Configure Forcepoint SMC

Forcepoint SMC must be reachable from AWS components that provision the necessary configuration between the NGFW engines hosted in AWS and the existing SMC using the SMC API. If SMC is not already reachable from outside the private company network, do as follows:

  1. Sign into the SMC.
  2. Navigate to Configuration > Administration.
  3. Expand Access Rights and then select API Clients.
  4. Right-click API Clients and select New API Client. The API Client Properties screen is displayed.
  5. Add a name in the Name field, and then click Generate Authentication Key. You can save the authentication key in your local drive for future reference.
  6. Select the Permissions tab.
  7. Select Unrestricted Permissions (Superuser) option.
  8. Click OK.
  9. From the left navigate panel navigate to Certificates, and then select TLS Credentials.
  10. Right-click TLS Credentials and select New TLS Credentials. Perform the following:
    1. Type a name for the certificate.
    2. Type the publicly accessible IP address into the Common Name [CN] field. Rest of the fields must have existing default values.
    3. Click Next.
  11. Select the Self-Sign option, and then click Finish.
  12. Right-click the newly created Credential and select Properties.
  13. From the Certificate properties window, select the Certificate tab, then copy the entire content including the lines:—–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–.
  14. Save the certificate in your local drive for future reference.
  15. Click OK.
  16. Close the Certificate window.
  17. From the left navigation pane, select Other Elements and right-click Locations.
  18. Select New Location. The Location Properties window is displayed.
  19. Type "cloud" in the Name field using only lower-case characters
  20. Click OK.
  21. In the SMC header select Home.
  22. From the left navigation menu, select Others. Right-click Management Server and select Properties.
  23. Click General tab and then select Exceptions.
  24. Click Add and browse the location "cloud" created in step 19. Select "cloud" and enter the public IP of the SMC into the Contact Addresses section.
  25. Click OK.
  26. Navigate to the SMC API tab and select Enable.
  27. From the Server Credentials section click the option Select.
  28. From the Select Element windows select the TLS Credentials that has been created already.
  29. From the Server TLS Cryptography Suite Set section, click the option Select.
  30. From the Select Element window, select the option NIST(SP 800-52 Rev.2) Compatible TLS Cryptographic Algorithms.
  31. Click Select and then OK in the Management Server-Properties window when finished.
  32. Click Yes.
  33. Navigate to the Home tab of the SMC.
  34. Right-click Log Server and select Properties.
  35. Add an exception same as done in step 23.