Forcepoint Network Security Platform 7.3.2 Common Criteria Evaluated Configuration Guide

Home
Common Criteria Evaluated Configuration Guide
Establishing a security configuration
A Common Criteria configuration that also meets IPsec VPN gateway requirements for Commercial Solutions for Classified (CSfC) solutions program requires a specific configuration of the SMC Appliance, SMC software, and Security Engines.
VPN Configuration
Setup VPN access rules
The Access rules define which traffic is sent to the policy-based VPN and which traffic is allowed out of the policy-based VPN.
Add rules to deny traffic as needed

Common Criteria Evaluated Configuration Guide
- Introduction
  This guide describes the requirements and guidelines for configuring the Forcepoint Network Security Platform to comply with Common Criteria evaluation standards.
- Evaluated capabilities
  The Forcepoint Network Security Platform is comprised of several components that have specific capabilities that have been evaluated.
- How Security Engine process traffic
  Security Engines permit or deny traffic according to Engine filtering rules that are contained in an Engine Policy. Rules match based on administrator defined properties of the traffic and the interface.
- Establishing a security configuration
  A Common Criteria configuration that also meets IPsec VPN gateway requirements for Commercial Solutions for Classified (CSfC) solutions program requires a specific configuration of the SMC Appliance, SMC software, and Security Engines.
  - Enable FIPS mode on the SMC Appliance
    To comply with Common Criteria evaluation standards, you must enable FIPS mode and enable 256-bit encryption as the security strength when you install the SMC Appliance.
  - External SMC certificate management configuration overview
    When you use external certificate management, the SMC configuration consists of these general tasks.
  - Verify the SMC Appliance self-tests
    The SMC Appliance contains several modules that run self-tests when the SMC Appliance starts.
  - Configure settings for an evaluated configuration
    After installing the SMC, several areas of the configuration must be configured specifically for a Common Criteria evaluated configuration by using the SMC Client.
  - Deleting log and audit data
    The Security Engine stores log data temporarily until the data is sent to the Log Server. The Log Server is responsible for sending log data to the configured external audit server.
  - Create an element for the Security Engine
    Use the SMC Client to create the Security Engine element.
  - Create a customized Engine Template Policy
    For a Common Criteria installation, add specific Access rules to a customized Engine Template Policy, then use that template to create security policies.
  - Create a Engine Policy
    After creating the customized Engine Template Policy, create a Engine Policy based on the template.
  - VPN Configuration
    - VPN Gateway Settings
    - VPN Certificates
    - Setup VPN Profile Element
      X.509 certificates are used for peer authentication in the evaluated configuration. The predefined VPN Profiles refer to pre-shared key authentication but the evaluation requires X.509 v3 certificate based authentication.
    - Setup external VPN Gateway element
    - Settings for VPN clients
    - Define policy based VPN elements
    - Setup VPN access rules
      The Access rules define which traffic is sent to the policy-based VPN and which traffic is allowed out of the policy-based VPN.
  - Enabling communication between the SMC and Security Engine
  - Verify the installed version of the SMC, Security Engine, and SMC Appliance
    You can verify the installed version of the SMC, Security Engine, and the SMC Appliance.
  - Disabling communication between the SMC and Security Engine
    You can disable communication from the perspective of the SMC or Security Engine.
  - Review audit events
    Review these examples of audit events and records that appear in Common Criteria evaluated configuration.
- Secure the update process
  When applying appliance upgrades and patches, review and follow the guidance in the Forcepoint Network Security Platform Product Guide to ensure that the update is secure.
- VPN Recovery Instructions
  In case VPN connection does not work, recovery should start from investigating why VPN tunnel is not established. Examining logging in detail gives indication of the underlying problem. Basic steps to follow are described below
- Network processes
  Many network processes can run on the appliances while in an evaluated configuration.

Add rules to deny traffic as needed

See section Create a Engine Policy in this guide for detailed steps.

For the field Use Action set it to Discard option to deny traffic.

Copyright © 2026 Forcepoint LLC