Home
Connectivity
The Administration > Connectivity section provides options to configure your sites, the private applications that hosted at your sites, and to deploy the endpoint client for Private Access standalone end users.
IPsec tunnel configuration
IPsec tunnels are used to connect private application hosting sites to provide remote access to internal applications.
Example IPsec configuration for Cisco ISR
This IPsec configuration example is for Cisco ISR 15.5(3) or higher.

Introduction
Forcepoint Private Access is a cloud-based zero trust network access solution that provides secure, authenticated remote access to internal applications.
Getting started
Forcepoint Private Access can be used to provide secure remote access to internal applications located on customer premises or in private cloud services, either as part of a Forcepoint Cloud Security Gateway deployment, or as a standalone solution.
Connectivity
The Administration > Connectivity section provides options to configure your sites, the private applications that hosted at your sites, and to deploy the endpoint client for Private Access standalone end users.
- Sites
  A site is a geographical location, data center, or cloud service, that connects to the service using traffic tunneling. Sites represent your private application hosting locations.
- Hosted PAC files
  For customers using Private Access as a standalone service, use the proxy auto-config (PAC) files on the Hosted PAC files page to configure endpoint. These PAC files are used by the Forcepoint Web Security Endpoint client to direct private application traffic to the Private Access service.
- Endpoint
  For customers using Private Access as a standalone service, the Endpoint general page provides installation settings for the Forcepoint Web Security Endpoint, which is built using the Forcepoint One Endpoint package builder.
- IPsec tunnel configuration
  IPsec tunnels are used to connect private application hosting sites to provide remote access to internal applications.
  - IPsec tunnel configuration overview
    To configure IPsec tunneling to the service, you must configure your edge device to connect to the Forcepoint gateways.
  - Supported IPsec settings
    For IPsec connectivity, your edge device must be configured to use Forcepoint-supported IKE tunnel negotiation and IPsec encryption settings.
  - Maximum segment size for IPsec tunnels
    The encapsulation overhead of the IPsec tunnel means that TCP sessions sent over the tunnel must be limited to a lower Maximum Segment Size (MSS) than usual.
  - Abbreviations for configuration parameters in IPsec examples
    Abbreviations are used for configuration parameters in the configuration examples. Replace the abbreviations with the appropriate addresses and values for your configuration.
  - Example IPsec configuration for Cisco ISR
    This IPsec configuration example is for Cisco ISR 15.5(3) or higher.
    - Configure IKE proposal
      Configure the IKE proposal for the Private Access service.
    - Configure two active tunnels using VTI interfaces
      Establish the IPsec tunnel using Virtual Tunnel Interfaces (VTI).
    - Useful show and debug commands for IPsec tunnels
      Show and debug commands display information such as connection and operation statistics.
  - Example IPsec configuration for Juniper SRX
    This IPsec configuration example is for Juniper SRX 12.1 R9 or higher.
  - Troubleshooting IPsec tunnels
    The troubleshooting information describes some typical problems that you might encounter in configuring and establishing your IPsec tunnels, and the suggested actions for how to resolve the problems.
- Connect Forcepoint NGFW to Forcepoint Private Access over a VPN
  These instructions explain how to configure a highly available IPsec VPN connection on a Forcepoint Next Generation Firewall (Forcepoint NGFW) for inbound private application traffic coming from Forcepoint Private Access.
Dashboard
The dashboard displays a summary of service activity over time.
Administration
The Administration tab provides access to configuration settings for your organization. Use this tab to set up connectivity, authentication, administrators, log management, and resources.
Authentication
The Administration > Authentication section provides settings to support end-user provisioning and authentication via integration with your SAML (Security Assertion Markup Language) compliant Identity Provider (IdP).
Policies
The Private Access policy tab is used to configure the processing rules that are used to control access to resources, and to inspect and secure traffic that is routed through the service. Private applications policy controls and secures remote access to internal applications.
Appendix
Reference information including a list of fields included in the traffic log export, and details of domains that are never decrypted.

Example IPsec configuration for Cisco ISR

This IPsec configuration example is for Cisco ISR 15.5(3) or higher.

Configure IKE proposal
Configure the IKE proposal for the Private Access service.
Configure two active tunnels using VTI interfaces
Establish the IPsec tunnel using Virtual Tunnel Interfaces (VTI).
Useful show and debug commands for IPsec tunnels
Show and debug commands display information such as connection and operation statistics.

© 2021 Forcepoint
Published 2 June 2021