How to Connect Forcepoint NGFW to Forcepoint Data Security Cloud over IPsec Tunnel

Home
Configurations in Forcepoint Data Security Cloud | SSE portal
This section details the configurations required to setup IPsec tunnel in Forcepoint Data Security Cloud | SSE portal.

Introduction
Forcepoint Data Security Cloud | SSE Cloud SWG solution enables web traffic filtering when a SmartEdge agent cannot be deployed on the end user's machine, such as for Guest users or IoT devices or when the organization does not want to deploy an agent.
Configurations in Forcepoint Data Security Cloud | SSE portal
This section details the configurations required to setup IPsec tunnel in Forcepoint Data Security Cloud | SSE portal.
- Creating Sites
  A Site represents a corporate location from which traffic will originate. While creating a Site, you can configure IPsec tunnel through which traffic should be sent over to cloud and create or add subnets groups within the site.
- Viewing Tunnels
  After creating tunnels, you can monitor the status of each tunnel under Analyze > Tunnels page.
- Creating Traffic Types
  Within a company network, there will be multiple subnets. Each subnet will be assigned for a particular purpose, that is assigned to managed devices, IoT, guest, servers and so on.
- Settings
  On the Protect > Forward Proxy > Settings page, you can set Cloud SWG Session Timeout, Cloud SWG Certificate Authority and Bypass Domains, Host IPs or Subnets.
Configurations on Forcepoint NGFW
These instructions explain how to forward web traffic from the Forcepoint NGFW site through the Forcepoint Data Security Cloud | SSE cloud proxy service using policy-based IPsec VPN.
Verifying high availability failover
For each site you add, it is important to ensure that the High Availability (HA) failover capability is provisioned and configured correctly such that failover happens successfully when required.
Installing Root Certificate
You may get an error Software is Preventing Firefox from safely connecting to site while accessing websites on Mozilla Firefox if the user is enforced to authenticate using the domain's identity provider.

Configurations in Forcepoint Data Security Cloud | SSE portal

This section details the configurations required to setup IPsec tunnel in Forcepoint Data Security Cloud | SSE portal.

Creating Sites
A Site represents a corporate location from which traffic will originate. While creating a Site, you can configure IPsec tunnel through which traffic should be sent over to cloud and create or add subnets groups within the site.
Viewing Tunnels
After creating tunnels, you can monitor the status of each tunnel under Analyze > Tunnels page.
Creating Traffic Types
Within a company network, there will be multiple subnets. Each subnet will be assigned for a particular purpose, that is assigned to managed devices, IoT, guest, servers and so on.
Settings
On the Protect > Forward Proxy > Settings page, you can set Cloud SWG Session Timeout, Cloud SWG Certificate Authority and Bypass Domains, Host IPs or Subnets.

Copyright © 2026 Forcepoint LLC