Forcepoint Network Security Platform 7.3.2 Common Criteria Evaluated Configuration Guide

Home
Common Criteria Evaluated Configuration Guide
Establishing a security configuration
A Common Criteria configuration that also meets IPsec VPN gateway requirements for Commercial Solutions for Classified (CSfC) solutions program requires a specific configuration of the SMC Appliance, SMC software, and Security Engines.
Disabling communication between the SMC and Security Engine
You can disable communication from the perspective of the SMC or Security Engine.

Common Criteria Evaluated Configuration Guide
- Introduction
  This guide describes the requirements and guidelines for configuring the Forcepoint Network Security Platform to comply with Common Criteria evaluation standards.
- Evaluated capabilities
  The Forcepoint Network Security Platform is comprised of several components that have specific capabilities that have been evaluated.
- How Security Engine process traffic
  Security Engines permit or deny traffic according to Engine filtering rules that are contained in an Engine Policy. Rules match based on administrator defined properties of the traffic and the interface.
- Establishing a security configuration
  A Common Criteria configuration that also meets IPsec VPN gateway requirements for Commercial Solutions for Classified (CSfC) solutions program requires a specific configuration of the SMC Appliance, SMC software, and Security Engines.
  - Enable FIPS mode on the SMC Appliance
    To comply with Common Criteria evaluation standards, you must enable FIPS mode and enable 256-bit encryption as the security strength when you install the SMC Appliance.
  - External SMC certificate management configuration overview
    When you use external certificate management, the SMC configuration consists of these general tasks.
  - Verify the SMC Appliance self-tests
    The SMC Appliance contains several modules that run self-tests when the SMC Appliance starts.
  - Configure settings for an evaluated configuration
    After installing the SMC, several areas of the configuration must be configured specifically for a Common Criteria evaluated configuration by using the SMC Client.
  - Deleting log and audit data
    The Security Engine stores log data temporarily until the data is sent to the Log Server. The Log Server is responsible for sending log data to the configured external audit server.
  - Create an element for the Security Engine
    Use the SMC Client to create the Security Engine element.
  - Create a customized Engine Template Policy
    For a Common Criteria installation, add specific Access rules to a customized Engine Template Policy, then use that template to create security policies.
  - Create a Engine Policy
    After creating the customized Engine Template Policy, create a Engine Policy based on the template.
  - VPN Configuration
  - Enabling communication between the SMC and Security Engine
  - Verify the installed version of the SMC, Security Engine, and SMC Appliance
    You can verify the installed version of the SMC, Security Engine, and the SMC Appliance.
  - Disabling communication between the SMC and Security Engine
    You can disable communication from the perspective of the SMC or Security Engine.
    - Disable in the SMC by deleting the Security Engine element
      To disable communication from the SMC, delete the Security Engine element in the SMC Client.
    - Disable by resetting the Security Engine in the SMC Client
      You can reset the Security Engine to factory settings from the SMC Client.
    - Disable by resetting the Security Engine from the console
      You can use the local console to reset the Security Engine to factory settings.
  - Review audit events
    Review these examples of audit events and records that appear in Common Criteria evaluated configuration.
- Secure the update process
  When applying appliance upgrades and patches, review and follow the guidance in the Forcepoint Network Security Platform Product Guide to ensure that the update is secure.
- VPN Recovery Instructions
  In case VPN connection does not work, recovery should start from investigating why VPN tunnel is not established. Examining logging in detail gives indication of the underlying problem. Basic steps to follow are described below
- Network processes
  Many network processes can run on the appliances while in an evaluated configuration.

Disabling communication between the SMC and Security Engine

You can disable communication from the perspective of the SMC or Security Engine.

Disable in the SMC by deleting the Security Engine element
To disable communication from the SMC, delete the Security Engine element in the SMC Client.
Disable by resetting the Security Engine in the SMC Client
You can reset the Security Engine to factory settings from the SMC Client.
Disable by resetting the Security Engine from the console
You can use the local console to reset the Security Engine to factory settings.

Copyright © 2026 Forcepoint LLC