Secure SD-WAN 7.2.1 Installation Guide

Home
Forcepoint FlexEdge Secure SD-WAN deployment
Forcepoint FlexEdge Secure SD-WAN deployment consists of adding and configuring engine elements in the SMC, and configuring the Secure SD-WAN Engine software on the engine.
Configuring Forcepoint FlexEdge Secure SD-WAN for the Engine/VPN role
Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Engine/VPN role.
Configuring Engine Clusters
After you have the SMC installed and running, you can configure the Engine Cluster elements.
Add layer 3 interfaces to Engine Clusters
Layer 3 interfaces are used in system communications and in traffic inspection on Engine Clusters.

Introduction to the Forcepoint FlexEdge Secure SD-WAN solution
Before setting up Forcepoint FlexEdge Secure SD-WAN, it is useful to know what the different components do and what engine roles are available. There are also tasks that you must complete to prepare for installation.
FlexEdge Secure SD-WAN Manager deployment
SMC is the management component of the Secure SD-WAN system. SMC must be installed and running before you can deploy the Secure SD-WAN engines.
Forcepoint FlexEdge Secure SD-WAN deployment
Forcepoint FlexEdge Secure SD-WAN deployment consists of adding and configuring engine elements in the SMC, and configuring the Secure SD-WAN Engine software on the engine.
- Configuring Forcepoint FlexEdge Secure SD-WAN for the Engine/VPN role
  Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Engine/VPN role.
  - Types of interfaces for Secure SD-WAN Engines in the Engine/VPN role
    You can configure several types of interfaces for Secure SD-WAN Engines in the Engine/VPN role.
  - Interface numbering
    The interfaces have their own numbering in the SMC called the interface ID. The interface IDs are mapped to the corresponding network interfaces on the Secure SD-WAN Engine when you configure the Secure SD-WAN Engine software.
  - Install licenses for FlexEdge Secure SD-WAN Engines
    Install the Secure SD-WAN Engine licenses that you downloaded while preparing for installation.
  - Configuring single engines
    After you have the SMC installed and running, you can configure the Single Engine elements.
  - Configuring Engine Clusters
    After you have the SMC installed and running, you can configure the Engine Cluster elements.
    - Considerations for Engine Clusters
      There are several operating modes for the physical interfaces of a Engine Cluster. Packet dispatch mode is recommended for new installations.
    - Create a Engine Cluster element
      To introduce a new Engine Cluster to the SMC, you must define a Engine Cluster element that stores the configuration information related to the Engine.
    - Add a node to a Engine Cluster
      The Engine Cluster element has two nodes when the element is created.
    - Add layer 3 interfaces to Engine Clusters
      Layer 3 interfaces are used in system communications and in traffic inspection on Engine Clusters.
      - Add a physical interface
        To route traffic through the Engine Cluster, you must define at least two layer 3 physical interfaces.
      - Add VLAN Interfaces to Engine Clusters
        VLANs divide a single physical network link into several virtual links.
    - Add IP addresses for Engine Cluster interfaces
      To route traffic through the engine, each Engine Cluster interface must have at least two IP addresses.
    - Add layer 2 interfaces to Engine Clusters
      Layer 2 interfaces are used in traffic inspection on Engine Clusters.
    - Set global interface options for a cluster
      Select which IP addresses are used for particular roles in system communications.
    - Add manual ARP entries for Engine Clusters
      ARP entries are normally managed automatically based on the Engine's routing configuration. However, you can also add manual ARP entries for the nodes.
    - Bind engine licenses to correct elements
      After you have configured the Engine Cluster elements, you must manually bind Management Server POL-bound licenses to specific nodes in Engine Cluster elements.
- Configuring FlexEdge Secure SD-WAN for the IPS role
  Configuring engine elements in the SMC prepares the SMC to manage FlexEdge Secure SD-WAN in the IPS role.
- Configuring FlexEdge Secure SD-WAN for the Layer 2 Engine role
  Configuring engine elements in the SMC prepares the SMC to manage Secure SD-WAN Engines in the Layer 2 Engine role.
- Configuring FlexEdge Secure SD-WAN Engines as Master FlexEdge Secure SD-WAN Engines and Virtual FlexEdge Secure SD-WAN Engines
  Configuring engine elements in the SMC prepares the SMC to manage Master Secure SD-WAN Engines and Virtual Secure SD-WAN Engines.
- Configuring routing
  After creating the Secure SD-WAN Engine elements and defining the interfaces, you can configure the basic routing.
- Initial configuration of Secure SD-WAN Engine software
  After configuring the Secure SD-WAN Engines in the Management Client, apply the initial configuration of the Secure SD-WAN Engine and contact the Management Server.
- Creating and installing policies
  After successfully applying the initial configuration and establishing contact between the Secure SD-WAN Engines and the Management Server, the Secure SD-WAN Engine is in the initial configuration state. Now you can create and install policies for access control or inspecting traffic.
Maintenance
To maximize the benefit of Secure SD-WAN, upgrade the SMC and Secure SD-WAN regularly.
Appendices

Add layer 3 interfaces to Engine Clusters

Layer 3 interfaces are used in system communications and in traffic inspection on Engine Clusters.

Add layer 3 physical interfaces to Engine Clusters
To route traffic through the Engine Cluster, you must define at least two layer 3 physical interfaces.
Add VLAN interfaces to layer 3 interfaces of Engine Clusters
VLANs divide a single physical network link into several virtual links.

Copyright © 2024 Forcepoint LLC