How to Connect Forcepoint NGFW to Forcepoint ONE Cloud over IPsec Tunnel

Home
Configurations in Forcepoint ONE SSE portal
This section details the configurations required to setup IPsec tunnel in Forcepoint ONE SSE portal.
Settings
On the Protect > Forward Proxy > Settings page, you can set Cloud SWG Session Timeout, Cloud SWG Certificate Authority and Bypass Domains, Host IPs or Subnets.

Introduction
Forcepoint ONE SSE Cloud SWG solution enables web traffic filtering when a SmartEdge agent cannot be deployed on the end user's machine, such as for Guest users or IoT devices or when the organization does not want to deploy an agent.
Configurations in Forcepoint ONE SSE portal
This section details the configurations required to setup IPsec tunnel in Forcepoint ONE SSE portal.
- Creating Sites
  A Site represents a corporate location from which traffic will originate. While creating a Site, you can configure IPsec tunnel through which traffic should be sent over to cloud and create or add subnets groups within the site.
- Viewing Tunnels
  After creating tunnels, you can monitor the status of each tunnel under Analyze > Tunnels page.
- Creating Traffic Types
  Within a company network, there will be multiple subnets. Each subnet will be assigned for a particular purpose, that is assigned to managed devices, IoT, guest, servers and so on.
- Settings
  On the Protect > Forward Proxy > Settings page, you can set Cloud SWG Session Timeout, Cloud SWG Certificate Authority and Bypass Domains, Host IPs or Subnets.
  - Cloud SWG Session Timeout
    From the Cloud SWG Session Timeout drop-down, define how often users’ session should last before enforcing authentication.
  - Cloud SWG Certificate Authority
    You can select either Forcepoint Self Signed Certificate or an external CA, previously uploaded to Settings > Certificate, so that Cloud SWG can use those CA to generate dynamic certificates for websites visited.
  - Bypass Domains, Host IPs or Subnets
    Bypass Domains, Host IPs or Subnets section allows you to enter specific domains, host IPs or subnets that you wish to not be proxied when using the SmartEdge agent or cloud SWG.
Configurations on Forcepoint NGFW
These instructions explain how to forward web traffic from the Forcepoint NGFW site through the Forcepoint ONE SSE cloud proxy service using policy-based IPsec VPN.
Verifying high availability failover
For each site you add, it is important to ensure that the High Availability (HA) failover capability is provisioned and configured correctly such that failover happens successfully when required.
Installing Root Certificate
You may get an error Software is Preventing Firefox from safely connecting to site while accessing websites on Mozilla Firefox if the user is enforced to authenticate using the domain's identity provider.

Settings

On the Protect > Forward Proxy > Settings page, you can set Cloud SWG Session Timeout, Cloud SWG Certificate Authority and Bypass Domains, Host IPs or Subnets.

Cloud SWG Session Timeout
From the Cloud SWG Session Timeout drop-down, define how often users’ session should last before enforcing authentication.
Cloud SWG Certificate Authority
You can select either Forcepoint Self Signed Certificate or an external CA, previously uploaded to Settings > Certificate, so that Cloud SWG can use those CA to generate dynamic certificates for websites visited.
Bypass Domains, Host IPs or Subnets
Bypass Domains, Host IPs or Subnets section allows you to enter specific domains, host IPs or subnets that you wish to not be proxied when using the SmartEdge agent or cloud SWG.

Copyright © 2024 Forcepoint LLC