Forcepoint™ Security Management Center Service Online Documentation

Home
Policy Creation and Administration
Creating and managing policy elements
Policy elements are containers for the rules that determine how Engines, Master Engines, and Virtual Engines examine traffic. The policy elements for the Engines include Template Policies, Policies, and Sub-Policies.
Editing policies
The rules in Engine and Layer 2 Interface Policies allow you to control how the Engines inspect and filter network traffic, and how NAT (network address translation) is applied on Engines, Master Engines, and Virtual Engines.
Add Exception rules
Inspection Exceptions allow you to make changes to the Inspection Policy that are not applied to all connections.
Define what action Exception rules take
The Action defines the command for the Engine to carry out when a connection matches the Exception rule.

Preface
This guide provides the information you need to work with your Forcepoint product.
Introduction to SMC as a Service
The SMC as a Service provides centralized access for configuring, managing, logging, and monitoring NGFWs that secure network connectivity and control business operations.
Getting Started
Routing
Policy Creation and Administration
- Overview
  Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
- Creating and managing policy elements
  Policy elements are containers for the rules that determine how Engines, Master Engines, and Virtual Engines examine traffic. The policy elements for the Engines include Template Policies, Policies, and Sub-Policies.
  - Creation and managing policy elements
  - Editing policies
    The rules in Engine and Layer 2 Interface Policies allow you to control how the Engines inspect and filter network traffic, and how NAT (network address translation) is applied on Engines, Master Engines, and Virtual Engines.
    - Getting started with editing policies
      Rules in policies are instructions to the Engines for handling traffic.
    - The different parts of the policy editing view
      The tabs and options shown in the policy editing view depend on the type of policy you are editing.
    - Editing rules in a policy
      Editing rules consists of defining matching criteria for different rule cells and making sure that the rules are organized in a logical way in the rule table.
    - Add Insert Points in Policy Templates
      Insert Points mark the positions where rules can be added.
    - Automatic rules and how they work
      When you enable a feature that requires traffic between certain components to be allowed, rules allowing the traffic are automatically created.
    - Configure settings for Automatic rules
      View a summary of Automatic rules and manage related settings in the Engine Editor.
    - Add Ethernet rules
      Ethernet rules define which Ethernet protocol packets the Engines stop, and which packets are allowed through.
    - Add Access rules
      Access rules are used in Engine, and Layer 2 Interface Policies.
    - Add NAT rules
      NAT rules define how NAT is applied to matching connections.
    - Add Inspection rules
      Inspection rules filter traffic based on traffic patterns. Inspection rules are stored in Inspection Policy elements.
    - Add Exception rules
      Inspection Exceptions allow you to make changes to the Inspection Policy that are not applied to all connections.
      - Add Exception rules in Inspection Policy elements
        The Exceptions tab allows you to create detailed rules that are processed before the Rules tree definitions on the Inspection tab.
      - Define what traffic Exception rules match
        Exception rules in Inspection Policy elements are matched based on the patterns defined in Situation elements.
      - Define what action Exception rules take
        The Action defines the command for the Engine to carry out when a connection matches the Exception rule.
      - Define Action options for the Continue action in Exception rules
        The Continue action can set options for the Permit and Terminate actions in subsequent rules.
      - Define Action options for the Permit action in Exception rules
        The options for the Permit action in Exception rules allow you to set additional options for traffic that has been allowed.
      - Define Action options for the Terminate action in Exception rules
        The Terminate action options control connection termination, notifications, and the creation of block list entries.
      - Define logging options for Exception rules
        Inspection Exception rules can create a log or alert entry each time they match.
    - Specify rule validity times
      You can specify when Access rules, inspection Exception rules, and rules in Alert policies are enforced.
    - Validate rules automatically
      You can automatically validate the rules in a policy at any time.
    - How default rules can be changed
      Rules inherited from the default Template policies cannot be edited directly. Instead, you can create a copy of the default Template policies.
- Rule Types within Policies
- Policy Supporting Elements
- Inspection & Content Filtering Policies
- Access Control & Authentication Policies
- Policy Troubleshooting & Maintenance
Monitoring
VPN

Define what action Exception rules take

The Action defines the command for the Engine to carry out when a connection matches the Exception rule.

Steps

Right-click the Action cell and select the action.

Copyright © 2026 Forcepoint LLC