# Create Master Engines or Virtual Engines

A Master Engine is a physical engine device that provides the resources for Virtual Engines. One physical Master Engine can support multiple Virtual Engines.

##

Selecting a Virtual Resource for the Virtual Engine automatically adds the Virtual Engine to the Master Engine where the Virtual Resource is used.

For more details about the product and how to configure features, click Help or press F1.

## Steps

1. Select Engine.
2. Select from the following:
   - New > Engine > Master Engine.
   - New > Engine > Virtual Engine.
3. If creating a Master Engine, select the role for the Virtual Engines that this Master Engine will host, then click OK.
   Note: You cannot change the role after you create the Master Engine element.
4. Configure the settings on the branches of the Engine Editor.
   The branches shown can vary depending on the type of Security Engine.
5. To save your changes, click Save.
6. When you have finished making all your changes and want to transfer the configuration to the Security Engine, click Save and Refresh.

## Engine Editor > Common elements

Use the Engine Editor toolbar options to save changes to the configuration and refresh the policy on the Security Engine.

Option | Definition
--- | ---
Save | Validates and saves the changes.
Save and Refresh | Validates and saves the changes, and refreshes the policy on the Security Engine.
More actions menu | Validate — Validates the changes without saving them.

## Engine Editor > General

Use this branch to change general Security Engine settings.

Option | Definition
--- | ---
Name | The name of the element.
Node Name (Optional) | The name of the Security Engine node.
Certificate Settings (Optional) | Allows you to define certificate settings for the Security Engine node for use external certificate management. Click Certificate Settings to create a certificate request for the Security Engine node.
Version (Not available for clusters) | The version of the Forcepoint Network Security Platform software. Not editable.
Status (Not available for clusters) | Shows the configuration status of the Security Engine. Not editable.
Log Server | Specifies the Log Server to which the Security Engine sends event data. If the Security Engine is a Virtual Engine, then you can select one of the following options: Inherit from Master Engine: When selected, the hosted Virtual Engine sends log data to the same Log Server that is used by the Master Engine. Override: When selected, you can select a different configured Log Server to which the log data is sent. For more details on how to configure a log server, refer to the Create additional Log Server elements topic. Note: You can only select one log server at a time for a Virtual Engine.
DNS IP Addresses (Optional) | Specifies the IP addresses of the DNS servers that the Security Engine uses. DNS IP addresses are IP addresses of external DNS servers. Security Engines use these DNS servers to resolve Domain names to IP addresses. Security Engines need DNS resolution to contact services that are defined using URLs or domain names, and to resolve fully qualified domain names (FQDNs) used in policies. (Engine/VPN role only) For DNS relay, specifies the IP addresses of external DNS servers to which the Security Engine forwards DNS requests from clients in the internal network. When DNS relay is configured, these DNS servers are used unless domain-specific DNS servers are specified in a DNS Relay Profile element. If you have configured at least one Physical Interface with a dynamic IP address or one static NetLink with a DNS IP address, the default value of the DNS IP Addresses field is The engine uses NetLink-specific DNS IP addresses. Note: If you have defined NetLink-specific DNS IP addresses, adding DNS IP addresses overrides the NetLink-specific DNS IP addresses. Click Add to add an element to the table, or Remove to remove the selected element. Select one of the following options: IP Address — Adds an IP Address element that represents a single IP address. Network Element — Adds a Network element that represents a network space.
Geolocation | Specifies the geographical location of the Security Engine.
Location | Specifies the location for the Security Engine if there is a NAT device between the Security Engine and other SMC components.
Proof-of-Serial (Appliances only) | Shows the Proof-of-Serial code of the Forcepoint Network Security Platform appliance. Not editable.
Category (Optional) | Includes the element in predefined categories. Click Select to select a category.
Tools Profile | Adds commands to the right-click menu for the element. Click Select to select an element.
Comment (Optional) | A comment for your own reference.

## Engine Editor > General > Clustering

Use this branch to view nodes and add new nodes to the Security Engine cluster.

Option | Definition
--- | ---
Node ID (Not editable) | Shows the ID number of the node.
Name | Specifies the name of the node. Double-click the cell to edit the name.
Configuration Status (Not editable) | Shows the configuration status of the node.
Certificate (Optional) | Shows information about the node's certificate for external certificate management. Right-click the cell, then select Edit Certificate to create a certificate request for the Security Engine node. You must create a separate certificate request for each Security Engine node.
Version (Not editable) | Shows the version of the Security Engine software that is installed on the engine.
Comment (Optional) | A comment for your own reference.
SNMP Location | Specifies the SNMP location string that is returned on queries to the SNMPv2-MIB or SNMPv2-MIB-sysLocation object.
SNMP Engine ID (SNMPv3 only) | A unique identifier for each Security Engine node that is used by the SNMP agent. The engine ID is used with a hash function to generate keys for authentication and encryption of SNMPv3 messages. If you do not specify the SNMP engine ID, an SNMP engine ID is automatically generated.
Disabled | Disables the node. You can enable the node later.
Add Node | Adds a node to the cluster. Opens the Engine Node Properties dialog box.
Edit Node | Allows you to change the properties of the selected node. Opens the Engine Node Properties dialog box.
Remove Node | Deletes the selected node. The deleted node cannot be restored.
Clustering Mode (Not Layer 2 Engines) | Balancing — All nodes are simultaneously online providing enhanced performance and high availability if there is node failure. Balancing mode is the default mode. Standby — Only one node can be online at a time. We recommend having at least one other node on standby to allow automatic takeover if there is failure. Several nodes can be on standby at a time. A randomly selected standby node is turned online when the online node fails. Note: Only standby clustering mode is supported for Layer 2 Engine Clusters.
Clustering | Allows you to change advanced settings for the cluster. Opens the Advanced Cluster Settings dialog box.

## Engine Editor > General > Tester

Use this branch to configure the tester to run various checks on the Security Engines and initiate responses based on the success or failure of these tests.

Note: These settings are not supported for Virtual Engines.

Option | Definition
--- | ---
Global Settings section
Alert Interval | Specify the time in minutes the Security Engine waits before sending a new alert when the same test keeps failing repeatedly. The default value is 60 minutes. If the interval is too short, the alerts can overload the system or the alert recipient.
Delay After | Specify the time in seconds that the Security Engine waits before it resumes running the tests after the listed events. The delay prevents false test failures that can occur due to variations in how quickly different processes and subsystems can start and stop. The maximum value is 1800. Boot — The default is 30 seconds. Reconfiguration — The default is 5 seconds. Status Change — The default is 5 seconds.
Auto Recovery (Clusters and Master Engines only) | When selected, the Security Engine automatically goes back online when a previously failed test completes successfully. Run the test in both online and offline states if you activate this option.
Boot Recovery | When selected, the Security Engine automatically goes back online after restarting if all offline tests report a success.
Global Node Selection for Engine Tests
Filter | Allows you to filter the elements shown.
More actions | A menu that contains various options, such as for creating new elements or showing elements that have been moved to the Trash.
Active | Shows whether the node is included in the tests that have been configured for the engine. Deselect to exclude a node from all Security Engine tests. Tip: If you select ALL for the Node setting in the test properties, you can use the Global Node Selection for Engine Tests table to exclude a specific node from the test.
Name | Specifies the name of the node.
Node | Specifies the node ID.
Set to Default | Returns tester changes to the default settings.

Option | Definition
--- | ---
Engine Tests section
Filter | Allows you to filter the elements shown.
More actions | A menu that contains various options, such as for creating new elements or showing elements that have been moved to the Trash.
Name | The name of the test. If you want to run more than one instance of the same test type with different parameters, give each test a unique name.
Active | Shows whether the test is active. Deselect to deactivate a test.
Node | Specifies whether the test applies to all nodes or a selected node.
Interval | Specifies how often the test is run. The minimum interval is one second and the maximum is 86400 (one day). Note: We recommend a minimum interval of four seconds. Running a test too frequently can increase overhead.
States | Shows the Security Engine states on which the test is run.
Action | Specifies which action is taken if the test fails, and which type of notification is sent.
Parameters | Shows some test details.
Add | Adds a test to the table: External — Runs a custom script stored on the Security Engine. If the script returns the code zero (0), the test is considered successful, otherwise the test is considered failed. File System Space — Checks the free disk space on a hard disk partition. Free Swap Space — Checks the available swap space on the hard disk. Inline Pair Link Speed — Checks whether the network settings (speed/duplex) match on the two ports that form the inline pair and can force ports to use the same settings. Not available in the Engine/VPN role. Link Status — Checks whether a network port reports the link as up or down. Multiping — Sends out a series of ping requests to determine whether there is connectivity through a network link. Policy — This option is included for backward compatibility with legacy software versions.
Edit | Allows you to change the test properties.
Remove | Removes the test from the table.

## Engine Editor > General > Permissions

Use this branch to change permissions settings to control the administration of Security Engines.

Option | Definition
--- | ---
Administrator Permissions section
Access Control Lists | Shows the Access Control Lists that have been selected. Click Add to add an element to the list, or Remove to remove the selected element.
Permissions | Shows the administrators that have permissions. Click Add Permission to add a row to the list, or Remove Permission to remove the selected row. Click the Administrator cell to select the administrator.

Option | Definition
--- | ---
Local Administrators section
Administrator | If local administrators have been defined, shows the names.
Info | Shows whether the local administrator can execute root-level commands with the sudo tool.

Option | Definition
--- | ---
Policies section
Allowed Policies | Shows the policies that are allowed to be installed. Click Add to add an element to the list, or Remove to remove the selected element. To allow the installation of any policy, select Set to ANY.

Option | Definition
--- | ---
Reporting section
E-mail Address(es) | The email addresses to which generated reports are sent when this Security Engine is the sender of log data for the report. To add several addresses, separate the addresses with a comma.

## Engine Editor > General > DNS Relay

Use this branch to enable and configure DNS relay for engines.

Option | Definition
--- | ---
DNS Relay Profile | Allows you to select a DNS Relay Profile element. Select — Opens a dialog box where you can select an existing DNS Relay Profile element. None — Removes the previously selected DNS Relay Profile element. Selecting None deactivates DNS Relay. New — Allows you to create a new DNS Relay Profile element. Opens the DNS Relay Profile Properties dialog box.
Listening IP Addresses | The IP addresses to which clients in the internal network send DNS requests. Click Add to add an element to the list, or Remove to remove the selected element.
Source for Domain-Specific DNS Queries | The IP addresses that are used as source IP addresses when the engine makes domain-specific DNS queries. When According to Routing is selected, the source IP address is automatically selected based on the route to the external DNS server.

## Engine Editor > General > NTP

Use this branch to enable NTP time synchronization and select NTP servers for the Security Engine.

Option | Definition
--- | ---
Enable time synchronization from NTP server | When selected, the Security Engine uses an external NTP server for time synchronization.
Preferred (Optional) | When selected, the Security Engine uses the specified NTP server by default.
NTP Server | Lists the available NTP servers. Double-click the cell to select an NTP server. Click Add to add a row to the table, or Remove to remove the selected row.

## Engine Editor > General > SNMP and LLDP

Use this branch to enable the Security Engine to send SNMP traps and to select the LLDP Profile for the Security Engine.

Note: These settings are not supported for Virtual Engines.

Option | Definition
--- | ---
SNMP section
SNMP Agent | Enables the Security Engine to send SNMP traps. Select — Select an existing SNMP Agent element. None — Disables the sending of SNMP traps. New — Create an SNMP Agent element.
SNMP Location | Specifies the SNMP location string that is returned on queries to the SNMPv2-MIB or SNMPv2-MIB-sysLocation object.
SNMP Engine ID (Single Security Engines and SNMPv3 only) | A unique identifier for the Security Engine that is used by the SNMP agent. The engine ID is used with a hash function to generate keys for authentication and encryption of SNMPv3 messages. If you do not specify the SNMP engine ID, an SNMP engine ID is automatically generated.
Listening IP Addresses | The IPv4 or IPv6 addresses from which SNMP traps are sent. Click Add to add an element to the list, or Remove to remove the selected element.
LLDP section
LLDP Profile (Security Engines and Master Engines in the Engine/VPN role only) | The LLDP Profile element that specifies settings for LLDP announcements that the Security Engine announces. Click Select to select an element.

## Engine Editor > General > Layer 2 Settings

Use this branch to configure settings for layer 2 physical interfaces on Single Engines, Engine Clusters, and Virtual Engines.

Option | Definition
--- | ---
Policy for Layer 2 Interfaces | The Layer 2 Interface Policy that contains rules for traffic detected by layer 2 physical interfaces. All layer 2 physical interfaces on the Security Engine use the same Layer 2 Interface Policy. If there are no layer 2 physical interfaces, this setting is ignored.
Layer 2 Interface Settings section | Defines settings for connection tracking on layer 2 physical interfaces.
Layer 2 Connection Tracking Mode | When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule. You can override this engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules. Normal — The engine drops ICMP error messages related to connections that are not currently active in connection tracking. A valid, complete TCP handshake is required for TCP traffic. The engine checks the traffic direction and the port parameters of UDP traffic. Strict — The engine does not permit TCP traffic to pass through before a complete, valid TCP handshake is performed. Loose — The engine allows some connection patterns and address translation operations that are not allowed in the Normal mode. This mode can be used, for example, if routing is asymmetric and cannot be corrected or if the use of dynamic routing protocols causes the engine to receive non-standard traffic patterns.
Inline IPS and Capture Interface Settings section | Defines advanced settings for Inline IPS Interfaces and Capture Interfaces.
Bypass Traffic on Overload | When selected, the Security Engine dynamically reduces the number of inspected connections if the load is too high. Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection. If this option is not selected, the Security Engine inspects all connections. Some connections might not get through if the engine gets overloaded.

## Engine Editor > Interfaces

Use this branch to configure the necessary interfaces and IP addresses for the Security Engine.

Note: By default, two interfaces 0 and 2 are already added for the predefined engine or when you create a single engine. Where, interface 0 is designated for the external interface, and interface 2 is designated for the internal interface.

Option | Definition
--- | ---
Add | Adds an interface or IP address of the specified type: Layer 3 Physical Interface (Available for Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role) Layer 2 Physical Interface (Available for Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role) Physical Interface (Available for all engine types except Single Engines, Engine Clusters, Virtual Engines, and Master Engines in the Engine/VPN role) VLAN Interface (Available for all engine types) IPv4 Address (Not available for Virtual IPS engines or Virtual Layer 2 Engines) IPv6 Address (Not available for Virtual IPS engines or Virtual Layer 2 Engines) ADSL Interface (Available for Single Engines and Engine Clusters) Tunnel Interface (Available for Single Engines, Engine Clusters, and Virtual Engines) Modem Interface (Available for Single Engines) Wireless Interface (Available for Single Engines) SSID Interface (Available for Single Engines) Switch (Available for Single Engines) Port Group Interface (Available for Single Engines) CAUTION: Physical Interfaces for Virtual Engines are automatically created based on the interface configuration in the Master Engine properties. The number of Physical Interfaces depends on the number of interfaces allocated to the Virtual Engine in the Master Engine. Physical Interfaces that you add to Virtual Engines might not be valid.
Edit | Allows you to change the properties of the interface or IP address.
Remove | Removes the selected interface or IP address.

## Engine Editor > Interfaces > Interface Options

Use this branch to define which IP addresses are used in particular roles in the Security Engine's system communications.

Option | Definition
--- | ---
Control Interface (Not Virtual Engines) | Primary — Specifies the Primary Control IP address for Management Server contact. Backup (Optional) — Specifies the Backup Control IP address that is used if the Primary Control IP address is not available. Note: We recommend that you do not use the IP address of an Aggregated Link interface as the primary or secondary control IP address of the Engine.
Node-Initiated Contact to Management Server | When selected, the Security Engine opens a connection to the Management Server and maintains connectivity. This option is always used with a dynamic control IP address, so it is always selected if the control IP address is dynamic. If the connection is not open when you command the Security Engine through the SMC Client, the command is left pending until the Security Engine opens the connection again. Note: This option is not supported for IPS Clusters, Layer 2 Engine Clusters, or Virtual Security Engines.
Heartbeat Interface (Clusters and Master Engines only) | Primary — Specifies communications between the nodes. We recommend that you use a Physical Interface, not a VLAN Interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation. CAUTION: Primary and Backup Heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information. Backup — Used if the Primary Heartbeat Interface is unavailable. It is not mandatory to configure a backup Heartbeat Interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is interrupted. We strongly recommend that you use a dedicated interface for the backup heartbeat as well. On Master Engines, you cannot use shared interfaces as a heartbeat interface.
IPv4 Identity for Authentication Requests or IPv6 Identity for Authentication Requests | The IPv4 address or IPv6 address of the selected interface is used when an Security Engine contacts an external authentication server. This option does not affect the routing of the connection with the authentication server. The IP address is used only as a parameter inside the authentication request payload to give a name to the request sender.
IPv4 Source for Authentication Requests or IPv6 Source for Authentication Requests | By default, specifies the source IPv4 address or IPv6 address for authentication requests according to routing. If the authentication requests are sent to an external authentication server over VPN, select an interface with a Node Dedicated IP address that you want to use for the authentication requests.
Default IP Address for Outgoing Traffic | Specifies the IP address that the Security Engine uses to initiate connections (such as for system communications and ping) through an interface that has no Node Dedicated IP Address. In clusters, you must select an interface that has an IP address defined for all nodes.

## Engine Editor > Interfaces > Virtual Resources

Use this branch to add Virtual Resources to the Master Engine.

Option | Definition
--- | ---
Add | Adds a Virtual Resource to the Master Engine. Opens the Virtual Resource Properties dialog box.
Edit | Allows you to change the properties of the selected Virtual Resource. Opens the Virtual Resource Properties dialog box.
Remove | Deletes the selected Virtual Resource.

## Engine Editor > Interfaces > Loopback

Use this branch to define loopback IP addresses for Engines. Loopback IP addresses allow you to assign IP addresses that do not belong to any directly connected networks to the Engine.

Option | Definition
--- | ---
Bypass Default IP Address | Specifies how the source IP address for traffic sent from the Security Engine node is selected for tunnel interfaces that do not have IP addresses. Use Loopback IP Address in Unnumbered Tunnel Interface — Uses an IP address listed in the table as the source IP address of traffic sent from the Security Engine node. Use Default Outgoing IP Address in Unnumbered Tunnel Interface — Uses the default outgoing IP address defined in the Interface Options pane as the source IP address of traffic sent from the Security Engine node.
Loopback addresses table | Click Add Row to add a row to the table, or Remove Row to remove the selected row. Click Up or Down to move the selected item up or down.
Loopback Address | Enter the loopback IP address.
CVI Address (Clusters only) | Enter the loopback IP address for the cluster.
Node NDI Address (Clusters only) | Enter the node-specific loopback IP address.
OSPFv2 Area | To advertise the loopback IP address as an OSPFv2 internal route, double-click the cell, then select an OSPFv2 Area element.
Comment (Optional) | A comment for your own reference.

## Engine Editor > Interfaces > ARP Entries

Use this branch to manually add ARP entries for IPv4 or neighbor discover entries for IPv6.

Option | Definition
--- | ---
Type | Static — The ARP entry gives the Security Engine a permanent reference to an IP address/MAC address pair. Proxy — The ARP entry gives the Security Engine a reference to an IP address/MAC address pair for which the Security Engine provides proxy ARP. Proxy ARP is possible only for hosts located in networks directly connected to the Security Engine.
Interface ID | The interface on which you want to apply this ARP entry
IP Addresses | Enter an IPv4 or IPv6 address.
MAC Address | Enter a MAC Address.
Add ARP Entry | Adds an ARP entry.
Remove ARP Entry | Removes the selected ARP entry.

## Engine Editor > Routing

Use this branch to view and change the routing configuration of the Security Engine.

Option | Definition
--- | ---
Filter | Allows you to view only the elements that match what you enter in the Filter field.
Refresh View | Updates the view.
Expand All | Expands all levels of the routing tree.
Collapse All | Collapses all levels of the routing tree.
Display Mode | Changes how the routing configuration is displayed. Tree View — Displays the routing configuration as a tree of interfaces, Router elements, NetLink elements, and destination networks. Table View — Displays the routing configuration as a table of destination networks, routing gateways, interfaces, and NetLink elements.
Default Route | Allows you to view and create default routes that are used when there is no more specific route defined. Note: If the Automatic Default Route setting is selected in the properties of the interface, default routes are created automatically for interfaces with dynamic IP addresses on single Security Engines. Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route. Add — Adds the default route to the routing configuration. Show Default Route — Highlights the default route in the Tree View or the Table View.
Add Route | Allows you to add routes to specific destination networks. Destination — The destination IP address or network. Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route. Add — Adds the route to the routing configuration.
Query Route | Allows you to search for routes. Source — The source IP address. Destination — The destination IP address. Query — Highlights the route in the Tree View or the Table View.

## Engine Editor > Routing > Link Usage

Use this branch to select a Link Usage Profile for an Security Engine and to define link usage exceptions for the Security Engine.

Option | Definition
--- | ---
Link Usage Profile | To enable dynamic link selection for the Security Engine, select a Link Usage Profile element.
Link Usage Profile Properties (read only) (Not editable) | Shows the properties of the selected Link Usage Profile element.
Exceptions to Link Usage Profile table (When a Link Usage Profile element has been selected) Click Add to add a row to the table, or Remove to remove the selected row. Click Up or Down to move the selected item up or down.
Source | The source IP addresses or users that the rule matches. Double-click the cell to select an element. You can also use type-ahead search to select an element.
Destination | The destination IP addresses or users that the rule matches. Double-click the cell to select an element. You can also use type-ahead search to select an element.
Service | The service or Network Application that the rule matches. Double-click the cell to select an element. You can also use type-ahead search to select an element.
ISP Link | The NetLink that traffic that matches the rule uses. Double-click the cell to select an element.
Comment (Optional) | A comment for your own reference.

## Engine Editor > Routing > Dynamic Routing

Use this branch to configure dynamic routing for the engine. Dynamic routing enables engines to automatically change their routing when the network topology changes.

Option | Definition
--- | ---
BGP section
Enabled | When selected, the BGP protocol for dynamic routing is enabled.
Router ID | Enter an ID for the Engine. The ID must be unique. Often, the global IPv4 address is the ID. By default, the Router ID is automatically the loopback CVI address or the highest CVI address available on the Engine Cluster.
BGP Profile | Select the BGP Profile to use. The element contains distance, redistribution, and aggregation settings.
Autonomous System | Select the Autonomous System (AS) to use. An AS represents a whole network or a series of networks.
Announced Networks table | You can add hosts, networks, or groups that contain both hosts and networks. Click Add to add an element to the table, or Remove to remove the selected element.
BMP Router ID | Enter a unique ID for the BMP router.
BMP Router ID Type | Select the ID type for the BMP router from the drop-down list. The following ID types are supported: Type 0 – [0-255]:[0-65535] Type 1 – ipv4:[0-255] Type 2 – [0-65535][0-255]

Option | Definition
--- | ---
OSPFv2 section
Enabled | When selected, the OSPFv2 protocol for dynamic routing is enabled.
Router ID | Enter an ID for the Engine.
OSPFv2 Profile | Select the OSPFv2 Profile to use. The element contains distance, redistribution, and aggregation settings.
Additional Networks to Automatically Add to Antispoofing | Elements that you add are automatically added under all interfaces (that have dynamic routing elements configured) on the Antispoofing branch in the Engine Editor. You can add hosts, networks, or groups that contain both hosts and networks. Click Add to add an element to the table, or Remove to remove the selected element.

Option | Definition
--- | ---
Equal Cost Multi Path Count (Optional, BGP only) | Enter the number of paths in the operating system routing table that have an equal routing priority for multi-path routing.
Additional Networks to Automatically Add to Antispoofing (Optional, all protocols) | Elements that you add are automatically added under all interfaces (that have dynamic routing elements configured) on the Antispoofing branch in the Engine Editor. You can add hosts, networks, or groups that contain both hosts and networks. Click Add to add an element to the table, or Remove to remove the selected element.

## Engine Editor > Routing > Antispoofing

Use this branch to view and change the antispoofing configuration.

Option | Definition
--- | ---
Refresh View | Updates the view.
Expand All | Expands all levels of the routing tree.
Collapse All | Collapses all levels of the routing tree.

## Engine Editor > Routing > Multicast Routing

Use this branch to define static multicast, IGMP-based multicast forwarding, or PIM dynamic routing. Only IPv4 addresses are supported.

Option | Definition
--- | ---
Multicast Routing Mode | Specifies how the Security Engine routes multicast traffic. None — Disables multicast routing. Static — Enables options that allow you to add static routes for multicast traffic. IGMP Proxy — Enables options that allow you to use the Security Engine for IGMP-based multicast forwarding. PIM — Enables options that allow you to use the Security Engine for dynamic routing using PIM.

Option | Definition
--- | ---
When Multicast Routing Mode is Static Click Add to add a row to the table, or Remove to remove the selected row.
Source Interface | Select the interface to use for multicast routing.
Source IP Address | Enter the unicast IP address of the multicast source.
Destination IP Address | Enter the multicast destination IP address. The destination address must be within the multicast range of 224.0.0.0 to 239.255.255.255.
Destination Interface | Right-click Destination Interface, then select Edit Destination Interface to select the interfaces where you want this multicast traffic forwarded.
Comment (Optional) | A comment for your own reference.

Option | Definition
--- | ---
When Multicast Routing Mode is IGMP Proxy
Upstream Interface | Select the interface to use as the upstream interface. If the multicast servers and the hosts are in the local networks, or if you want to limit the multicast to the local networks, it is not necessary to define the upstream interface. In that case, leave Not Set selected.
Upstream IGMP Version | Select the IGMP version according to the upstream network environment. The default IGMP version is version 3.
Downstream Interfaces table Click Add to add a row to the table, or Remove to remove the selected row.
Interface | Select the downstream interfaces.
IGMP Querier Settings | Select an IGMP Querier Settings element according to the downstream network environment. The element defines the IGMP version and query parameters.

Option | Definition
--- | ---
When Multicast Routing Mode is PIM
PIM Profile | Select a PIM Profile to use. The profile contains the multicast groups and determines the PIM mode that is used.
Multicast Routing Preference | Note: This option is not supported in this version of Forcepoint Network Security Platform. The routing table is used to specify reverse path forwarding (RPF) information whenever multicast traffic from source addresses uses a different path than unicast traffic from the same source address. Prefer Best Match — The RPF lookup prefers the best match based on both the default routing table and the Multicast routing (mroute) table. Prefer mroute — The RPF lookup uses the mroute table. If the mroute table cannot be used, the default routing table is used.
Bootstrap Settings — see RFC 5059 for more information.
RP Candidate | If you want to use the engine as a rendezvous point (RP) candidate, select an IP address. Otherwise, select Not a Candidate.
RP Priority | Enter a value for the RP priority.
Multicast Groups | Add the multicast IPv4 networks for which the engine acts as an RP candidate. Click Add to add a row to the table, or Remove to remove the selected row.
BSR Candidate | If you want to use the engine as a bootstrap router (BSR) candidate, select an IP address. Otherwise, select Not a Candidate.
BSR Priority | Enter a value for the BSR priority.

## Engine Editor > Routing > Policy Routing

Use this branch to define policy routing for the Security Engine.

Option | Definition
--- | ---
IPv4 Policy Routes or IPv6 Policy Routes | Enter the routing information in the appropriate table. Click Add to add a row to the table, or Remove to remove the selected row. Click Up or Down to move the selected element up or down.
Source IP Address | Enter the source IP address. This IP address is always something other than the default 0.0.0.0 that matches any IP address. Such configurations can be handled more easily with the normal routing tools in the Routing pane.
Source Netmask (IPv4 only) | Enter the netmask for the source IP address.
Source Prefix (IPv6 only) | Enter the network prefix for the source IP address.
Destination IP Address | Enter the destination IP address.
Destination Netmask (IPv4 only) | Enter the netmask for the destination IP address.
Destination Prefix (IPv6 only) | Enter the network prefix for the destination IP address.
Gateway IP Address | Enter the IP address of the device to which packets that match the source/destination pair are forwarded.
Comment (Optional) | A comment for your own reference.

## Engine Editor > Add-Ons

Use this branch to view a summary of the add-on features and the status of each feature.

## Engine Editor > Add-Ons > Anti-Malware

Use this branch to enable and change settings for anti-malware checks on the Security Engine.

Option | Definition
--- | ---
Enable | Enables anti-malware checks.
Malware Log Level | The log level for anti-malware events. None — Does not create any log entry. Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored. Stored — Creates a log entry that is stored on the Log Server. Essential — Creates a log entry that is shown in the Logs view and saved for further use. Alert — Triggers the alert you select.
Alert | When the Log Level is set to Alert, specifies the Alert that is sent.

Option | Definition
--- | ---
Malware Signature Update Settings section
Update Frequency | Defines how often the Security Engine checks for updates to the anti-malware database. Never — The Security Engine does not check for updates. You must update the anti-malware database manually. When Anti-Malware Daemon Starts — Checks when the anti-malware daemon starts. The daemon starts, for example, when the anti-malware feature is enabled or when the Security Engine restarts. Every Hour — Checks for updates once an hour. Daily — Checks for updates once a day. Set the time of day. Weekly — Checks for updates once a week. Set the day and time of day.

Option | Definition
--- | ---
Malware Signature Mirror Settings section
Mirror(s) | Enter the URL of the anti-malware database mirror that the Security Engine contacts to update the anti-malware database. Separate multiple addresses with commas.
Use HTTP Proxy (Optional) | Specifies that the Security Engine uses an HTTP proxy to connect to the anti-malware database mirrors.
Host | The IP address or DNS name of the HTTP proxy.
Port | The listening port of the HTTP proxy.
Username | The user name for authenticating to the HTTP proxy.
Password | The password for authenticating to the HTTP proxy. By default, passwords and keys are not shown in plain text. To show the password or key, deselect the Hide option.

## Engine Editor > Add-Ons > Data Protection

Use this branch to enable ICAP for data protection on the Security Engine.

Option | Definition
--- | ---
Enable ICAP for data protection | When selected, the Security Engine sends files to the specified ICAP servers for DLP scanning.
ICAP Servers list Click Add to add an element to the list, or Remove to remove the selected element. If you add multiple ICAP servers, traffic is balanced between the ICAP servers.

## Engine Editor > Add-Ons > Endpoint Integration

Use this branch to enable endpoint integration on the engine and change the settings for the endpoint client communication.

Option | Definition
--- | ---
When Endpoint Service is Forcepoint Endpoint Context Agent
ECA Listener Certificate | The internal certificate for the Security Engine that listens for Forcepoint One Endpoint traffic. The certificate is generated automatically when you save the Forcepoint One Endpoint configuration.
Signing CA | The internal CA that signed the certificate.
ECA Configuration | The selected ECA Configuration element. Click Select to select an element.
Source Networks | Add the networks or zones that contain the Forcepoint One Endpoint clients. The Forcepoint One Endpoint clients located in these networks or zones send endpoint information to this Engine. Click Add to add an element to the table, or Remove to remove the selected element.
Destination Networks | Add the networks or zones where outbound connections are going. The Forcepoint One Endpoint clients send endpoint information only if the destination address is located in these networks or zones. If filtering based on both source address and destination address, both conditions must be met. Click Add to add an element to the table, or Remove to remove the selected element.
Listening Interfaces | The interfaces or zones the Security Engine uses to listen for Forcepoint One Endpoint traffic. Click Add to add an element to the table, or Remove to remove the selected element.
Listening Port | The port on which the Security Engine listens for Forcepoint One Endpoint traffic.
Export Configuration for Endpoint Clients | Opens the Export ECA Configuration dialog box, where you can export an XML file that contains the Forcepoint One Endpoint configuration and details of all the Security Engines that use the same ECA Configuration element. You must first save the Security Engine configuration.

## Engine Editor > Add-Ons > File Reputation

Use this branch to enable file reputation services for file filtering.

Option | Definition
--- | ---
File Reputation Service | Select the file reputation service to use. None — Disables file reputation services. Global Threat Intelligence (GTI) — Enables the use of McAfee GTI file reputation services for file filtering.

Option | Definition
--- | ---
When File Reputation Service is Global Threat Intelligence (GTI)
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Click Add to add an element to the list, or Remove to remove the selected element. Note: You can only use one HTTP proxy for the connection to the McAfee Global Threat Intelligence file reputation service. If you select more than one HTTP proxy, the additional HTTP proxies are ignored.

## Engine Editor > Add-Ons > IPv6 Transition Mechanism

Use this dialog to enable IPv6 transition mechanisms that enable communication between devices that have only IPv4 addresses and devices that have only IPv6 address.

Option | Definition
--- | ---
Type | Select one of the following translation modes: NAT64: Allows only IPv6 connectivity to customers while still enabling access to servers that have only IPv4 address. Following fields need to be set: Local IPv4 pools: IPv4 addresses used in translation. NAT64 IPv6 prefix: 32,40,48,56,64 or 96 bit IPv6 prefix. IPv6 addresses matching this prefix will be translated to IPv4 addresses. (96 bit prefix recommended). Static mappings (Optional): Can be used to ensure that specific IPv6 address & port combination will be always translated to specific IPv4 address & port combination. IPv4 address must be from the local IPv4 pool. 464XLAT CLAT: Enables IPv4-only applications to work on IPv6-only networks. Following fields need to be set: Local IPv6 Prefix: 32,40,48,56,64, or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating local IPv4 addresses. Surrounding network must route traffic matching this prefix to Security Engine. Remote IPv6 Prefix: 32,40,48,56,64 or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating non-local IPv4 addresses. This prefix must match the NAT64 prefix configured to the remote 464XLAT PLAT. SIIT EAM: Allows any IPv4 address to be converted to an IPv6 address by way of one simple configurable IPv6 prefix. Following fields need to be set: Default IPv6 Address pool: 32,40,48,56,64 or 96 bit IPv6 prefix (96 bit prefix recommended) which will be used when translating between IPv4 and IPv6 addresses. This prefix will be used when explicit mapping entries are not matching. SIIT EAM Mappings (Optional): Combination of IPv4 network prefix and IPv6 prefix definition. IPv4 prefix value must have identical or smaller number of suffix bits than its corresponding IPv6 prefix value.

## Engine Editor > Add-Ons > OPC UA Inspection

Use this branch to change inspection settings for open platform communications unified architecture (OPC UA). For information about OPC UA, see Knowledge Base article 12491.

## Engine Editor > Add-Ons > HTTP/3 (QUIC) Inspection

Use this dialog box to activate HTTP/3 inspection.

Option | Definition
--- | ---
Include QUIC ports for Web Traffic | This option is enabled by default and activates QUIC inspection to the application traffic.
Discard HTTP/3 if Decryption is configured for the Connection | When this option is selected, any QUIC or HTTP/3 traffic that is configured to be inspected with decryption (TLS inspection) is discarded. As a result, browsers then typically fall back to using HTTP/2. Note: When configuring QUIC inspection it is recommended to select this option to ensure that traffic configured for inspection does not pass through uninspected. When configuring HTTP/3 inspection this option must be unselected.

## Engine Editor > Add-Ons > Sandbox

Use this branch to select and configure sandbox servers for Security Engines.

Option | Definition
--- | ---
Sandbox Type | Specifies which type of sandbox the Security Engine uses for sandbox file reputation scans. None — The Security Engine does not use a sandbox. Cloud Sandbox - Advanced Malware Detection & Protection — The engine uses the Advanced Malware Detection & Protection cloud service for sandbox analysis and file reputation scan. Note: This is a licensed service which requires a subscription to use. Local Sandbox - Advanced Malware Detection & Protection — The engine uses the Advanced Malware Detection & Protection cloud service for sandbox analysis and file reputation scan. Note: This is a licensed service which requires a local AMDP server to use. Cloud Sandbox - Advanced Malware Detection — The engine uses the cloud sandbox for Forcepoint Advanced Malware Detection. Local Sandbox - Advanced Malware Detection — The engine uses the local sandbox for Forcepoint Advanced Malware Detection. Note: To use the local sandbox for Forcepoint Advanced Malware Detection, you must have a Forcepoint Advanced Malware Detection appliance.

Option | Definition
--- | ---
When Sandbox Type is Cloud Sandbox - Advanced Malware Detection & Protection
Sandbox Service | Specifies the sandbox service that the engine contacts to request a file reputation with the file hash (SHA256), and if not found, sends the file for sandbox analysis. Click Select to select an element.
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Add — Allows you to add an HTTP Proxy to the list. Remove — Removes the selected HTTP Proxy from the list.

Option | Definition
--- | ---
When Sandbox Type is Cloud Sandbox - Advanced Malware Detection
License Key (Optional) | The license key for the connection to the sandbox server. If you have not entered a license key in the properties of the Sandbox Service element, you must enter a license key here. If you have entered a license key in the properties of the Sandbox Service element, you can optionally enter a license key here to override the global setting. Note: The license defines the home data center where files are analyzed. Enter the key and license token for the data center that you want to use as the home data center. CAUTION: The license keys and license tokens allow access to confidential analysis reports. Handle the license key and license token securely.
License Token (Optional) | The license token for the connection to the sandbox server. If you have not entered a license token in the properties of the Sandbox Service element, you must enter a license key here. If you have entered a license token in the properties of the Sandbox Service element, you can optionally enter a license token here to override the global setting.
Sandbox Service | Specifies the sandbox service that the engine contacts to request file reputation scans. Click Select to select an element.
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Add — Allows you to add an HTTP Proxy to the list. Remove — Removes the selected HTTP Proxy from the list.

Option | Definition
--- | ---
When Sandbox Type is Local Sandbox - Advanced Malware Detection & Protection
Sandbox Service | Specifies the sandbox service that the engine contacts to request file reputation scans. Click Select to select an element.
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Add — Allows you to add an HTTP Proxy to the list. Remove — Removes the selected HTTP Proxy from the list.

Option | Definition
--- | ---
When Sandbox Type is Local Sandbox - Advanced Malware Detection
License Key (Optional) | The license key for the connection to the sandbox server. If you have not entered a license key in the properties of the Sandbox Service element, you must enter a license key here. If you have entered a license key in the properties of the Sandbox Service element, you can optionally enter a license key here to override the global setting.
License Token (Optional) | The license token for the connection to the sandbox server. If you have not entered a license token in the properties of the Sandbox Service element, you must enter a license key here. If you have entered a license token in the properties of the Sandbox Service element, you can optionally enter a license token here to override the global setting.
Sandbox Service | Specifies the sandbox service that the engine contacts to request file reputation scans. Click Select to select an element.
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Add — Allows you to add an HTTP Proxy to the list. Remove — Removes the selected HTTP Proxy from the list.

## Engine Editor > Add-Ons > Sidewinder Proxy

Use this branch to enable and configure Sidewinder Proxies.

Option | Definition
--- | ---
Enable | When selected, enables Sidewinder Proxy.
Sidewinder Logging Profile | The selected Sidewinder Logging Profile element for the engine. Click Select to open the Select Element dialog box, where you can select a Sidewinder Logging Profile.
SSH Proxy | Settings specific to the SSM SSH Proxy.
SSH Known Hosts Lists | The selected SSH Known Hosts List elements for the engine. Click Add to add an element to the list, or Remove to remove the selected element.
Host Keys | The SSH host keys used by the engine when it acts as the SSH server in a connection that uses the SSM SSH Proxy. Click Add to add a row to the table, or Remove to remove the selected row. To import an existing host key, click Import.
Key Type | Shows the signature algorithm used for the host key.
Key Length | Shows the length of the host key.
SHA256 Fingerprint | Shows the SHA256 fingerprint of the host key.
SSH Proxy Services | The SSH Proxy Service element with which the host key is used. Double-click the field to open the Select Element dialog box, where you can select a Service element.
Comment (Optional) | A comment for your own reference.
Advanced Settings | Opens the Advanced Sidewinder Proxy Settings dialog box.

## Advanced Sidewinder Proxy Settings dialog box

These settings are intended for advanced users. We do not recommend changing these settings unless you are instructed to do so by Forcepoint Technical Support.

Note: On Master Engines, these settings are shown in the Add-Ons > Sidewinder Proxy branch of the Engine Editor.

Option | Definition
--- | ---
Shared tab
Use this tab to define advanced Sidewinder Proxy settings that are shared by all SSM Proxies. Click Add to add a row to the table, or Remove to remove the selected row.
Shared Proxy Property | The name of the shared advanced Sidewinder Proxy setting.
Value | The value of the advanced Sidewinder Proxy setting.

Option | Definition
--- | ---
HTTP tab
Use this tab to define advanced Sidewinder Proxy settings for the SSM HTTP Proxy. Click Add to add a row to the table, or Remove to remove the selected row.
HTTP Proxy Property | The name of the advanced HTTP Sidewinder Proxy setting.
Value | The value of the advanced Sidewinder Proxy setting.

Option | Definition
--- | ---
SSH tab
Use this tab to define advanced Sidewinder Proxy settings for the SSM SSH Proxy. Click Add to add a row to the table, or Remove to remove the selected row.
SSH Proxy Property | The name of the advanced SSH Sidewinder Proxy setting.
Value | The value of the advanced Sidewinder Proxy setting.

Option | Definition
--- | ---
TCP tab
Use this tab to define advanced TCP Sidewinder Proxy settings for the SSM TCP Proxy. Click Add to add a row to the table, or Remove to remove the selected row.
TCP Proxy Property | The name of the advanced Sidewinder Proxy setting.
Value | The value of the advanced Sidewinder Proxy setting.

Option | Definition
--- | ---
UDP tab
Use this tab to define advanced Sidewinder Proxy settings for the SSM UDP Proxy. Click Add to add a row to the table, or Remove to remove the selected row.
UDP Proxy Property | The name of the advanced UDP Sidewinder Proxy setting.
Value | The value of the advanced Sidewinder Proxy setting.

## Engine Editor > Add-Ons > Snort

Use this branch to override settings in the global Snort configuration for specific Security Engines.

Note: These settings are not supported for Master Engines or Virtual Engines.

Option | Definition
--- | ---
Enable | When selected, enables Snort inspection for the Security Engine. Note: To apply Snort inspection to traffic, you must also create Access rules to select traffic for Snort inspection.
Snort Configuration (Optional) | The externally created Snort configuration .zip file that contains the Snort configuration files and rules for Snort inspection. Click Browse to select a file. Click None to remove a previously imported file. Click Export to export the Snort configuration file. All Security Engines for which Snort inspection is enabled use the global Snort configuration by default. If you do not want to override settings in the global Snort configuration, it is not necessary to import a Snort configuration file for an individual Security Engine. Settings in the Snort configuration .zip file for an individual Security Engine are combined with the settings in the global Snort configuration .zip file. If any configuration files in a Snort configuration .zip file for an individual Security Engine have the same files name and paths as configuration files in the global Snort configuration .zip file, the overlapping files in the global Snort configuration .zip file are ignored.

## Engine Editor > Add-Ons > TLS Inspection

Use this branch to activate TLS inspection. You can configure TLS inspection for client or server protection.

Note: These settings are not supported for Master Engines.

Option | Definition
--- | ---
Client Protection Certificate Authority | Select the Client Protection Certificate Authority element to use for client protection.
TLS Credentials | Specifies the Server Protection Credentials elements that are used for server protection. Click Add to add an element to the list, or Remove to remove the selected element.
Check Certificate Revocation | When selected, the Security Engine uses CRL or OCSP to check whether certificates have been revoked.
Decrypt All Traffic | When selected, the Security Engine forces all traffic to be decrypted. When the checkbox is not selected, the Security Engine either decrypts or does not decrypt traffic according to the settings in TLS Match elements.
Cryptography Suite Set (TLS 1.2 and lower) | Specifies the TLS Cryptography Suite Set element that defines which cryptographic algorithms are allowed for TLS traffic that is decrypted for TLS Client Protection. Click Select to select an element. Note: If you use TLS 1.3 with Security Engine version 6.11 or higher, the Security Engine decrypts all supported TLS 1.3 cryptographic algorithms.

## Engine Editor > Add-Ons > ThreatSeeker

Use this branch to select HTTP Proxy elements for the connection to the ThreatSeeker Intelligence Cloud.

Option | Definition
--- | ---
Enable | When selected, enables ThreatSeeker URL filtering for the engine.
HTTP Proxies (Optional) | When specified, requests are sent through an HTTP proxy instead of the engine accessing the external network directly. Add — Allows you to add an HTTP Proxy to the list. Remove — Removes the selected HTTP Proxy from the list.
URL Categorization | Select one of the following options: ThreatSeeker Cloud Service: When selected, the ThreatSeeker URL Categorization cloud database is used for the URL filtering. Note: By default, this option is selected. Local (with Database Download): When selected, the locally downloaded ThreatSeeker URL Categorization database is used for the URL filtering. Note: The Security Engine must have a minimum of 16 GB of memory to use the locally downloaded ThreatSeeker URL Categorization database. When the Local (with Database Download) option is selected the entire ThreatSeeker URL Categorization database is automatically downloaded and is made locally available to the engine. The local database is automatically updated over the internet whenever updates are available. If the ThreatSeeker Cloud Service option is selected after the Local (with Database Download) option was selected, the locally downloaded database will be automatically deleted.

## Engine Editor > Add-Ons > User Authentication

Use this branch to enable user authentication. You can configure authentication using HTTP connections or encrypted HTTPS connections.

Option | Definition
--- | ---
Authentication Time-Out | Defines the length of time after which authentication expires and users must re-authenticate.
Authentication Idle Time-Out | Defines an idle timeout for user authentication. If there have been no new connections within the specified time limit after the closing of a user's previous connection, the user is removed from the list of authenticated users.
HTTP | When selected, allows authentication using plain HTTP connections. Change the Port number if you want to use a different port for the authentication interface. The default port is 80.
HTTPS | When selected, allows authentication using encrypted HTTPS connections. Change the Port number if you want to use a different port for the authentication interface. The default port is 443. This option is required for client certificate authentication.
HTTPS Settings | Opens the Browser-Based User Authentication HTTPS Configuration dialog box.
TLS Profile | The TLS Profile element that defines TLS settings for HTTPS connections for authentication, and the trusted certificate authority for client certificate authentication. Click Select to select an element. This option is required for client certificate authentication.
Use Client Certificates for Authentication | When selected, the Security Engine allows users to authenticate using X.509 certificates. Client certificate authentication is supported for browser-based user authentication.
Always Use HTTPS | When selected, redirects connections to the HTTPS port and enforces the use of HTTPS if the Security Engine also listens on other ports.
Listen on Interfaces | Restricts the interfaces that users can authenticate through. All — Users can authenticate through all interfaces. Selected — Users can only authenticate through the selected interfaces.
User Authentication Page | Select the User Authentication Page element that defines the look of the logon, challenge, re-authentication, and status page shown to end users when they authenticate.
Enable Session Handling (Optional) | When selected, enables cookie-based strict session handling. Note: When Enable Session Handling is selected, the Authentication Idle Time-Out option is not available. The Refresh Status Page Every option defines the authentication timeout.
Refresh Status Page Every (Optional) | Defines how often the status page is automatically refreshed. When Enable Session Handling is selected, defines the authentication timeout.
Enable SAML | When selected, enables SAML authentication for browser-based user authentication. Note: This feature is only supported for HTTPS connections.
Clock Skew Limit | Enter the maximum allowed time difference in seconds between the Service Provider and the Identity Provider.
Add | Click Add to add a row to the table. The table includes the following columns: Note: To enter details in the row, double-click the field in the column to open the dialog box. Authentication Method: Select the authentication method element to use for the Browser-based SAML authentication. For more details on how to create a SAML Authentication method, refer to the Create a SAML authentication method element topic. Service Entity ID: Enter the Service Provider Entity ID. Note: You must configure the Service Entity ID in both the IdP and the Engine. The Service Provider Entity ID that is configured in the IdP must match the Service Provider Entity ID that is configured in the Engine. IdP Metadata: Enter the IdP Metadata details to establish trusted and secure communication with the Identity Provider (IdP). For more details, refer to the Create a SAML authentication method element topic. Note: If IdP metadata has already been configured for the selected authentication method and you reconfigure it here, the new IdP metadata will overwrite the existing configuration for that authentication method. This overwrite applies only to browser-based user authentication. ACS URL: Enter the URL where the SAML assertion is sent after login. For example, https://xxy.xxyxyx.com:9443/sso/saml. Wherein, xxy.xxyxyx.com is the hostname of the browser-based authentication and 9443 is the same port that is defined for the browser-based authentication. Note: You must configure the ACS URL in both the IdP and the Security Engine. The ACS URL that is configured in the IdP must match the ACS URL that is used in the Engine. The IP Address and the port used in the ACS URL must match the browser-based user authentication interface IP Address and port.
Remove | Select a row in the table and then click Remove to remove the row.

## Browser-Based User Authentication HTTPS Configuration dialog box

Use this dialog box to change the properties of an HTTPS certificate for browser-based user authentication.

Option | Definition
--- | ---
Organization (O) (Optional) | The name of your organization as it appears in the certificate.
Organization Unit (OU) (Optional) | The name of your department or division as it appears in the certificate.
State/Province (ST) (Optional) | The name of state or province as it appears in the certificate.
Locality (L) (Optional) | The name of the city as it appears in the certificate.
Common Name (CN) | The value for the Common Name field in the certificate request. For server certificates, the value is typically the fully qualified domain name (FQDN).
Key Length | The length of the key in bits.
Sign
With External Certificate Authority | Select this option if you want to create a certificate request that another certificate authority signs.
Internally with | Select this option to sign the certificate using an internal CA. If more than one valid internal CA is available, select the internal CA that signs the certificate request. There can be multiple valid internal CAs in the following cases: There is both an Internal RSA CA for Gateways and an Internal ECDSA CA for Gateways. The Internal CA for Gateways is in the process of being renewed and both the previous CA and the new CA are temporarily available.
Generate Request | Generates the request. The certificate request is shown in the same dialog box.

Option | Definition
--- | ---
Certificate Request — if signing with an external certificate authority
Subject Name | The identifier of the certified entity.
Export | Opens the Export Certificate Request dialog box.
Import Certificate | Opens the Import Certificate dialog box.
Delete | Deletes the certificate request.
Sign Internally | Signs the certificate with the Internal CA. If more than one valid internal CA is available, opens the Sign Certificate Request dialog box.

Option | Definition
--- | ---
Certificate Request — if signing with an internal certificate authority
Subject Name | The identifier of the certified entity.
Public Key Algorithm | The algorithm used for the public key.
Key Length | The length of the key in bits.
Serial Number | The sequence number of the certificate. The number is issued by the CA.
Signature Algorithm | The signature algorithm that was used to sign the certificate.
Signed By | The CA that signed the certificate.
SubjectAltName | The subject alternative name fields of the certificate.
Valid From | The start date of certificate validity.
Valid To | The end date of certificate validity.
Fingerprint (SHA-1) | The certificate fingerprint using the SHA-1 algorithm.
Fingerprint (SHA-256) | The certificate fingerprint using the SHA-256 algorithm.
Fingerprint (SHA-512) | The certificate fingerprint using the SHA-512 algorithm.
Export | Opens the Export Certificate dialog box.
Delete | Deletes the certificate request.

## Export Certificate Request dialog box

Use this dialog box to export a certificate request to sign using an external certificate authority.

Option | Definition
--- | ---
Certificate request field | Shows the certificate request as text. You can copy and paste the certificate request into an external application to sign the certificate.
Export | Exports the certificate request so that you can sign it using an external certificate authority. Opens the Export Certificate Request dialog box.

## Engine Editor > Add-Ons > User Identification

Use this branch to select a User Identification Service element.

Note: These settings are not supported for Master Engines or Virtual Engines.

Option | Definition
--- | ---
User Identification Service | The Forcepoint User ID Service and Integrated User ID Service provide user, group, and IP address information that can be used in transparent user identification. The Integrated User ID Service is primarily meant for demonstration purposes and proof-of-concept testing of user identification services. Select — Allows you to select an existing Forcepoint User ID Service or Integrated User ID Service element. None — Disables transparent user identification. Note: For Forcepoint Network Security Platform version 6.4 or higher, we recommend that you use the Forcepoint User ID Service.
Network Filters section (When a Forcepoint User ID Service element is selected)
IP Ranges (Optional) | To prevent the Security Engine from receiving too many logon events, specify the IP address ranges of networks from which to receive logon events. Click Add to add an element to the list, or Remove to remove the selected element. We recommend adding the IP address ranges of networks for which the Security Engine routes traffic. Note: Network filters do not exclude other IP addresses outside of the specified IP address range if a user has at least one logon in the specified IP address range. The Security Engine might still receive logon events from other IP address ranges.

## Engine Editor > Add-Ons > ZTNA Connector

From 7.0 version onwards, ZTNA Connector is integrated with engine.

This dialog box is used to enable the ZTNA connector so that, the connector is downloaded and installed automatically to the Engine. The Engine can be used as a connection point for applications that you might want to publish through FONE portal by using Forcepoint Network Security Platform as ZTNA connector. For more information about the ZTNA connector, see Zero Trust Network Access section in Forcepoint ONE Admin Guide.

Option | Definition
--- | ---
Enable | When selected this option, the ZTNA Connector is downloaded and installed automatically to the Engine.
ZTNA Installer Key | This installer key is required to fetch the ZTNA connector image from Forcepoint ONE. You can generate installer key in the Forcepoint ONE management portal.
Data Center | This is the site name given for the ZTNA connector in Forcepoint ONE.
Auto-update | When selected this option, the Engine checks if there is a newer version of ZTNA connector available during policy refresh.

Note: Make sure to modify the access rules to allow connections from the Engine to applications.

## Engine Editor > Policies

Use this branch to view information about the policy that is installed.

## Engine Editor > Policies > Element-based NAT

Use this branch to add NAT definitions for element-based NAT. The NAT definition is also added to the elements that are included in the NAT configuration.

Option | Definition
--- | ---
Use Default NAT Address for Traffic from Internal Networks | Select an option to define how the Security Engine uses the default NAT address. On — The Security Engine always uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic. Off — The Security Engine never uses the default NAT address as the public IP address. Automatic — The Security Engine automatically determines whether to use the default NAT address based on the routing configuration. If there are routes that use NetLinks, the Security Engine uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic. When you select On or Automatic, a NAT rule is generated at the end of the IPv4 or IPv6 NAT rules in the policy.
Show Details | Opens the Default NAT Address Properties dialog box.
Add NAT Definition | Creates a NAT Definition element and opens the element properties.
Edit NAT Definition | Opens the properties of an existing NAT Definition element.
Remove NAT Definition | Removes the selected row from the table.

## Engine Editor > Policies > Automatic Rules

Use this branch to view a summary of currently used Automatic rules and change general settings for Automatic rules.

Option | Definition
--- | ---
To Engine section (Engine/VPN role only)
Allow Traffic to Authentication Ports | When Yes is selected, allows traffic to the ports that are used for user authentication.
Allow Traffic from Listening IP Addresses to DNS Relay Port | When Yes is selected, allows traffic from clients in the internal network to the standard DNS ports (53/TCP and 53/UDP) on the interfaces that are selected as listening interfaces for DNS relay.
From Engine section (Engine/VPN role only)
Allow Connections to Domain-Specific DNS Servers | When Yes is selected, allows connections from the engine to the domain-specific DNS servers specified in the DNS Relay Profile element that is selected for engine.
Allow Connections from Local DHCP Relay to Remote DHCP Server | When Yes is selected, allows connections from interfaces on which DHCP relay is active to remote DHCP servers. Note: To relay DHCP messages through a policy-based VPN, you must add specific Access rules to allow the traffic. The Access rules must refer to the correct policy-based VPN.
Log Level for Automatic Rules | The log level for traffic that matches automatic rules. None — Does not create any log entry. Alert — Triggers an alert entry. Essential — Creates a log entry that is shown in the Logs view and saved for further use. Stored — Creates a log entry that is stored on the Log Server. Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored.
Alert | When the Log Level is set to Alert, specifies the Alert that is sent.
Reset to Default Settings | Returns Automatic Rule changes to the default settings.

## Engine Editor > Policies > Aliases

Use this branch to view and change alias translation values.

Option | Definition
--- | ---
Alias | Shows the name of the Alias element.
Value | Right-click the Value cell and select one of the following options: Edit Value — Opens the Alias Value Properties dialog box. Set to Any — The Alias element matches any value. Set to None — Disables translation for the Alias element.

## Engine Editor > VPN

Use this branch to view the VPN Gateway elements associated with the Security Engine, and the VPN where the VPN Gateway elements are used. You can optionally add more VPN Gateway elements.

Option | Definition
--- | ---
Add (Optional) | Adds a VPN Gateway element to the Security Engine. One VPN Gateway element is automatically created for each Security Engine. You can use the same VPN Gateway element in multiple VPN. You might need to add VPN Gateway elements if you want to use different endpoint IP addresses in different types of VPN. Click Remove to remove the selected element.
Endpoints
Enabled | When selected, the endpoint IP address is active.
Edit | Opens the Properties dialog box for the endpoint.

## Engine Editor > VPN > Endpoints

Use this branch to change the endpoint settings that are used when the Security Engine acts as a VPN gateway.

Option | Definition
--- | ---
Enabled | When selected, the endpoint IP address is active.
Name | Shows the name of the endpoint. If the endpoint does not have a descriptive name, the IP address of the endpoint is shown.
IP Address | Shows the IP address of the endpoint.
Connection Type | Defines how the endpoint is used in a Multi-Link configuration.
Options | Shows the optional settings that have been selected for the endpoint.
Phase-1 ID | Shows the value of the phase-1 ID that identifies the gateway during the IKE phase-1 negotiations.
VPN Type | Shows the types of VPNs that the endpoint can be used in.
Edit | Allows you to change the properties of the selected endpoint.

## Engine Editor > VPN > Application Access Portal

Use this branch to change settings for the Application Access Portal on the Security Engine.

Option | Definition
--- | ---
Application Access Portal | Shows the Application Access Portal element that is selected for the Security Engine. Click Select to select an element.
Port (Optional) | The port for client connections to the Application Access Portal. The default port is 443.
Allowed SSL/TLS Versions | The versions of SSL and TLS that are allowed for connections to the Application Access Portal. SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2
TLS Cryptography Suite Set | The cryptographic suite for TLS connections to the Application Access Portal. Click Select to select an element. Do not change the default setting unless you have a specific reason to do so.
Enable SAML | When selected, it enables SAML authentication for Application Access Portal.
Clock Skew Limit | Enter the maximum allowed time difference in seconds between the Service Provider and the Identity Provider.
Add | Click Add to add a row to the table. The table includes the following columns: Note: To enter details in the row, double-click the field in the column to open the dialog box. Authentication Method: Select the authentication method element to use for the Application Access Portal. Service Entity ID: Enter the Service Provider Entity ID. Note: You must configure the Service Entity ID in both the IdP and the Engine. The Service Provider Entity ID that is configured in the IdP must match the Service Provider Entity ID that is configured in the Engine. IdP Metadata: Enter the IdP Metadata details to establish trusted and secure communication with the Identity Provider (IdP). For more details, refer to the Create a SAML authentication method element topic. Note: If IdP metadata has already been configured for the selected authentication method and you reconfigure it here, the new IdP metadata will overwrite the existing configuration for that authentication method. This overwrite applies only Application Access Portal. ACS URL: Enter the URL where the SAML assertion is sent after login. For example, https://xxy.xxyxyx.com:9443/sso/saml. Wherein, xxy.xxyxyx.com is the hostname of the Application Access Portal and 9443 is the same port that is defined for the Application Access Portal. Note: You must configure the ACS URL in both the IdP and the Security Engine. The ACS URL that is configured in the IdP must match the ACS URL that is used in the Engine. The IP Address and the port used in the ACS URL must match the browser-based user authentication interface IP Address and port.
Remove | Select a row in the table and then click Remove to remove the row.

## Engine Editor > VPN > Sites

Use this branch to select the protected IP addresses that are behind the gateway.

Option | Definition
--- | ---
Add and update IP addresses based on routing | When selected, the site content updates automatically according to changes made in the routing configuration for the Security Engine (for interfaces that are not disabled). Note: When the option is not selected, you must manually define the addresses that you want to be routable through the VPN.
Search | Opens a search field for the selected list.
Up | Navigates up one level in the navigation hierarchy. Not available at the top level of the navigation hierarchy.
More actions | New — Creates an element of the specified type. Show Deleted Elements — Shows elements that have been moved to the Trash.
Left pane | Shows elements that you can add to the site definition.
Add | Adds the selected element to the site content.
Remove | Removes the selected element from the site content.
Search | Opens a search field for the selected element list.
Up | Navigates up one level in the navigation hierarchy. Not available at the top level of the navigation hierarchy.
New | Creates an element of the specified type.
More actions | Expand All — Expands all levels of the status tree. Collapse All — Collapses all levels of the status tree. Refresh View — Updates the view.
Right pane | Allows you to change the IP addresses that are included in the site definition.

## Engine Editor > VPN > VPN Client

Use this branch to change settings that are used when the Security Engine acts as a VPN Gateway in a mobile VPN.

Option | Definition
--- | ---
Gateway Display Name | If you want to show a different name for the Gateway to Mobile VPN users, enter the name for the VPN Gateway element.
VPN Type | Defines the type of tunnels the mobile VPN supports. IPsec VPN — The mobile VPN only supports IPsec tunnels. SSL VPN — The mobile VPN only supports SSL VPN tunnels. Both IPsec & SSL VPN — The mobile VPN supports IPsec and SSL VPN tunnels.
SSL Port | (When VPN Type is SSL VPN) The port for SSL VPN tunnels.
TLS Cryptography Suite Set | (When VPN Type is SSL VPN) The cryptographic suite for SSL VPN tunnels. Click Select to select an element. Note: Do not change the default setting unless you have a specific reason to do so.
Authentication Timeout | (When VPN Type is SSL VPN) The timeout for Forcepoint VPN Client user authentication.
Enable DTLS | (When VPN Type is SSL VPN) When selected, Datagram Transport Layer Security (DTLS) is enabled for the SSL enabled endpoints of the configured gateway. DTLS is a new optional secure encapsulation method that uses UDP protocol instead of TCP for traffic tunneling under TLS layer. It may increase tunnel performance in challenging network conditions. DTLS is automatically used when all of the following conditions are true: DTLS is enabled on the gateway configuration of the security engine. Both the client and the security engine are using versions that support DTLS. The client user has not disabled DTLS locally on the client. The network path from the client to the gateway endpoint does not block DTLS. If any of the above conditions are not met, a TCP based TLS connection continues to be used for SSL VPN connections. DTLS operates over the same port as the TLS based tunnel but uses UDP instead of TCP. Note: DTLS is not enabled for all endpoints. It is only available for SSL-enabled endpoints.

Option | Definition
--- | ---
Local Security Checks section (Forcepoint VPN Client for Windows only) | Defines whether the Forcepoint VPN Client for Windows checks for the presence of basic security software to stop connections from risky computers. Anti-Virus is enabled — Requires anti-virus software to be enabled on the computers of mobile VPN users. Firewall is enabled — Requires firewall software to be enabled on the computers of mobile VPN users. Windows Update is enabled — Requires the Windows Update service to be enabled on the computers of mobile VPN users.

Option | Definition
--- | ---
Virtual Address section | Options for configuring the Forcepoint VPN Client with virtual IP addresses assigned by a DHCP server for connections inside the VPN.
DHCP Mode | Specifies how DHCP requests from VPN clients are sent. Disabled (IPsec VPN type only) — DHCP is not enabled. Direct — When selected, the engine sends a normal DHCP client broadcast message to a DHCP server located in a directly connected network. Note: This option is included for backward compatibility with legacy software versions. Relay — When selected, the engine sends unicast DHCP relay messages for VPN clients’ DHCP requests. Note: If SSL VPN or Both IPsec & SSL VPN is selected from the VPN Type drop-down list, only the Direct and DHCP Relay are shown.
Interface | (When DHCP Mode is Direct) The source address for the DHCP packets when querying the DHCP server (the interface toward the DHCP server).
Interface for DHCP Relay | (When DHCP Mode is Relay) The source address for the DHCP packets when querying the DHCP server (the interface toward the DHCP server).
DHCP Server (Security Engine < 5.9) | (When DHCP Mode is Direct) The DHCP server that assigns IP addresses for the VPN clients. Note: This option is included for backward compatibility with legacy software versions.
DHCP Servers | (When DHCP Mode is Relay) The DHCP server that assigns IP addresses for the VPN clients. Click Add to add an element to the table, or Remove to remove the selected element.
Add Information (Optional) | Specifies what VPN Client user information is added to the Remote ID option field in the DHCP Request packets. Add User Information — When selected, VPN Client user information (in the form user@domain) is automatically added to the Remote ID option field in the DHCP Request packets. Add Group Information — When selected, VPN Client user information (in the form group@domain) is automatically added to the Remote ID option field in the DHCP Request packets. None — When selected, no user or user group information is added to the Remote ID option field in the DHCP Request packets.
Restrict Virtual Address Ranges | When selected, the VPN gateway restricts the VPN clients’ addresses to the specified range, even if the DHCP server tries to assign some other IP address. Enter the IP address range in the field on the right.
Proxy ARP | When selected, the engine acts as a proxy for the VPN clients’ ARP requests. Enter the IP address range for proxy ARP in the field on the right.

Option | Definition
--- | ---
Secondary IPsec VPN Gateways section (Optional) | (When VPN Type is IPsec VPN) Other IPsec VPN gateways to contact in case there is a disruption at the IPsec VPN gateway end (in the order of contact). Click Add to add a row to the table, or Remove to remove the selected row. Click Up or Down to move the selected element up or down.

## Engine Editor > VPN > Certificates

Use this branch to change settings for automatic certificate management and trusted certificate authorities for VPNs.

Option | Definition
--- | ---
Automated RSA Certificate Management | When selected, RSA certificates are automatically created and renewed. Note: Only the default certificate authority is used in automated RSA certificate management.
Trusted VPN Certificate Authorities | Restricts which certificate authorities the VPN gateway trusts. Trust all — The VPN gateway trusts all certificate authorities. This option is the default setting. Trust only selected — The VPN gateway trusts only the certificate authorities that you select in the table.

## Engine Editor > VPN > Advanced

Use this branch to change advanced VPN settings.

Option | Definition
--- | ---
Gateway Settings | The Gateway Settings element that defines performance-related VPN options.
Gateway Profile | The Gateway Profile in use.
Translate IP Addresses Using NAT Pool | When selected, the specified IP address range and port range are used for translating IP addresses of incoming Forcepoint VPN Client connections to internal networks. Enter the ranges in the IP Address Range and Port Range fields. Note: This option is an alternative to using virtual IP addresses for VPN Clients.

## Engine Editor > Advanced Settings

Use this branch to change system parameters for the Security Engine. These parameters control how the Security Engine behaves under certain traffic conditions.

Option | Definition
--- | ---
Encrypt Configuration Data | By default, the configuration of the Security Engine is stored in an encrypted format. Disable the encryption only if instructed to do so by Forcepoint Customer Hub.
Disable Application Health Monitoring | When selected, the Application Health Monitoring feature is disabled.
Bypass Traffic on Overload (IPS only) | When selected, the Security Engine dynamically reduces the number of inspected connections if the load is too high. Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection. If this option is not selected, the Security Engine inspects all connections. Some connections might not get through if the IPS engine gets overloaded.
Contact Node Timeout (Not Virtual Engines) | The maximum amount of time the Management Server tries to connect to an Security Engine. A consistently slow network connection might require increasing this value. The default value is 120 seconds. Note: Setting the timeout value too short or too long can delay or prevent contact between the Management Server and the Security Engines.
Auto Reboot Timeout (Not Virtual Engines) | Specifies the length of time after which an error situation is considered non-recoverable and the Security Engine automatically reboots. The default value is 10 seconds. Set to 0 to disable.
Policy Handshake (Not Virtual Engines) | When selected, the nodes automatically roll back to using the previously installed policy if connectivity is lost after installing a new policy. Without this feature, you must switch to the previous configuration manually through the boot menu of the Security Engine. Note: We recommend adjusting the timeout (next setting) rather than disabling this feature completely if there is a need to make changes.
Rollback Timeout (Not Virtual Engines) | The length of time the Security Engine waits for a management connection before it rolls back to the previously installed policy when the Policy Handshake option is active. The default value is 60 seconds.
Automated Node Certificate Renewal (Not Virtual Engines) | When selected, the Security Engine's certificate for system communications is automatically renewed before it expires. Otherwise, the certificate must be renewed manually. Each certificate for system communications is valid for three years. If the certificate expires, other components refuse to communicate with the Security Engine. Note: Does not renew VPN certificates. Automatic certificate renewal for internally signed VPN certificates is set separately in the Security Engine's VPN settings.
FIPS-Compatible Operating Mode (Engines only) (Not Virtual Engines) | When selected, activates a mode that is compliant with the Federal Information Processing Standards (FIPS). Note: You must also select FIPS-specific settings in the Security Engine Configuration Wizard on the command line of the Security Engine. For more information, see How to install Forcepoint Network Security Platform in FIPS mode.
Disable Remote Engine Upgrades (FIPS-Compatible Operating Mode only) | When selected, remote upgrades for Security Engines are disabled in FIPS-compatible operating mode.
Disable sgInfo Creation (FIPS-Compatible Operating Mode only) | When selected, creating sgInfo files for Security Engines is disabled in FIPS-compatible operating mode.
Number of CPUs Reserved for Control Plane (Engines only) (Not Virtual Engines) | Select how many CPUs to reserve for control plane operations. In situations where there is exceptionally high traffic, in a denial of service attack, for example, this ensures that you can still monitor and control the Security Engine operation. Note: The reserved CPUs cannot be used for traffic processing. Using fewer CPUs for traffic processing degrades performance.
Isolate Also Interfaces for System Communications (Engines only) | When selected, the reserved CPUs handle the system communications traffic that pass through the Control Interfaces and dedicated primary Heartbeat Interfaces. We recommend that you only use this option when the Physical Interfaces used for system communications do not handle any other traffic.

## Engine Editor > Advanced Settings > Traffic Handling

Use this branch to change advanced parameters that control how the Security Engine handles traffic.

Option | Definition
--- | ---
Layer 3 Connection Tracking Mode (Engines only) Connection Tracking Mode (IPS engines and Layer 2 Engines only) | When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule. You can override this Security Engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules. Normal — The Security Engine drops ICMP error messages related to connections that are not currently active in connection tracking. A valid, complete TCP handshake is required for TCP traffic. The Security Engine checks the traffic direction and the port parameters of UDP traffic. Strict — The Security Engine does not permit TCP traffic to pass through before a complete, valid TCP handshake is performed. Loose — The Security Engine allows some connection patterns and address translation operations that are not allowed in the Normal mode. This mode can be used, for example, if routing is asymmetric and cannot be corrected or if the use of dynamic routing protocols causes the Security Engine to receive non-standard traffic patterns. On Engines and Layer 2 Engines, Normal is the default setting. On IPS engines, Loose is the default setting.
Virtual Defragmenting (Not Virtual Engines) (Not editable on IPS engines) | When selected, fragmented packets are sent onwards using the same fragmentation as when they arrived at the Security Engine. When the Security Engine receives fragmented packets, it defragments the packets for inspection. The original fragments are queued until the inspection is finished. If the option is not selected, the packets are sent onwards as if they had arrived unfragmented.
Strict TCP Mode for Deep Inspection (Not Virtual Engines) | This option is included for backward compatibility with legacy software versions.
Concurrent Connection Limit (Not Virtual Engines) | A global limit for the number of open connections. When the set number of connections is reached, the Security Engine stops the next connection attempts until a previously open connection is closed.
Inspection CPU Balancing Mode (Not Virtual Engines) | Specifies how inspected connections are allocated between the CPUs. Select from the following options: Default — The connection is allocated to the CPU that received the first packet of the connection. If the utilization on the CPU is high, a different CPU is dynamically selected. Incoming and outgoing packets might be handled by different CPUs. Round Robin — Connections are allocated evenly between all CPUs in order. This option can improve CPU balancing when there are a large number of CPUs. NUMA local Round Robin — Connections are balanced within the CPU that received the first packet of the connection. Incoming and outgoing packets are handled by the same CPU.
Active Wait Time Between Inspected Packets (Not Virtual Engines) | Defines how long the inspection process stays active waiting for packets after it has inspected a packet. Short — The inspection process stays active for the minimum amount of time. This setting provides the best CPU performance, but can increase latency in inspection. This is the default setting. Medium — The inspection process stays longer for a moderate amount of time. This setting provides a balance between CPU performance and latency in inspection. Long — The inspection process stays active for the maximum amount of time. This setting provides the lowest latency in inspection, but decreases CPU performance.
Default Connection Termination in Access Policy (IPS engines and Layer 2 Engines only) | Defines how connections that match Access rules with the Discard action are handled. Terminate and Log Connection — Stops the matching connections. This option is the default setting. Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.
Default Connection Termination in Inspection Policy | Defines how connections that match rules with the Terminate action in the Inspection Policy are handled. Terminate and Log Connection — Stops the matching connections. This option is the default setting. Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.
Action When TCP Connection Does Not Start With a SYN Packet (Not Master Engines) | The Security Engine refuses TCP connections if the TCP connection does not start with a SYN packet, even if the TCP connection matches an Access rule with the Allow action. The Security Engine does not send a TCP reset if the TCP connection begins with a TCP reset packet. Discard Silently — The connection is silently dropped. Refuse With TCP Reset — The connection is refused, and a TCP reset packet is returned.

## Engine Editor > Advanced Settings > Certificate Validation

Use this branch to specify settings for certificate validation and revocation status checks on the engine. The settings are used for features that have certificate validation and certificate revocation checks enabled.

Note: These settings are not supported for Virtual Engines.

Option | Definition
--- | ---
HTTP Proxy (Optional) | When specified, Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL) lookups are sent through an HTTP proxy instead of the engine accessing the external network directly.
Timeout for OCSP and CRL Lookups | The maximum amount of time that the engine tries to connect to the CRL or OCSP server if the connection has failed. The default is 120 seconds.
Active destination server certificate probing | When selected, it enables the Security Engine to fetch the server certificate over a separate TLS connection before establishing the original connection. The original connection is the TLS connection that a client tries to open through the engine to a destination server.
Server certificate cache timeout | The set value for this field determines how long the previously fetched certificates are to be retained. Note: By default, the timeout value for certificate entries in the cache is 1 day.
Distribution Points to Prefetch | Specify the URLs of the distribution points to prefetch CRLs and store them in the CRL Cache in advance. This allows for certificate validation to occur even if the network connection to the CRL server is unavailable during the validation process. Note: The CRLs remain available after reboot, if they are still valid. The CRLs are periodically refreshed to ensure valid entries are available in the CRL Cache. Prefetched CRLs are used for certificate validation when the dynamic revocation information fetching fails.

## Engine Editor > Advanced Settings > SYN Rate Limits

Use this branch to change global SYN rate limits. SYN rate limits reduce the risk of SYN flood attacks.

Option | Definition
--- | ---
SYN Rate Limits | Limits for SYN packets sent to the Security Engine. None — SYN rate limits are disabled. Automatic — The Security Engine automatically calculates the Allowed SYNs per Second and Burst Size values for the interface based on the Security Engine capacity and memory size. Custom — Enter custom values for Allowed SYNs per Second and Burst Size.
Allowed SYNs per Second | (When SYN Rate Limits is Custom) The number of allowed SYN packets per second.
Burst Size | (When SYN Rate Limits is Custom) The number of allowed SYNs before the Security Engine starts limiting the SYN rate. CAUTION: We recommend setting the Burst Size value to at least one tenth of the Allowed SYNs per Second value. If the burst size is too small, SYN rate limits do not work. For example, if the value for Allowed SYNs per Second is 10000, the Burst Size value must be at least 1000.

## Engine Editor > Advanced Settings > Log Handling

Use this branch to change log handling settings for the Security Engine. You can use log handling settings to adjust logging when the log spool fills up.

Note: These settings are not supported for Virtual Engines.

Option | Definition
--- | ---
Log Spooling Policy (Not Virtual Engines) | Defines what happens when the log spool becomes full. Stop Traffic — The Security Engine stops processing traffic and goes offline. Discard Log — Log entries are discarded in four stages, according to available space. Monitoring data is discarded first, followed by log entries marked as Transient and Stored, and finally log entries marked as Essential. The Security Engine continues to process traffic.
Log Compression (Antispoofing Log Event Type for Engines only) | The maximum number of separately logged entries. When the defined limit is reached, a single Antispoofing log entry or Discard log entry is logged. The single entry contains information about the total number of the generated Antispoofing log entries or Discard log entries. The individual log entries are deleted. After the single log entry is created, logging returns to normal and all entries are logged and shown separately. Double-click a cell to edit the value. Note: Do not enable Log Compression if you want all Antispoofing and Discard entries to be logged as separate log entries (for example, for reporting or statistics).
Set to Default | Returns Log Compression settings to the default settings.
Store a Copy of Recent Log Files on the Security Engine | When selected, the Security Engine stores copies of logs according to the specified settings.
Maximum Time | The maximum length of time for which to store copies of logs. Values can be 1–720 hours (the maximum is 30 days), or not specified. If a value is not specified, the Security Engine stores copies of logs until the limits specified in the Guaranteed Free Spool Partition or Guaranteed Free Spool Partition Size options are reached.
Guaranteed Free Spool Partition | The minimum percentage of the spool partition that must be kept free. When the amount of free space reaches the limit, the Security Engine starts deleting the oldest stored copies of log and alert entries when a new log or alert entry is saved. Values can be 5–80 %, or not specified. Note: You must enter a value for at least one of the guarantee options. If you enter a value for both options, both limits are enforced.
Guaranteed Free Spool Partition Size | The minimum amount of file space, in MB, on the spool partition that must be kept free. When the amount of free space reaches the limit, the Security Engine starts deleting the oldest stored copies of log and alert entries when a new log or alert entry is saved. Values can be 50–1000 MB, or not specified. Note: You must enter a value for at least one of the guarantee options. If you enter a value for both options, both limits are enforced.

## Engine Editor > Advanced Settings > Scan Detection

Use this branch to change scan detection settings. You can use scan detection to count the number of connections or connection attempts within a time window and set a threshold after which an alert is generated.

Option | Definition
--- | ---
Scan Detection Mode | When you enable scan detection, the number of connections or connection attempts within a time window is counted. Disabled — Scan detection is not enabled. Off (Can Be Overridden in Policy) — Scan detection is not enabled, but you can override this setting in individual Access rules. This option is the default setting. On (Can Be Overridden in Policy) — Scan detection is enabled. You can override this setting in individual Access rules if scan detection is not needed or to avoid false positives.
Create a log entry when the system detects section | Allows you to set thresholds for creating log entries. When the specified number of events for the specified time period is exceeded, log entries are created. The following options are available for each protocol: events in — Specifies the maximum number of events. The default value is 220. Time period field — Specifies the time period. The default value is 1. Time unit drop-down list — Specifies the unit of time. The default value is Minutes.
Log Level | Specifies the log level for the log entries. Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored. Stored — Creates a log entry that is stored on the Log Server. Essential — Creates a log entry that is shown in the Logs view and saved for further use. Alert — Triggers the alert you select.
Alert | When the Log Level is set to Alert, specifies the Alert that is sent.
Severity | When the Log Level is set to Alert, allows you to override the severity defined in the Alert element.
Set to Default | Returns Scan Detection changes to the default settings.

## Engine Editor > Advanced Settings > DoS Protection

Use this branch to configure protection that can help prevent Denial of Service (DoS) attacks.

Option | Definition
--- | ---
Rate-Based DoS Protection Mode | Enables or disables DoS protection, which can help prevent Denial of Service (DoS) attacks. Disabled — DoS protection is not enabled. Off (Can Be Overridden in Policy) — DoS protection is not enabled, but you can override this setting in individual Access rules. This option is the default setting. On (Can Be Overridden in Policy) — DoS protection is enabled. You can override this setting in individual Access rules.
SYN Flood Sensitivity | When SYN flood protection is activated, the Security Engine acts as a SYN proxy. The engine completes the TCP handshake with the client, and only initiates the connection with the server after the client has completed the TCP handshake. Off — SYN flood protection is not enabled. Low — Allows the most SYN-ACK timeouts before the Security Engine requires a full TCP handshake with the client before it communicates with a server. Medium — Allows a medium number of SYN-ACK timeouts before the Security Engine requires a full TCP handshake with the client before it communicates with a server. This option is the default setting. High — Allows the fewest SYN-ACK timeouts before the Security Engine requires a full TCP handshake with the client before it communicates with a server.
Limit for Half-Open TCP Connections (Optional) | Set the maximum number of half-open TCP connections per destination IP address. The minimum is 125, the maximum is 100 000. When the limit is exceeded, the SYN flood protection is activated, and log data is generated.
Slow HTTP Request Sensitivity | The Security Engine analyzes the data transfer rate and length of time it takes to read the header fields of the HTTP request. If the sender of the request tries to keep the connection open for an unreasonable length of time, the Security Engine block lists the sender’s IP address for a specified length of time. Off — Slow HTTP Request Protection is not enabled. Low — Allows the slowest data transfer rate before the block list timeout is applied. This option is the default setting. Medium — Allows a moderately slow data transfer rate before the block list timeout is applied. High — Allows the least slow data transfer rate before the block list timeout is applied.
Slow HTTP Request Block list Timeout | The length of time for block listing IP addresses that are suspected of sending malicious traffic. Enter the time in seconds (the default is 300).
TCP Reset Sensitivity | When enabled, the Security Engine detects the sequence numbers of the TCP RST segments to determine whether it is under a TCP Reset attack. You cannot override this setting in individual Access rules Off — TCP reset protection is not enabled. This option is the default setting. Low — Allows the most TCP reset requests before the Security Engine considers itself to be under attack. Medium — Allows a medium number of TCP reset requests before the Security Engine considers itself to be under attack. High — Allows the fewest TCP reset requests before the Security Engine considers itself to be under attack.

## Engine Editor > Advanced Settings > Idle Timeouts

Use this branch to view and change the timeouts for removing idle connections from the state table, including non-TCP communications that are handled like connections.

Option | Definition
--- | ---
Timeouts table Double-click the Timeout(s) cell to change the value. Click Add to add an element to the table, or Remove to remove the selected element. To set the selected protocols and values back to default settings, click Set to Default.

## Engine Editor > Advanced Settings > Authentication

Use this branch to configure advanced settings for user authentication.

Option | Definition
--- | ---
Default User Domain | The default LDAP domain from which the Security Engine looks up users. Note: This setting applies to all user authentication, including browser-based user authentication, VPN clients, and the Application Access Portal.
Allow user lookup from known User Domain matching to client certificate email domain or UPN suffix | When selected, the Security Engine looks up the user from the domain specified in the email address or user principal name before looking up the user in the default domain. Note: This option is ignored when the value of the Client Certificate Identity Field for TLS option is Distinguished Name.
Allow Username Lookup Using Long UserID Attribute | When selected, the Security Engine uses the Long UserID to find or match the user in the Active Directory or LDAP Server. Note: If Short UserID is configured, the engine first attempts to find the user using Short UserID from the domain found by domain part of the login name.
Client Certificate Identity Field for TLS | The attribute that is used to look up the user entry from the user domain when using TLS. The Security Engine only uses values from the Active Directory or LDAP server that is associated with the global default LDAP domain or the engine-specific default user domain. User Principal Name — The User Principal Name attribute on the Attributes tab of the Active Directory Server or LDAP Server element is used. Email — The E-mail attribute on the Attributes tab of the Active Directory Server or LDAP Server element is used. Distinguished Name — The specified value in the distinguished name is used. Note: If you select Distinguished Name, you must specify the identity search value on the Client Certificate tab of the Active Directory Server or the LDAP Server Properties dialog box.
Root Password Login | Select one of the following options: Login Allowed via SSH and Console: The root password login to an engine is allowed via SSH and console. Note: By default, this option is selected if the engine is upgraded. Login Allowed via Console Only: The root password login to an engine by using SSH is not allowed. But root password login by using console is allowed. Note: By default, this option is selected when we create a new engine. Root Account Disabled (Super User Privileges through sudo): The root password login to an engine is disabled.
Authentication Method | Select an authentication method element from the available options: Local Password: Allows authentication using the local password. [Select…]: Select this option to view the available radius authentication method elements. Note: The authentication method options are displayed as per the radius authentication server elements that are configured. For more details on how to create a radius authentication server element, refer to the Define Authentication Method elements for external servers topic.
SSH Passwordless Login | Select one of the following options: Allow: The SSH password less login is allowed. Deny: The SSH password less login is denied. Note: This applies only to administrators replicated on the engine. For more details on administrator account replication, refer to the Add administrator accounts topic.

## Engine Editor > Advanced Settings > Tunneling

Use this branch to change the packet tunneling settings for the engine.

Option | Definition
--- | ---
Limit for Rematching Tunneled Traffic | Specifies how many times the contents of tunneled packets can be re-matched against the IPv6 Access rules or IPv4 Access rules when several layers of tunneling are encountered. The default is 1. When the limit is reached, the action defined in the Action if Limit is Exceeded setting is taken.
Action if Limit is Exceeded | Specifies whether remaining encapsulated packets inside the tunneling packet are allowed without further inspection or discarded. The default is to discard the remaining packets. When this action is triggered, you are notified according to the Log Level setting.
Log Level | Specifies whether you are notified through a normal (stored) log entry or an Alert when the limit for rematching tunneled traffic is reached.
Alert | If you selected Alert as the Log Level, select the Alert element that is used when an event triggers an alert. The Alert elements can be used for matching in Alert Policies. Click Select to select an element.
Set to Default | Returns Tunneling changes to the default settings.

## Engine Editor > Advanced Settings > Custom Properties Profiles

Use this branch to enable a custom properties profile for the Security Engine.

Option | Definition
--- | ---
Custom Properties Profiles list | Shows the selected custom properties profiles. Click Add to add an element to the list, or Remove to remove the selected element.