# Engine Editor > Advanced Settings

Use this branch to change system parameters for the Security Engine. These parameters control how the Security Engine behaves under certain traffic conditions.

Option | Definition
--- | ---
Encrypt Configuration Data | By default, the configuration of the Security Engine is stored in an encrypted format. Disable the encryption only if instructed to do so by Forcepoint Customer Hub.
Disable Application Health Monitoring | When selected, the Application Health Monitoring feature is disabled.
Bypass Traffic on Overload (IPS only) | When selected, the Security Engine dynamically reduces the number of inspected connections if the load is too high. Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection. If this option is not selected, the Security Engine inspects all connections. Some connections might not get through if the IPS engine gets overloaded.
Contact Node Timeout (Not Virtual Engines) | The maximum amount of time the Management Server tries to connect to an Security Engine. A consistently slow network connection might require increasing this value. The default value is 120 seconds. Note: Setting the timeout value too short or too long can delay or prevent contact between the Management Server and the Security Engines.
Auto Reboot Timeout (Not Virtual Engines) | Specifies the length of time after which an error situation is considered non-recoverable and the Security Engine automatically reboots. The default value is 10 seconds. Set to 0 to disable.
Policy Handshake (Not Virtual Engines) | When selected, the nodes automatically roll back to using the previously installed policy if connectivity is lost after installing a new policy. Without this feature, you must switch to the previous configuration manually through the boot menu of the Security Engine. Note: We recommend adjusting the timeout (next setting) rather than disabling this feature completely if there is a need to make changes.
Rollback Timeout (Not Virtual Engines) | The length of time the Security Engine waits for a management connection before it rolls back to the previously installed policy when the Policy Handshake option is active. The default value is 60 seconds.
Automated Node Certificate Renewal (Not Virtual Engines) | When selected, the Security Engine's certificate for system communications is automatically renewed before it expires. Otherwise, the certificate must be renewed manually. Each certificate for system communications is valid for three years. If the certificate expires, other components refuse to communicate with the Security Engine. Note: Does not renew VPN certificates. Automatic certificate renewal for internally signed VPN certificates is set separately in the Security Engine's VPN settings.
FIPS-Compatible Operating Mode (Engines only) (Not Virtual Engines) | When selected, activates a mode that is compliant with the Federal Information Processing Standards (FIPS). Note: You must also select FIPS-specific settings in the Security Engine Configuration Wizard on the command line of the Security Engine. For more information, see How to install Forcepoint Network Security Platform in FIPS mode.
Disable Remote Engine Upgrades (FIPS-Compatible Operating Mode only) | When selected, remote upgrades for Security Engines are disabled in FIPS-compatible operating mode.
Disable sgInfo Creation (FIPS-Compatible Operating Mode only) | When selected, creating sgInfo files for Security Engines is disabled in FIPS-compatible operating mode.
Number of CPUs Reserved for Control Plane (Engines only) (Not Virtual Engines) | Select how many CPUs to reserve for control plane operations. In situations where there is exceptionally high traffic, in a denial of service attack, for example, this ensures that you can still monitor and control the Security Engine operation. Note: The reserved CPUs cannot be used for traffic processing. Using fewer CPUs for traffic processing degrades performance.
Isolate Also Interfaces for System Communications (Engines only) | When selected, the reserved CPUs handle the system communications traffic that pass through the Control Interfaces and dedicated primary Heartbeat Interfaces. We recommend that you only use this option when the Physical Interfaces used for system communications do not handle any other traffic.