concurrent classifying' refers to the volume of active classification occurring at peak times, distinct from total licensed seats. Typical office workloads see 20-30% peak concurrency among licensed agents.

  • Heartbeats configured at 60 seconds

  • Larger deployments scale by adding clusters; each cluster handles the per-row agent count.

FDC as an add-on to an existing DSPM cluster

If DSPM is already sized, FDC adds a fixed delta per cluster:
  Per cluster
vCPU +4
RAM +16 GB

The base DSPM platform is 20 vCPU / 80 GB. The DSPM + FDC minimum is therefore 24 vCPU / 96 GB per cluster. Read FDC agent capacity from the synergy table above — select the row whose vCPU / RAM matches the DSPM cluster size after the FDC delta is applied.

Worked example: One DSPM cluster at the base size (20 vCPU / 80 GB) adding FDC:

  • Cluster after the FDC add-on: 24 vCPU / 96 GB.

  • FDC agent capacity: up to 80 concurrently classifying / 22,000 idle (the 24 / 96 row in the synergy table above).

For multi-cluster DSPM deployments, the +4 / +16 delta applies per cluster and the agent capacity is multiplied by the cluster count.

Note: The above values are baseline minimums. Review capacity utilization every six months and adjust as data volumes, policy counts, and endpoint numbers scale. Contact Forcepoint support before making changes if you need guidance.

Storage and Partition Details

Minimum disk space requirement is 500 GB. Only locally mounted SSD storage is supported - NAS and network-attached storage are not supported. SWAP must be disabled.

Performance baseline (minimum):

  • IOPS: ≥ 4,500 sustained

  • Throughput: ≥ 250 MB/s sustained

  • Latency: <1 ms typical. NAS introduces bursty throttling and is unsuitable.

Note: For optimal performance, use NVMe SSDs. Alternatively, enterprise-grade locally mounted SSDs are acceptable.
Partition guidance:

  • / (root) - at least 20 GB, minimum 32M inodes

  • /var - at least 20 GB

  • /var/lib/rancher - at least 500 GB (or at least 80% of total allocated disk)

  • /tmp - at least 75 GB.

Note: If neither /var, /var/lib/rancher, nor /tmp is assigned to a dedicated partition, assign the full 500 GB to /root. If /var is assigned but /var/lib/rancher is not, assign 500 GB to /var. If /var/lib/rancher is assigned but /var is not, assign 500 GB to /var/lib/rancher.

Networking and Firewall

Inbound port 443/TCP must be open on the FDC server for management dashboard access and agent connections. This port does not require public exposure if users and agents operate within a company VPN; internal network access is sufficient.

Outbound HTTPS (port 443) connections to the endpoints listed below must be allowed, with SSL inspection disabled. All traffic to these URLs should bypass interception and pass through unaltered.
Source Destination Port Protocol Purpose
Admin systems FDC server 443, 22 HTTPS, SSH Admin access to FDC server dashboard and shell
Endpoint systems FDC server 443 HTTPS FDC agent communication with server
FDC server https://assets.master.k3s.getvisibility.com 443 HTTPS Custom K3s installation files
FDC server https://images.master.k3s.getvisibility.com 443 HTTPS Private Docker registry
FDC server https://charts.master.k3s.getvisibility.com 443 HTTPS Private Helm registry
FDC server https://prod-eu-west-1-starport-layer-bucket.s3.eu-west-1.amazonaws.com 443 HTTPS Docker registry AWS CDN
FDC server https://rpm.rancher.io 443 HTTPS Rancher RPM repo for SELinux packages - RHEL/CentOS only, required during K3s install
FDC server https://agents.master.k3s.getvisibility.com 443 HTTPS Agent client binaries and Office add-ins
FDC server https://api.master.k3s.getvisibility.com 443 HTTPS Private API server
FDC server https://rancher.%5Breseller%5D.k3s.getvisibility.com 443 HTTPS Rancher management server. [reseller] is one of: master, forcepointemea, fpemea, forcepointapac, forcepointus, saas, forcepointpocemea, forcepointpocapac, forcepointpocus.
FDC server https://registry2.getvisibility.com/content/artifacts 443 HTTPS Agent packages
Network speed requirements:

  • Minimum: 40 Mbps download, 8 Mbps upload

  • Recommended for faster initial setup: 100 Mbps download or more.

Note: K3s may attempt to reach git.rancher.io (a hard-coded default repository). This can safely be blocked - Forcepoint uses its own private repository and blocking this URL has no impact on deployment.

Server Configuration

Static IP Addressing

A static IPv4 address with subnet mask and default gateway must be configured directly on the FDC server. DHCP - even with a static lease must be disabled.

DNS

DNS with public name resolution must be enabled. Use your internal DNS server rather than a public resolver such as 8.8.8.8 - using a public server may have compliance implications and will prevent resolution of internal hostnames. A DNS A record should also be created for the FDC server to support agent deployment.

NTP

Time synchronization must be configured and active. Ubuntu 24.04 includes systemd-timesyncd by default - verify it is active. Accurate time ensures logs are recorded in the correct order and that updates are applied correctly.

Hostname

A unique static hostname must be assigned to the FDC server. Use hostnamectl to view or set the hostname. The hostname is stored at /etc/hostname.

Third-Party Software

All third-party software must be installed post-deployment, after the K3s and Rancher cluster has been initialized. It is recommended to disable antivirus or any other third-party security software before proceeding with FDC installation. If full disablement is not possible, configure the AV exclusions listed in the FDC Agent Requirements section below.

OS-Level Preparation

Additional OS-level configuration is required before installation begins. Steps differ by Linux distribution.
OS Required Steps
Ubuntu

Disable and stop ufw:

sudo ufw disable
sudo ufw stop

Disable systemd-resolved:

sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved

Disable apparmor:

sudo systemctl disable apparmor
sudo systemctl stop apparmor

Ensure the /var partition does not have the noexec flag set.
RHEL/CentOS/Oracle Linux

Disable firewalld:

systemctl disable firewalld --now

Disable fapolicyd:

systemctl disable fapolicyd.service

Disable nm-cloud-setup and reboot:

systemctl disable nm-cloud-setup.service nm-cloud-setup.timer 
reboot

Check FIPS mode. If FIPS is enabled, K3s workloads will crash at startup. Check with:

sysctl crypto.fips_enabled

A value of 1 means FIPS is enabled. Refer to How to disable FIPS in RHEL/CentOS to resolve this before proceeding.

Check iptables version. RHEL systems running iptables 1.8.4 have known bugs affecting firewall routing and network reachability. Configure K3s to use its bundled version by adding --prefer-bundled-bin to the K3s service and restarting:

cat /etc/systemd/system/k3s.service
# Add '--prefer-bundled-bin' to ExecStart line
sudo systemctl daemon-reload
sudo systemctl stop k3s
sudo systemctl start k3s

If using a dedicated /var/lib/rancher partition, ensure it is NOT mounted with the noexec flag in /etc/fstab.

Pre-Installation Validation Script

Run the following command as the root user to validate all server prerequisites before installation. This is a single command - enter it on one line.
curl -sfL https://assets.master.k3s.getvisibility.com/k3s/k3s.sh | 
INSTALL_K3S_VERSION="v1.26.10+k3s1" K3S_KUBECONFIG_MODE="644" 
PRODUCT_NAME=synergy ONLY_PRECHECK=true sh -s - server --node-name=local-01

Agent Requirements

The FDC agent must be installed on each endpoint that will classify files. This section covers hardware, software, and antivirus requirements per endpoint operating system.

Windows Agent

Requirement Details
Supported OS Windows 10, Windows 11
Processor 2 GHz or faster, minimum 2 cores (64-bit)
RAM 4 GB minimum
Disk Space 1 GB free space
Administrator Privileges Required to install the agent
.NET 8 Runtime x86 Must be installed
.NET Framework 4.8.1 Must be installed (usually already present on modern Windows 10/11)
Visual Studio 2010 Tools for Office Runtime Required (usually installed with Office apps)
Office Version Office 365 subscription plans (recommended) or Office 2019, 2021, 2024
Browser Microsoft Edge (latest) or Google Chrome (latest)

AV Exclusion list:

If antivirus can not be fully disabled during or after installation, configure the following exclusions to prevent interference with FDC agent processes.

Paths to Exclude

  • %programfiles(x86)%\GVClient

  • %appdata%\GVClient

  • %windir%\syswow64\config\systemprofile\AppData\Roaming\GVClient

  • %appdata%\GVClient.CLI.Windows - CLI process

  • %appdata%\WordClassifier - Word plugin

  • %appdata%\ExcelClassifier - Excel plugin

  • %appdata%\GVClient.Powerpoint - PowerPoint plugin

  • %appdata%\OutlookClassifier - Outlook plugin

Trusted Applications

  • %programfiles(x86)%\GVClient\app-*\GVClient.Shell.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\GVClient.AutoUpdateService.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\GVClient.Healthcheck.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\GVClient.DotNetFrameworkBridge.exe

  • %programfiles(x86)%\GVClient\app-*\GVClient.CLI.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\AgentEngine\GVClient.Tools.PowerTools.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\AgentEngine\GVClient.AgentEngine.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\EndpointDiscovery\GVClient.EndpointDiscovery.Windows.exe

  • %programfiles(x86)%\GVClient\app-*\AgentUI\GVClient.AgentUI.exe

  • %programfiles(x86)%\GVClient\app-*\AgentEngine\createdump.exe

  • %programfiles(x86)%\GVClient\app-*\EndpointDiscovery\createdump.exe

  • %programfiles(x86)%\GVClient\app-*\AgentEngine\Proxy\grpcwebproxy.exe

  • %programfiles(x86)%\GVClient\app-*\ServerManager.exe

macOS Agent

Requirement Details
Supported OS macOS 14 (Sonoma), macOS 15 (Sequoia), macOS 26 (Tahoe)
Processor Intel Core i5 or Apple M1, M2, M3, or M4
RAM 4 GB minimum
Disk Space 800 MB free space
Administrator Privileges Required to install the agent
Write Permissions Read/write access to /Users/Shared/GVClient (configured at install time)
.NET Runtime .NET 8 Runtime (8.0.XX) must be installed
Office Version Office 365 subscription plans
Important:
  • Certificate and manifest requirement: The macOS agent — including classification in O365 web and New Outlook — will not function unless the Forcepoint certificate is trusted AND manifests are deployed into the O365 admin console.
  • Exchange On-Premises: Not officially supported or certified. While some functionality may work, behavior is not validated or guaranteed in on-premises environments.
  • OWA with Exchange On-Premises: Not supported or certified. Any usage falls outside the tested scope.