Centralized management of global system settings

Global System Properties dialog box — Updates tab

Use this tab to define settings for dynamic updates, engine upgrades, and licenses.

Note: Telemetry data is collected when Secure SD-WAN Manager version 6.5 or higher connects to the Engine Updates and Upgrades service at https://⁠autoupdate.ngfw.forcepoint.com/dynup.rss. For more information, see Knowledge Base article 19213.

Option	Definition
Allow Sending License and Installation Telemetry Data to Forcepoint Servers	When selected, allows the Management Server to send information about the installed components and licenses to the Engine Updates and Upgrades service. You must select this option to configure settings for dynamic updates, and engine and license upgrades.
View Telemetry Data	Shows the telemetry data that is collected when Secure SD-WAN Manager version 6.5 or higher connects to the Engine Updates and Upgrades service.
Dynamic Updates	Specifies the dynamic updates options: Do Not Check for Updates. You are not notified of new dynamic updates. Notify When Updates Become Available. You receive an alert when a new dynamic update becomes available. You must manually download and activate the update. Notify and Automatically Download Updates. You receive an alert when a new dynamic update becomes available. The Secure SD-WAN Manager also automatically downloads the update. You must manually activate the update. Automatically Download and Activate Updates The Secure SD-WAN Manager automatically downloads and activates the new dynamic updates.
Update Service (Optional)	Specifies the update service that is used for automatic dynamic updates. Click Select to select an element.
Notify When Updates Have Been Activated (Optional)	You receive an alert when the dynamic updates have been activated. This option becomes available when you select Automatically Download and Activate Updates. You must refresh the policies before the updates take effect. If Refresh Policies After Update Activation is selected, the policies are refreshed automatically. Otherwise, you must refresh the policies manually.
Refresh Policies After Update Activation (Optional)	The Secure SD-WAN Manager automatically refreshes the policies after activating the dynamic updates. This option becomes available when you select Automatically Download and Activate Updates.
Remote Upgrades for Engines	Specifies new engine upgrade options: Do Not Check for Engine Upgrades. You are not notified of new engine upgrades. Notify When Engine Upgrades Become Available. You receive an alert when a new engine upgrade becomes available. You must manually download and install the update. Notify and Automatically Download Engine Upgrades. You receive an alert when a new engine upgrade becomes available. The Secure SD-WAN Manager automatically downloads the new engine upgrade. You must manually install the update.
Upgrade Service (Optional)	Specifies the upgrade service that is used for automatic engine upgrades. Click Select to select an element.
Generate and Install New Licenses Automatically (Optional)	When selected, automatically regenerates and installs the licenses required for upgrading Secure SD-WAN Manager components to a major new release.
Check for Updates	Specifies how often to check for updates.

Global System Properties dialog box — Change Management tab

Use this tab to enforce an approval workflow for all engines.

Option	Definition
Require Approval for Changes in Engine Configuration	When selected, all changes to engine configurations and policies must be approved before the changes are committed and transferred to the engines. Administrators with permissions to approve changes and administrators with unrestricted permissions (superusers) can approve changes.
Allow Administrators to Approve Their Own Changes	When selected, the same administrator who made the changes can approve the changes.

Global System Properties dialog box — Password Policy tab

Use this tab to change settings for password strength, password expiration, failed logons, and actions related to temporary and long-term inactivity in the administrator password policy.

Option	Definition
Enforce Password Settings for All the Administrators and Web Portal Users	When selected, enforces the password settings for all administrators and Web Portal users.

Option	Definition
Logon Options section
Only one Logon Session for Each User	When selected, an administrator or Web Portal user can open only a single session at a time to the Management Client or to the Web Portal.
Administrator User Name is Case Sensitive	When selected, uppercase and lowercase letters in the administrator user name are considered to be different from each other.
Disable Account After Failed Logon Attempts	When selected, administrator accounts are disabled when the maximum number of failed logon attempts in the specified length of time is reached.
Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 8 attempts.
Attempts Within	The length of time for counting the number of failed logon attempts. Select the time unit from the drop-down list. The default is 30 minutes.
Temporarily Lock Account After Failed Logon Attempts	When selected, administrators or Web Portal users are temporarily locked when the maximum number of failed logon attempts is reached.
Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 6 attempts. This option is selected by default.
Lock Account for	The length of time for which the account is locked. Select the time unit from the drop-down list. The default is 30 minutes.
Disable Accounts That Have Been Inactive For	When selected, administrator or Web Portal user accounts that have not been used for the specified length of time are automatically disabled. Select the time unit from the drop-down list. The default is 3 months.
Lock the Management Client Window After the User Session is Idle for	When selected, the Management Client window is locked when an administrator has been idle for the specified length of time. Select the time unit from the drop-down list. The default is 15 minutes.
Hide the Management Client Window Content	When selected, the content of the Management Client window is hidden when the screen is locked.
Close the Management Client	When selected, the Management Client is automatically closed when the screen is locked.
Allow Logon Only From Listed IP Addresses	When selected, administrators or Web Portal users can only log on from hosts that have the listed IP addresses. You can enter up to 170 IP addresses.
Add	Adds an IP address to the list.
Remove	Removes the selected IP address from the list.

Option	Definition
Password Age and Expiration section
Require Password Change After First Logon	When selected, the administrator or Web Portal user must change the password after the first time they log on.
Minimum Time Before Next Password Change	When selected, the administrator or Web Portal user password cannot be changed again before the specified length of time. Select the time unit from the drop-down list. The default is 3 days.
Password Expires After	When selected, specifies the length of time after which administrator or Web Portal user passwords expire and must be changed. Select the time unit from the drop-down list. The default is 3 months.
Notify User When Password Expires in	When selected, the administrator or Web Portal user is notified that the password is about to expire the specified length of time before expiration. Select the time unit from the drop-down list. The default is 7 days.
Disable Account Automatically After Password Expiration	When selected, the administrator or Web Portal user account is automatically disabled when the password expires.
Limit Reuse of Previous Passwords (Number of Previous Passwords)	When selected, the administrator or Web Portal user cannot use a password that has already been used in the specified number of previous passwords. The default is 8.

Option	Definition
Password Complexity Requirements section
Minimum Number of Characters in Password	When selected, administrator or Web Portal user passwords must contain the specified minimum number of characters. The default is 10 characters. This option is selected by default.
Minimum Number of Required Characters	When selected, administrator or Web Portal user passwords must contain the specified minimum number of required characters. Note: The total number of required characters must not be larger than the value of the Minimum Number of Characters in Password option. This option is selected by default.
Uppercase	The minimum number of required uppercase letters. The default is 0.
Lowercase	The minimum number of required lowercase letters. The default is 1.
Special Characters	The minimum number of special characters. Special characters include the following characters: !@#$%^&*() The default is 0.
Numbers	The minimum number of required numeric characters. The default is 1.
Maximum of Same Characters Between Previous and New Password	When selected, administrator or Web Portal user passwords must not have more than the specified number of characters in common with the previous password. The default is 4 characters.
Reset to Default	Discards the changes and reverts to the default settings.

Global System Properties dialog box — Global Options tab

Use this tab to configure general settings for the Secure SD-WAN Manager and Engine.

You can also use this tab to:

Authorize McAfee® Global Threat Intelligence™ (McAfee GTI). Only administrators with unrestricted permissions (superusers) can enable McAfee GTI.
Show users in the Home view.
Set the expiration time for one-time passwords that are generated when you save the initial configuration for an Engine.
Import Snort configuration files globally to configure default settings for Snort inspection for all Engines.

All settings are optional.

Option	Definition
Enable McAfee Global Threat Intelligence (GTI) and McAfee Threat Intelligence Exchange (TIE) usage	When selected, enables McAfee GTI usage. Note: McAfee Threat Intelligence Exchange (TIE) is no longer supported in Engine 6.10 and higher.
Show Users in the Home View	When selected, users that have been recently active are shown in the Home view.
Retrieve Information for Users Active	A user is considered active if they have generated log data. Select the time period to retrieve the information. The longer the time period, the greater the performance impact.
Display Users as	User Names — The name of the user is shown. The information is shown as it is shown in the logs. Source IP Addresses — If user name information is not available, or cannot be shown due to privacy legislation, you can show only the source IP address of the user.
Show Users From These Networks (Only if Display Users as is Source IP Addresses	If you want to show users as source IP addresses, select the networks where your users are located.
One-Time Passwords Expire After	Defines the expiration time for one-time passwords that are generated when you save the initial configuration for an Engine. If the one-time password is not used, it automatically expires after the expiration time has elapsed. By default, one-time passwords expire after 30 days.
Snort Configuration	The externally created Snort configuration .zip file that contains the Snort configuration files and rules for Snort inspection. Click Browse to select a file. Click None to remove a previously imported file. Click Export to export the Snort configuration file. All Engines for which Snort inspection is enabled use the global Snort configuration by default. Settings in the Snort configuration .zip file for an individual Engine are combined with the settings in the global Snort configuration .zip file. If any configuration files in a Snort configuration .zip file for an individual Engine have the same files name and paths as configuration files in the global Snort configuration .zip file, the overlapping files in the global Snort configuration .zip file are ignored.

Global System Properties dialog box — Banners tab

Use this tab to create logon banners and export banners.

Note: The text from the banner also appears in the logon window of the Appliance console and Web Portal.

Option	Definition
Show Logon Banner	When selected, the specified banner is shown to all administrators before they log on to the Management Client.
Banner text box	Specifies the text for the logon banner. You can use HTML to format the text.
Include Export Banner	When selected, the specified banner is added at the beginning of each exported XML file or HTML file to indicate that the export contains sensitive or classified data.
Banner text box	Specifies the text for the export banner. Only plain text is supported.