Secure SD-WAN 7.1 Installation Guide

Home
Forcepoint FlexEdge Secure SD-WAN deployment
Forcepoint FlexEdge Secure SD-WAN deployment consists of adding and configuring engine elements in the SMC, and configuring the Secure SD-WAN Engine software on the engine.
Configuring Forcepoint FlexEdge Secure SD-WAN for the Engine/VPN role
Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Engine/VPN role.
Configuring single engines
After you have the SMC installed and running, you can configure the Single Engine elements.
Add layer 2 interfaces to Single Engines
Layer 2 interfaces are used in traffic inspection on Single Engines.

Introduction to the Forcepoint FlexEdge Secure SD-WAN solution
Before setting up Forcepoint FlexEdge Secure SD-WAN, it is useful to know what the different components do and what engine roles are available. There are also tasks that you must complete to prepare for installation.
FlexEdge Secure SD-WAN Manager deployment
SMC is the management component of the Secure SD-WAN system. SMC must be installed and running before you can deploy the Secure SD-WAN engines.
Forcepoint FlexEdge Secure SD-WAN deployment
Forcepoint FlexEdge Secure SD-WAN deployment consists of adding and configuring engine elements in the SMC, and configuring the Secure SD-WAN Engine software on the engine.
- Configuring Forcepoint FlexEdge Secure SD-WAN for the Engine/VPN role
  Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Engine/VPN role.
  - Types of interfaces for Secure SD-WAN Engines in the Engine/VPN role
    You can configure several types of interfaces for Secure SD-WAN Engines in the Engine/VPN role.
  - Interface numbering
    The interfaces have their own numbering in the SMC called the interface ID. The interface IDs are mapped to the corresponding network interfaces on the Secure SD-WAN Engine when you configure the Secure SD-WAN Engine software.
  - Install licenses for FlexEdge Secure SD-WAN Engines
    Install the Secure SD-WAN Engine licenses that you downloaded while preparing for installation.
  - Configuring single engines
    After you have the SMC installed and running, you can configure the Single Engine elements.
    - Create a Single Engine element
      To add a single-node engine to the SMC, add a Single Engine element that stores the configuration information related to the engine.
    - Add layer 3 interfaces to Single Engines
      Layer 3 interfaces are used in system communications and in traffic inspection on Single Engines.
    - Add a wireless interface
      You can add one wireless interface to a Single Engine.
    - Add an SSID interface
      A service set identifier (SSID) interface represents an 802.11 wireless LAN.
    - Add Switches to Single Engines
      An integrated switch represents the switch functionality on purpose-built Secure SD-WAN Engine appliances. Integrated switches eliminate the need for an external switch device and reduce costs and clutter.
    - Add Port Group Interfaces to Single Engines
      Port groups simplify port and network segment configuration. Traffic inside a port group is not inspected. The traffic between port groups is inspected by the engine in the same way as other traffic.
    - Add IP addresses for Single Engine interfaces
      You can add one or more IP addresses to each interface on a Single Engine.
    - Add a modem interface
      You can use mobile broadband modems with Single Engines to provide wireless links for outbound connections.
    - Add layer 2 interfaces to Single Engines
      Layer 2 interfaces are used in traffic inspection on Single Engines.
      - Add logical interfaces to Single Engines
        Logical Interface elements are used in the Layer 2 Interface Policy and the traffic inspection process to represent a network segment.
      - Add reset interfaces to Single Engines
        Reset interfaces can deliver TCP resets and ICMP destination unreachable messages to interrupt communications picked up from capture interfaces when the communications trigger a response.
      - Add capture interfaces to Single Engines
        Capture interfaces monitor traffic that external devices have duplicated for inspection to the Single Engine.
      - Add inline IPS interfaces to Single Engines
        There are two physical interfaces in an inline IPS interface. The traffic is forwarded from one interface to the other.
      - Bypass traffic on overload on Single Engines
        You can configure the Single Engine to bypass traffic when the traffic load becomes too high.
      - Add inline Layer 2 Engine interfaces to Single Engines
        There are two physical interfaces in an inline Layer 2 Engine interface. The traffic is forwarded from one interface to the other.
      - Add VLAN interfaces to layer 2 interfaces of Single Engines
        VLANs divide a single physical network link into several virtual links.
    - Set global interface options
      Select which IP addresses are used for particular roles in system communications.
    - Bind engine licenses to Single Engine elements
      After you have configured the Single Engine elements, you must manually bind Management Server POL-bound licenses to specific Single Engine elements.
  - Configuring Engine Clusters
    After you have the SMC installed and running, you can configure the Engine Cluster elements.
- Configuring FlexEdge Secure SD-WAN for the IPS role
  Configuring engine elements in the SMC prepares the SMC to manage FlexEdge Secure SD-WAN in the IPS role.
- Configuring FlexEdge Secure SD-WAN for the Layer 2 Engine role
  Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Layer 2 Engine role.
- Configuring FlexEdge Secure SD-WAN Engines as Master FlexEdge Secure SD-WAN Engines and Virtual FlexEdge Secure SD-WAN Engines
  Configuring engine elements in the SMC prepares the SMC to manage Master Secure SD-WAN Engines and Virtual Secure SD-WAN Engines.
- Configuring routing
  After creating the Secure SD-WAN Engine elements and defining the interfaces, you can configure the basic routing.
- Initial configuration of Secure SD-WAN Engine software
  After configuring the Secure SD-WAN Engines in the Management Client, apply the initial configuration of the Secure SD-WAN Engine and contact the Management Server.
- Creating and installing policies
  After successfully applying the initial configuration and establishing contact between the Secure SD-WAN Engines and the Management Server, the Secure SD-WAN Engine is in the initial configuration state. Now you can create and install policies for access control or inspecting traffic.
Maintenance
To maximize the benefit of Secure SD-WAN, upgrade the SMC and Secure SD-WAN regularly.
Appendices

Add layer 2 interfaces to Single Engines

Layer 2 interfaces are used in traffic inspection on Single Engines.

Add logical interfaces to Single Engines
Logical Interface elements are used in the Layer 2 Interface Policy and the traffic inspection process to represent a network segment.
Add reset interfaces to Single Engines
Reset interfaces can deliver TCP resets and ICMP destination unreachable messages to interrupt communications picked up from capture interfaces when the communications trigger a response.
Add capture interfaces to Single Engines
Capture interfaces monitor traffic that external devices have duplicated for inspection to the Single Engine.
Add inline IPS interfaces to Single Engines
There are two physical interfaces in an inline IPS interface. The traffic is forwarded from one interface to the other.
Bypass traffic on overload on Single Engines
You can configure the Single Engine to bypass traffic when the traffic load becomes too high.
Add inline Layer 2 Engine interfaces to Single Engines
There are two physical interfaces in an inline Layer 2 Engine interface. The traffic is forwarded from one interface to the other.
Add VLAN interfaces to layer 2 interfaces of Single Engines
VLANs divide a single physical network link into several virtual links.

Copyright © 2024 Forcepoint LLC