Network Security Platform 7.3.0 Online Help

Home
Traffic inspection policies
Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
Ethernet rules

About this Help
This online help was created for Forcepoint Network Security Platform, version 7.3.0.
Introduction to the Forcepoint Network Security Platform solution
Before setting up Forcepoint Network Security Platform, it is useful to know what the different components do and what engine roles are available.
Deployment
Before you can set up the system and start configuring elements, you must consider how the different SMC components should be positioned and deployed.
Setting up
After deploying the SMC components, you are ready to start using the SMC Client and carrying out some of the first configuration tasks.
Monitoring
You can use the SMC to monitor system components and third-party devices. You can also view and filter logs, and create Reports from them.
Controlling Security Engines
You can command and set options for engines through the SMC Client or on the engine command line. You can also stop traffic manually.
SMC configuration
SMC Manager configuration allows you to customize how the SMC components work.
Security Engine configuration
You can create and modify Engines, IPS engines, Layer 2 Engines, Master Engines and Virtual Security Engines. You can configure the Security Engine properties, activate optional features, and configure advanced Security Engine settings.
Routing
Use the SMC Client to configure static or dynamic routing, and use a Multi-Link configuration to manage and distribute inbound and outbound connections.
Traffic inspection policies
Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
- Creating and managing policy elements
  Policy elements are containers for the rules that determine how Security Engines, Master Engines, and Virtual Engines examine traffic. The policy elements for the engines include Template Policies, Policies, and Sub-Policies.
- Ethernet rules
  - Getting started with Ethernet rules
    Ethernet rules are lists of matching criteria and actions that define whether Ethernet protocol traffic is allowed or discarded.
  - Configuration of Ethernet rules
    You can use Ethernet rules in IPS, Layer 2 Engine, and Layer 2 Interface Policy and Template Policy elements. Sub-Policies cannot contain Ethernet rules.
  - Examples of Ethernet rules
    These examples illustrate some common modifications to the default Ethernet rules and general steps on how each example is configured.
- Access rules
  Access rules are lists of matching criteria and actions that define how the engine treats different types of network traffic. They are your main configuration tool for defining which traffic is stopped and which traffic is allowed.
- NAT rules
- Inspection Policy elements
  Inspection Policy elements define how the engines look for patterns in traffic allowed through the Access rules and what happens when a certain type of pattern is found.
- Snort inspection on Security Engines
  The Snort open source intrusion prevention system is integrated into Forcepoint Security Engine. You can import externally created Snort configurations into Forcepoint Security Engine to use Snort rule sets for inspection.
- Editing policies
  The rules in Engine, IPS, Layer 2 Engine, and Layer 2 Interface Policies allow you to control how the engines inspect and filter network traffic, and how NAT (network address translation) is applied on Engines, Master Security Engines, and Virtual Engines.
- Defining IP addresses
  When you define IP addresses as elements, you can use the same definitions in multiple configurations for multiple components.
- Working with Service elements
  Service elements match traffic based on protocol or port and set options for advanced inspection of traffic. Service elements are used in Engine Policies, IPS Policies, Layer 2 Engine Policies, and Layer 2 Interface Policies.
- Defining Situation elements
  Situation elements contain the context information that defines the pattern that the Security Engine looks for in the inspected traffic. Situation elements also define the patterns that match events in the traffic.
- Using Network Application elements
  Network Application elements collect combinations of identified characteristics and detected events in traffic to dynamically identify traffic related to the use of a particular network application.
- Defining User Response elements
  With the User Response element, you can send customized replies to users, instead of just closing an HTTP or HTTPS connection.
- Quality of Service
  The Quality of Service (QoS) features allow you to manage bandwidth and prioritize connections on the Security Engines. QoS features are available on Engines, IPS Security Engines, Layer 2 Engines, Master Engines, Virtual Engines, Virtual IPS Security Engines, and Virtual Layer 2 Engines.
- Anti-malware scanning
  An anti-malware scanner compares network traffic against an anti-malware database to search for viruses and other malware. If malware is found, the traffic is stopped or content is stripped out.
- File filtering
  Monitoring and restricting what data is sent out is an important part of data loss prevention (DLP). File filtering allows you to restrict the file types that are allowed in and out through the engine, and to apply malware detection to files.
- Integrating Forcepoint One Endpoint with Forcepoint Network Security Platform
  If you have installed Forcepoint One Endpoint clients on the endpoints in your network, you can collect information about endpoint clients, and use the information for access control in the SMC.
- Filtering URLs
  URL filtering allows you to filter URLs based on categories of content or lists of individual URLs.
- Protocol Agents on Security Engines
  Protocol elements of the Protocol Agent type are special modules for some protocols and services that require advanced processing. Protocol Agents can enforce policies on the application layer.
- Sidewinder Proxies
  Sidewinder Proxies are software modules that provide network level proxies, protocol validation, and configurable application level protocol filtering and translation on Forcepoint Network Security Platform.
- Setting up TLS inspection
  The TLS inspection feature decrypts TLS connections so that they can be inspected for malicious traffic and then re-encrypts the traffic before sending it to its destination.
- Setting up QUIC inspection
  QUIC is a secure general-purpose transport protocol. QUIC combines encryption and transport layer data stream processing into one protocol, thereby, reduces latency and improves security.
- Forward traffic to a proxy service for external inspection
  In addition to inspecting traffic on the Security Engine, you can transparently forward traffic to a proxy service in the cloud or on premises. For example, you can forward all HTTP and HTTPS traffic to the Forcepoint Web Security Cloud service.
- Configuring Explicit HTTP Proxy (Experimental)
  You can configure the Explicit HTTP Proxy to allow clients to send traffic to the Engine before it is sent to the destination.
- Block listing IP addresses
  Block listing is a way to temporarily block unwanted network traffic either manually or automatically with block list requests from an Security Engine or Log Server. Engines, IPS engines, Layer 2 Engines, and Virtual Engines can use a block list for blocking traffic.
Users and authentication
User accounts are stored in internal databases or external directory servers. You can use Forcepoint Network Security Platform in the Engine/VPN role or external authentication servers to authenticate users.
Virtual private networks
Forcepoint Network Security Platform supports both policy-based and Route-based Tunnels between VPN gateways. For full remote access, Forcepoint Network Security Platform supports both IPsec and SSL VPN tunnels for VPN clients.
Maintenance and upgrades
Maintenance includes procedures that you do not typically need to do frequently.
Troubleshooting
Troubleshooting helps you resolve common problems in the Forcepoint Network Security Platform and SMC.
Appendices

Ethernet rules

Getting started with Ethernet rules
Ethernet rules are lists of matching criteria and actions that define whether Ethernet protocol traffic is allowed or discarded.
Configuration of Ethernet rules
You can use Ethernet rules in IPS, Layer 2 Engine, and Layer 2 Interface Policy and Template Policy elements. Sub-Policies cannot contain Ethernet rules.
Examples of Ethernet rules
These examples illustrate some common modifications to the default Ethernet rules and general steps on how each example is configured.