# Default elements for policy-based VPNs

There are several default elements for policy-based VPN configuration.

Table 1. Default elements for policy-based VPN configuration
Element type | Default elements
--- | ---
Certificates | The Internal RSA CA for Gateways VPN Certificate Authority element represents the Management Server’s internal RSA certificate authority. You can use the element to define certificate trust relationships if you configure other CAs in the SMC.
Connection Types | The default Connection Type elements represent the Active, Aggregate, and Standby modes for endpoints in a Multi-Link configuration.
Gateways | The predefined VPN Client gateway element that represents VPN clients, including the Forcepoint VPN Client and third-party VPN clients. You can change the Gateway Profile associated with this default element.
Gateway Profiles | Several different Gateway Profiles are included for different Engine/VPN role and Forcepoint VPN Client versions. With third-party VPN devices, you can use the Default (All Capabilities) profile, which enables all options. You can also create a more restrictive profile yourself for better automatic configuration validation.
Gateway Settings | Gateway Default Settings is a predefined Gateway Settings element that contains the default recommended settings for most environments. Each engine has settings that are common to all VPNs the engine establishes, set in the Gateway Settings element. These settings are mostly for performance tuning. Usually there is no need to change them at all. If there is some particular need to change the settings, you must create a custom Gateway Setting element. You cannot edit the Gateway Default Settings system element. There are some advanced properties on the General tab, meant for advanced users only. The default values are the recommended values. These options affect the VPN directly.
VPN Profiles | The predefined VPN Profiles are provided to allow you to quickly try out VPNs without creating a VPN Profile yourself. The Forcepoint Cloud Connection VPN profile contains VPN settings forconnecting VPN with Forcepoint Cloud services. The iOS Suite VPN Profile contains only iOS-compatible encryption algorithms and protocols. For example, iOS VPN clients only support IKEv1 key exchange, which must be enabled in the profile. The SOHO Suite VPN profile contains VPN settings for SOHO firewalls. The Suite-B-GCM-128 and Suite-B-GCM-256 VPN Profiles contain the VPN settings specified for the respective cryptographic suites in RFC 6379. The CNSA-GCM-256-ECDH-384, CNSA-GCM-256-DH-3072 and CNSA-GCM-256-DH-4096 Profiles contain the VPN settings specified for the respective cryptographic suites in RFC 9206. The predefined VPN Profiles also allow you to change settings that are not specified in RFC 4308, RFC 6379, and RFC 9206. You might need to adjust the settings to achieve a valid VPN in some configurations.