Create Secure SD-WAN Engines

(Optional)

(Optional)

(Not available for clusters)

(Not available for clusters)

(Optional)

Specifies the IP addresses of the DNS servers that the Secure SD-WAN Engine uses. DNS IP addresses are IP addresses of external DNS servers. Secure SD-WAN Engines use these DNS servers to resolve Domain names to IP addresses. Secure SD-WAN Engines need DNS resolution to contact services that are defined using URLs or domain names, and to resolve fully qualified domain names (FQDNs) used in policies.

(Engine/VPN role only) For DNS relay, specifies the IP addresses of external DNS servers to which the Secure SD-WAN Engine forwards DNS requests from clients in the internal network. When DNS relay is configured, these DNS servers are used unless domain-specific DNS servers are specified in a DNS Relay Profile element.

If you have configured at least one Physical Interface with a dynamic IP address or one static NetLink with a DNS IP address, the default value of the DNS IP Addresses field is The engine uses NetLink-specific DNS IP addresses.

• IP Address — Adds an IP Address element that represents a single IP address.
• Network Element — Adds a Network element that represents a network space.

(Appliances only)

(Optional)

(Optional)

To add several addresses, separate the addresses with a comma.

• Select — Opens a dialog box where you can select an existing DNS Relay Profile element.
• None — Removes the previously selected DNS Relay Profile element. Selecting None deactivates DNS Relay.
• New — Allows you to create a new DNS Relay Profile element. Opens the DNS Relay Profile Properties dialog box.

When According to Routing is selected, the source IP address is automatically selected based on the route to the external DNS server.

(Optional)

Lists the available NTP servers. Double-click the cell to select an NTP server.

The Layer 2 Interface Policy that contains rules for traffic detected by layer 2 physical interfaces.

All layer 2 physical interfaces on the Secure SD-WAN Engine use the same Layer 2 Interface Policy. If there are no layer 2 physical interfaces, this setting is ignored.

When selected, the Secure SD-WAN Engine dynamically reduces the number of inspected connections if the load is too high.

Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection.

If this option is not selected, the Secure SD-WAN Engine inspects all connections. Some connections might not get through if the engine gets overloaded.

• Layer 3 Physical Interface

  (Available for Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role)

• Layer 2 Physical Interface

  (Available for Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role)

• Physical Interface

  (Available for all engine types except Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role)

• VLAN Interface

  (Available for all engine types)

• IPv4 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Engines)

• IPv6 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Engines)

• ADSL Interface

  (Available for Single Engines and Engine Clusters)

• Tunnel Interface

  (Available for Single Engines, Engine Clusters, and Virtual Engines)

• Modem Interface

  (Available for Single Engines)

• Wireless Interface

  (Available for Single Engines)

• SSID Interface

  (Available for Single Engines)

• Switch

  (Available for Single Engines)

• Port Group Interface

  (Available for Single Engines)

(Not Virtual Engines)

• Primary — Specifies the Primary Control IP address for Management Server contact.
• Backup (Optional) — Specifies the Backup Control IP address that is used if the Primary Control IP address is not available.

(Clusters and Master Engines only)

• Primary — Specifies communications between the nodes. We recommend that you use a Physical Interface, not a VLAN Interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation.
  CAUTION:
  Primary and Backup Heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information.
• Backup — Used if the Primary Heartbeat Interface is unavailable. It is not mandatory to configure a backup Heartbeat Interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is interrupted. We strongly recommend that you use a dedicated interface for the backup heartbeat as well.

On Master Engines, you cannot use shared interfaces as a heartbeat interface.

The IPv4 address or IPv6 address of the selected interface is used when an Secure SD-WAN Engine contacts an external authentication server.

This option does not affect the routing of the connection with the authentication server. The IP address is used only as a parameter inside the authentication request payload to give a name to the request sender.

• Use Loopback IP Address in Unnumbered Tunnel Interface — Uses an IP address listed in the table as the source IP address of traffic sent from the Secure SD-WAN Engine node.
• Use Default Outgoing IP Address in Unnumbered Tunnel Interface — Uses the default outgoing IP address defined in the Interface Options pane as the source IP address of traffic sent from the Secure SD-WAN Engine node.

(Clusters only)

(Clusters only)

(Optional)

• Tree View — Displays the routing configuration as a tree of interfaces, Router elements, NetLink elements, and destination networks.
• Table View — Displays the routing configuration as a table of destination networks, routing gateways, interfaces, and NetLink elements.

• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the default route to the routing configuration.
• Show Default Route — Highlights the default route in the Tree View or the Table View.

• Destination — The destination IP address or network.
• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the route to the routing configuration.

• Source — The source IP address.
• Destination — The destination IP address.
• Query — Highlights the route in the Tree View or the Table View.

• Type 0 – [0-255]:[0-65535]
• Type 1 – ipv4:[0-255]
• Type 2 – [0-65535][0-255]

(Optional, BGP only)

(Optional, all protocols)

(IPv4 only)

(IPv6 only)

(IPv4 only)

(IPv6 only)

(Optional)

• None — Does not create any log entry.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers the alert you select.

• Never — The Secure SD-WAN Engine does not check for updates. You must update the anti-malware database manually.
• When Anti-Malware Daemon Starts — Checks when the anti-malware daemon starts. The daemon starts, for example, when the anti-malware feature is enabled or when the Secure SD-WAN Engine restarts.
• Every Hour — Checks for updates once an hour.
• Daily — Checks for updates once a day. Set the time of day.
• Weekly — Checks for updates once a week. Set the day and time of day.

(Optional)

• None — Disables file reputation services.
• Global Threat Intelligence (GTI) — Enables the use of McAfee GTI file reputation services for file filtering.

(Optional)

• NAT64: Allows only IPv6 connectivity to customers while still enabling access to servers that have only IPv4 address. Following fields need to be set:
  • Local IPv4 pools: IPv4 addresses used in translation.
  • NAT64 IPv6 prefix: 32,40,48,56,64 or 96 bit IPv6 prefix. IPv6 addresses matching this prefix will be translated to IPv4 addresses. (96 bit prefix recommended).
  • Static mappings (Optional): Can be used to ensure that specific IPv6 address & port combination will be always translated to specific IPv4 address & port combination. IPv4 address must be from the local IPv4 pool.
• 464XLAT CLAT: Enables IPv4-only applications to work on IPv6-only networks. Following fields need to be set:
  • Local IPv6 Prefix: 32,40,48,56,64, or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating local IPv4 addresses. Surrounding network must route traffic matching this prefix to Secure SD-WAN.
  • Remote IPv6 Prefix: 32,40,48,56,64 or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating non-local IPv4 addresses. This prefix must match the NAT64 prefix configured to the remote 464XLAT PLAT.
• SIIT EAM: Allows any IPv4 address to be converted to an IPv6 address by way of one simple configurable IPv6 prefix. Following fields need to be set:
  • Default IPv6 Address pool: 32,40,48,56,64 or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating between IPv4 and IPv6 addresses. This prefix will be used when explicit mapping entries are not matching.
  • SIIT EAM Mappings (Optional): Combination of IPv4 network prefix and IPv6 prefix definition. IPv4 prefix value must have identical or smaller number of suffix bits than its corresponding IPv6 prefix value.

• If you select the option and enable TLS inspection, the access rule which allows the traffic enables decryption, then the Engine discards the QUIC traffic. As a result, the client application reverts to using TLS, which can be decrypted.
• If you select the option and enable TLS inspection, however; the access rule which allows the traffic disables decryption, then QUIC traffic is allowed.
• If you select the option but has not enabled TLS inspection, then QUIC traffic will be allowed.
• If you do not select the option, then QUIC will always be allowed if it is included in an allowing access rule, no matter if TLS inspection is enabled, or if the allowing access rule enables decryption.

• None — The Secure SD-WAN Engine does not use a sandbox.
• Advanced Malware Detection & Protection — The engine uses the Advanced Malware Detection & Protection cloud service for sandbox analysis and file reputation scan.
  Note: This is a licensed service which requires a subscription to use.
• Cloud Sandbox - Forcepoint Advanced Malware Detection — The engine uses the cloud sandbox for Forcepoint Advanced Malware Detection.
• Local Sandbox - Forcepoint Advanced Malware Detection — The engine uses the local sandbox for Forcepoint Advanced Malware Detection.
  Note: To use the local sandbox for Forcepoint Advanced Malware Detection, you must have a Forcepoint Advanced Malware Detection appliance.

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Optional)

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Optional)

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

This option is required for client certificate authentication.

• All — Users can authenticate through all interfaces.
• Selected — Users can only authenticate through the selected interfaces.

(Optional)

(Optional)

(Optional)

(Optional)

(Optional)

(Optional)

• There is both an Internal RSA CA for Gateways and an Internal ECDSA CA for Gateways.
• The Internal CA for Gateways is in the process of being renewed and both the previous CA and the new CA are temporarily available.

• On — The Secure SD-WAN Engine always uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic.
• Off — The Secure SD-WAN Engine never uses the default NAT address as the public IP address.
• Automatic — The Secure SD-WAN Engine automatically determines whether to use the default NAT address based on the routing configuration. If there are routes that use NetLinks, the Secure SD-WAN Engine uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic.

When you select On or Automatic, a NAT rule is generated at the end of the IPv4 or IPv6 NAT rules in the policy.

(Engine/VPN role only)

(Engine/VPN role only)

• None — Does not create any log entry.
• Alert — Triggers an alert entry.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Stored — Creates a log entry that is stored on the Log Server.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored.

• Edit Value — Opens the Alias Value Properties dialog box.
• Set to Any — The Alias element matches any value.
• Set to None — Disables translation for the Alias element.

(Optional)

Click Remove to remove the selected element.

(Optional)

• SSL 3.0
• TLS 1.0
• TLS 1.1
• TLS 1.2

• New — Creates an element of the specified type.
• Show Deleted Elements — Shows elements that have been moved to the Trash.

• Expand All — Expands all levels of the status tree.
• Collapse All — Collapses all levels of the status tree.
• Refresh View — Updates the view.

• IPsec VPN — The mobile VPN only supports IPsec tunnels.
• SSL VPN — The mobile VPN only supports SSL VPN tunnels.
• Both IPsec & SSL VPN — The mobile VPN supports IPsec and SSL VPN tunnels.

(When SD-WAN Type is SSL VPN)

(When SD-WAN Type is SSL VPN)

(When SD-WAN Type is SSL VPN)

• Anti-Virus is enabled — Requires anti-virus software to be enabled on the computers of mobile VPN users.
• Firewall is enabled — Requires firewall software to be enabled on the computers of mobile VPN users.
• Windows Update is enabled — Requires the Windows Update service to be enabled on the computers of mobile VPN users.

• Disabled (IPsec VPN type only) — DHCP is not enabled.
• Direct — When selected, the engine sends a normal DHCP client broadcast message to a DHCP server located in a directly connected network.
  Note: This option is included for backward compatibility with legacy software versions.
• Relay — When selected, the engine sends unicast DHCP relay messages for VPN clients’ DHCP requests.

(When DHCP Mode is Direct)

(When DHCP Mode is Relay)

(When DHCP Mode is Direct)

(When DHCP Mode is Relay)

(Optional)

• Add User Information — When selected, VPN Client user information (in the form user@domain) is automatically added to the Remote ID option field in the DHCP Request packets.
• Add Group Information — When selected, VPN Client user information (in the form group@domain) is automatically added to the Remote ID option field in the DHCP Request packets.
• None — When selected, no user or user group information is added to the Remote ID option field in the DHCP Request packets.

(Optional)

(When SD-WAN Type is IPsec VPN)

• Trust all — The VPN gateway trusts all certificate authorities. This option is the default setting.
• Trust only selected — The VPN gateway trusts only the certificate authorities that you select in the table.

(IPS only)

When selected, the Secure SD-WAN Engine dynamically reduces the number of inspected connections if the load is too high.

Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection.

If this option is not selected, the Secure SD-WAN Engine inspects all connections. Some connections might not get through if the IPS engine gets overloaded.

(Not Virtual Engines)

The maximum amount of time the Management Server tries to connect to an Secure SD-WAN Engine.

A consistently slow network connection might require increasing this value. The default value is 120 seconds.

(Not Virtual Engines)

(Not Virtual Engines)

Without this feature, you must switch to the previous configuration manually through the boot menu of the Secure SD-WAN Engine.

(Not Virtual Engines)

(Not Virtual Engines)

Each certificate for system communications is valid for three years. If the certificate expires, other components refuse to communicate with the Secure SD-WAN Engine.

(Engines only)

(Not Virtual Engines)

(FIPS-Compatible Operating Mode only)

(FIPS-Compatible Operating Mode only)

(Engines only)

(Not Virtual Engines)

(Engines only)

(Engines only)

(IPS engines and Layer 2 Engines only)

When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule.

You can override this Secure SD-WAN Engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules.

• Normal — The Secure SD-WAN Engine drops ICMP error messages related to connections that are not currently active in connection tracking. A valid, complete TCP handshake is required for TCP traffic. The Secure SD-WAN Engine checks the traffic direction and the port parameters of UDP traffic.
• Strict — The Secure SD-WAN Engine does not permit TCP traffic to pass through before a complete, valid TCP handshake is performed.
• Loose — The Secure SD-WAN Engine allows some connection patterns and address translation operations that are not allowed in the Normal mode. This mode can be used, for example, if routing is asymmetric and cannot be corrected or if the use of dynamic routing protocols causes the Secure SD-WAN Engine to receive non-standard traffic patterns.

(Not Virtual Engines)

(Not editable on IPS engines)

When selected, fragmented packets are sent onwards using the same fragmentation as when they arrived at the Secure SD-WAN Engine.

When the Secure SD-WAN Engine receives fragmented packets, it defragments the packets for inspection. The original fragments are queued until the inspection is finished. If the option is not selected, the packets are sent onwards as if they had arrived unfragmented.

(Not Virtual Engines)

(Not Virtual Engines)

(Not Virtual Engines)

(Not Virtual Engines)

(IPS engines and Layer 2 Engines only)

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

(Not Master Engines)

• Discard Silently — The connection is silently dropped.
• Refuse With TCP Reset — The connection is refused, and a TCP reset packet is returned.

• None — SYN rate limits are disabled.
• Automatic — The Secure SD-WAN Engine automatically calculates the Allowed SYNs per Second and Burst Size values for the interface based on the Secure SD-WAN Engine capacity and memory size.
• Custom — Enter custom values for Allowed SYNs per Second and Burst Size.

(When SYN Rate Limits is Custom)

(When SYN Rate Limits is Custom)

• Disabled — Scan detection is not enabled.
• Off (Can Be Overridden in Policy) — Scan detection is not enabled, but you can override this setting in individual Access rules. This option is the default setting.
• On (Can Be Overridden in Policy) — Scan detection is enabled. You can override this setting in individual Access rules if scan detection is not needed or to avoid false positives.

• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers the alert you select.

• Disabled — DoS protection is not enabled.
• Off (Can Be Overridden in Policy) — DoS protection is not enabled, but you can override this setting in individual Access rules. This option is the default setting.
• On (Can Be Overridden in Policy) — DoS protection is enabled. You can override this setting in individual Access rules.

• Off — SYN flood protection is not enabled.
• Low — Allows the most SYN-ACK timeouts before the Secure SD-WAN Engine requires a full TCP handshake with the client before it communicates with a server.
• Medium — Allows a medium number of SYN-ACK timeouts before the Secure SD-WAN Engine requires a full TCP handshake with the client before it communicates with a server. This option is the default setting.
• High — Allows the fewest SYN-ACK timeouts before the Secure SD-WAN Engine requires a full TCP handshake with the client before it communicates with a server.

(Optional)

• Off — Slow HTTP Request Protection is not enabled.
• Low — Allows the slowest data transfer rate before the block list timeout is applied. This option is the default setting.
• Medium — Allows a moderately slow data transfer rate before the block list timeout is applied.
• High — Allows the least slow data transfer rate before the block list timeout is applied.

• Off — TCP reset protection is not enabled. This option is the default setting.
• Low — Allows the most TCP reset requests before the Secure SD-WAN Engine considers itself to be under attack.
• Medium — Allows a medium number of TCP reset requests before the Secure SD-WAN Engine considers itself to be under attack.
• High — Allows the fewest TCP reset requests before the Secure SD-WAN Engine considers itself to be under attack.

Double-click the Timeout(s) cell to change the value. Click Add to add an element to the table, or Remove to remove the selected element. To set the selected protocols and values back to default settings, click Set to Default.