Next Generation Firewall 7.0 Installation Guide

Home
Forcepoint NGFW deployment
Forcepoint NGFW deployment consists of adding and configuring engine elements in the SMC, and configuring the Forcepoint NGFW software on the engine.
Configuring Forcepoint NGFW for the Firewall/VPN role
Configuring engine elements in the SMC prepares the SMC to manage NGFW Engines in the Firewall/VPN role.
Configuring single firewalls
After you have the SMC installed and running, you can configure the Single Firewall elements.
Add layer 2 interfaces to Single Firewalls
Layer 2 interfaces are used in traffic inspection on Single Firewalls.

Introduction to the Forcepoint Next Generation Firewall solution
Before setting up Forcepoint Next Generation Firewall (Forcepoint NGFW), it is useful to know what the different components do and what engine roles are available. There are also tasks that you must complete to prepare for installation.
Security Management Center deployment
SMC is the management component of the Forcepoint NGFW system. SMC must be installed and running before you can deploy the Forcepoint NGFW engines.
Forcepoint NGFW deployment
Forcepoint NGFW deployment consists of adding and configuring engine elements in the SMC, and configuring the Forcepoint NGFW software on the engine.
- Configuring Forcepoint NGFW for the Firewall/VPN role
  Configuring engine elements in the SMC prepares the SMC to manage NGFW Engines in the Firewall/VPN role.
  - Types of interfaces for NGFW Engines in the Firewall/VPN role
    You can configure several types of interfaces for NGFW Engines in the Firewall/VPN role.
  - Interface numbering
    The interfaces have their own numbering in the SMC called the interface ID. The interface IDs are mapped to the corresponding network interfaces on the NGFW Engine when you configure the Forcepoint NGFW software.
  - Install licenses for NGFW engines
    Install the NGFW Engine licenses that you downloaded while preparing for installation.
  - Configuring single firewalls
    After you have the SMC installed and running, you can configure the Single Firewall elements.
    - Create a Single Firewall element
      To add a single-node firewall to the SMC, add a Single Firewall element that stores the configuration information related to the firewall.
    - Add layer 3 interfaces to Single Firewalls
      Layer 3 interfaces are used in system communications and in traffic inspection on Single Firewalls.
    - Add a wireless interface
      You can add one wireless interface to a Single Firewall.
    - Add an SSID interface
      A service set identifier (SSID) interface represents an 802.11 wireless LAN.
    - Add Switches to Single Firewalls
      An integrated switch represents the switch functionality on purpose-built Forcepoint NGFW appliances. Integrated switches eliminate the need for an external switch device and reduce costs and clutter.
    - Add Port Group Interfaces to Single Firewalls
      Port groups simplify port and network segment configuration. Traffic inside a port group is not inspected. The traffic between port groups is inspected by the firewall in the same way as other traffic.
    - Add IP addresses for Single Firewall interfaces
      You can add one or more IP addresses to each interface on a Single Firewall.
    - Add a modem interface
      You can use mobile broadband modems with Single Firewalls to provide wireless links for outbound connections.
    - Add layer 2 interfaces to Single Firewalls
      Layer 2 interfaces are used in traffic inspection on Single Firewalls.
      - Add logical interfaces to Single Firewalls
        Logical Interface elements are used in the Layer 2 Interface Policy and the traffic inspection process to represent a network segment.
      - Add reset interfaces to Single Firewalls
        Reset interfaces can deliver TCP resets and ICMP destination unreachable messages to interrupt communications picked up from capture interfaces when the communications trigger a response.
      - Add capture interfaces to Single Firewalls
        Capture interfaces monitor traffic that external devices have duplicated for inspection to the Single Firewall.
      - Add inline IPS interfaces to Single Firewalls
        There are two physical interfaces in an inline IPS interface. The traffic is forwarded from one interface to the other.
      - Bypass traffic on overload on Single Firewalls
        You can configure the Single Firewall to bypass traffic when the traffic load becomes too high.
      - Add inline Layer 2 Firewall interfaces to Single Firewalls
        There are two physical interfaces in an inline Layer 2 Firewall interface. The traffic is forwarded from one interface to the other.
      - Add VLAN interfaces to layer 2 interfaces of Single Firewalls
        VLANs divide a single physical network link into several virtual links.
    - Set global interface options
      Select which IP addresses are used for particular roles in system communications.
    - Bind engine licenses to Single Firewall elements
      After you have configured the Single Firewall elements, you must manually bind Management Server POL-bound licenses to specific Single Firewall elements.
  - Configuring Firewall Clusters
    After you have the SMC installed and running, you can configure the Firewall Cluster elements.
- Configuring Forcepoint NGFW for the IPS role
  Configuring engine elements in the SMC prepares the SMC to manage Forcepoint NGFW in the IPS role.
- Configuring Forcepoint NGFW for the Layer 2 Firewall role
  Configuring engine elements in the SMC prepares the SMC to manage NGFW Engines in the Layer 2 Firewall role.
- Configuring NGFW Engines as Master NGFW Engines and Virtual NGFW Engines
  Configuring engine elements in the SMC prepares the SMC to manage Master NGFW Engines and Virtual NGFW Engines.
- Configuring routing
  After creating the NGFW Engine elements and defining the interfaces, you can configure the basic routing.
- Initial configuration of Forcepoint NGFW software
  After configuring the NGFW Engines in the Management Client, apply the initial configuration of the NGFW Engine and contact the Management Server.
- Creating and installing policies
  After successfully applying the initial configuration and establishing contact between the NGFW Engines and the Management Server, the NGFW Engine is in the initial configuration state. Now you can create and install policies for access control or inspecting traffic.
Maintenance
To maximize the benefit of Forcepoint NGFW, upgrade the SMC and Forcepoint NGFW regularly.
Appendices

Add layer 2 interfaces to Single Firewalls

Layer 2 interfaces are used in traffic inspection on Single Firewalls.

Add logical interfaces to Single Firewalls
Logical Interface elements are used in the Layer 2 Interface Policy and the traffic inspection process to represent a network segment.
Add reset interfaces to Single Firewalls
Reset interfaces can deliver TCP resets and ICMP destination unreachable messages to interrupt communications picked up from capture interfaces when the communications trigger a response.
Add capture interfaces to Single Firewalls
Capture interfaces monitor traffic that external devices have duplicated for inspection to the Single Firewall.
Add inline IPS interfaces to Single Firewalls
There are two physical interfaces in an inline IPS interface. The traffic is forwarded from one interface to the other.
Bypass traffic on overload on Single Firewalls
You can configure the Single Firewall to bypass traffic when the traffic load becomes too high.
Add inline Layer 2 Firewall interfaces to Single Firewalls
There are two physical interfaces in an inline Layer 2 Firewall interface. The traffic is forwarded from one interface to the other.
Add VLAN interfaces to layer 2 interfaces of Single Firewalls
VLANs divide a single physical network link into several virtual links.

© 2023 Forcepoint
Published 25 August 2023