Forcepoint™ Security Management Center Service Online Documentation

Home
VPN
VPN types & architecture
A VPN extends a secured private network over public networks by encrypting connections so that they can be transported over insecure links without compromising confidential data.
Policy-based VPNs vs. route-based VPNs
SMCaaS provides two types of VPNs. The main difference between the two is how traffic is selected to use the VPN.
Policy-based VPNs in Engine
In Policy-based VPNs, the Access rules determine which traffic is sent into the VPN tunnels.

Preface
This guide provides the information you need to work with your Forcepoint product.
Introduction to SMC as a Service
The SMC as a Service provides centralized access for configuring, managing, logging, and monitoring NGFWs that secure network connectivity and control business operations.
Getting Started
Routing
Policy Creation and Administration
Monitoring
VPN
- VPN types & architecture
  A VPN extends a secured private network over public networks by encrypting connections so that they can be transported over insecure links without compromising confidential data.
  - Policy-based VPNs vs. route-based VPNs
    SMCaaS provides two types of VPNs. The main difference between the two is how traffic is selected to use the VPN.
    - Limitations of VPNs in Engine
      These limitations apply to VPNs in Engine.
    - Policy-based VPNs in Engine
      In Policy-based VPNs, the Access rules determine which traffic is sent into the VPN tunnels.
      - Types of encryption for tunnels in policy-based VPNs
        Tunnels in policy-based VPNs can use IPsec or SSL VPN encryption.
    - How route-based VPNs work
      In route-based VPNs, any traffic that is routed to a tunnel interface and allowed by Access rules is automatically sent through the tunnel to the peer endpoint.
  - Site-to-site VPNs (IPv4 & IPv6)
    You can create VPNs between VPN gateway devices or between a VPN client and a VPN gateway device.
  - Mobile VPNs
    In a mobile VPN, a VPN client on a user's device connects to a VPN gateway.
  - IPsec VPNs
  - Configuring VPNs with external gateway devices
    An External VPN Gateway is any VPN gateway that is not controlled by the same SMCaaS Application on which you are configuring the gateway element.
  - Adaptive Forward Erasure Correction (FEC) for VPN tunnels
    The FEC feature helps to control errors in data transmission over an unreliable or noisy communication channel.
  - Logs related to VPNs
    VPN negotiations and VPN traffic are logged as informational messages and can be viewed in the Logs view like any other logs.
  - Clustering and VPNs
    A SMCaaS cluster can be used as a gateway in policy-based and route-based VPNs. There are no additional configuration steps compared to a Single Engine.
  - VPNs and Multi-Link for VPN
    Using Multi-Link enhances the reliability of the VPN communications by ensuring the availability of network connections.
  - VPN Broker
    The VPN Broker creates highly-scalable, full-mesh VPN environments. VPN tunnels are automatically created between Engines when they communicate with each other. The VPN tunnels are automatically removed when they are no longer needed.
- VPN configuration
- VPN authentication & certificates
  A digital certificate is a proof of identity. SMCaaS supports using certificates for authenticating gateways and the Forcepoint VPN Client.
- Application Access Portal
- Mobile VPN & VPN client
- VPN & access rules
- Reconfiguring existing VPNs
  You can reconfigure and tune existing VPNs.

Policy-based VPNs in Engine

In Policy-based VPNs, the Access rules determine which traffic is sent into the VPN tunnels.

Types of encryption for tunnels in policy-based VPNs
Tunnels in policy-based VPNs can use IPsec or SSL VPN encryption.

Copyright © 2026 Forcepoint LLC