Forcepoint™ Security Management Center Service Online Documentation

Home
VPN
VPN types & architecture
A VPN extends a secured private network over public networks by encrypting connections so that they can be transported over insecure links without compromising confidential data.
IPsec VPNs
PPK support for route-based and policy-based tunnels
In route-based tunnels, the routing defines which traffic is sent through the tunnel.
Examples of route-based tunnels
These examples illustrate some common uses of route-based tunnels and general steps for how each example is configured.

Preface
This guide provides the information you need to work with your Forcepoint product.
Introduction to SMC as a Service
The SMC as a Service provides centralized access for configuring, managing, logging, and monitoring NGFWs that secure network connectivity and control business operations.
Getting Started
Routing
Policy Creation and Administration
Monitoring
VPN
- VPN types & architecture
  A VPN extends a secured private network over public networks by encrypting connections so that they can be transported over insecure links without compromising confidential data.
  - Policy-based VPNs vs. route-based VPNs
    SMCaaS provides two types of VPNs. The main difference between the two is how traffic is selected to use the VPN.
  - Site-to-site VPNs (IPv4 & IPv6)
    You can create VPNs between VPN gateway devices or between a VPN client and a VPN gateway device.
  - Mobile VPNs
    In a mobile VPN, a VPN client on a user's device connects to a VPN gateway.
  - IPsec VPNs
    - Post-quantum security
      The Post-quantum Pre-Shared Key (PPK) is used in addition to the Diffie-Hellman (DH) key exchange in the IKEv2 protocol to prevent threats from quantum computers.
    - Post-quantum pre-shared keys (PPK)
      A Post-quantum Pre-shared Key (PPK) element can be used along with the IKEv2 protocol to prevent threats from quantum computers. A PPK consists of a Key ID and a Pre-shared secret.
    - PPK with IKEv2 protocol configuration
      SAs for IPsec VPNs are created in a process called the Internet key exchange (IKE) negotiations.
    - PPK support for route-based and policy-based tunnels
      In route-based tunnels, the routing defines which traffic is sent through the tunnel.
      - Using route-based tunnels for dynamic routing
        Route-based tunnels can protect and route dynamic routing communications between sites to protect the confidentiality and integrity of the dynamic routing communications.
      - Add tunnel interfaces for Engines
        Tunnel Interfaces allow routing information to be used to determine the correct VPN tunnel to use in route-based VPNs.
      - Create Route-Based Tunnel elements
        Route-Based Tunnel elements represent the endpoints of the tunnel.
      - Using GRE keep alive to check the status of route-based VPN tunnels
        You can optionally use GRE keep alive to check that route-based VPN tunnels of the GRE tunnel type are still functioning.
      - Create Tunnel Group elements
        You can group Route-Based Tunnel elements, then monitor them in the Dashboard view.
      - Use a policy-based VPN to encrypt tunnels in route-based VPNs
        You can use a policy-based VPN to provide encryption for route-based VPN tunnels.
      - Examples of route-based tunnels
        These examples illustrate some common uses of route-based tunnels and general steps for how each example is configured.
        
        Example: protecting dynamic routing communications with a route-based tunnel
        This scenario shows an example of protecting communications when public Internet networks are used for backup connectivity.
        
        Example: configuring route-based VPNs with external gateways
        This scenario shows an example of creating a route-based tunnel between an internal and external network.
      - Defining Policy-Based VPN elements
        The Policy-Based VPN element collects together the gateways and the VPN Profile, and provides the settings for defining the topology and the tunnels of the policy-based VPN.
  - Configuring VPNs with external gateway devices
    An External VPN Gateway is any VPN gateway that is not controlled by the same SMCaaS Application on which you are configuring the gateway element.
  - Adaptive Forward Erasure Correction (FEC) for VPN tunnels
    The FEC feature helps to control errors in data transmission over an unreliable or noisy communication channel.
  - Logs related to VPNs
    VPN negotiations and VPN traffic are logged as informational messages and can be viewed in the Logs view like any other logs.
  - Clustering and VPNs
    A SMCaaS cluster can be used as a gateway in policy-based and route-based VPNs. There are no additional configuration steps compared to a Single Engine.
  - VPNs and Multi-Link for VPN
    Using Multi-Link enhances the reliability of the VPN communications by ensuring the availability of network connections.
  - VPN Broker
    The VPN Broker creates highly-scalable, full-mesh VPN environments. VPN tunnels are automatically created between Engines when they communicate with each other. The VPN tunnels are automatically removed when they are no longer needed.
- VPN configuration
- VPN authentication & certificates
  A digital certificate is a proof of identity. SMCaaS supports using certificates for authenticating gateways and the Forcepoint VPN Client.
- Application Access Portal
- Mobile VPN & VPN client
- VPN & access rules
- Reconfiguring existing VPNs
  You can reconfigure and tune existing VPNs.

Examples of route-based tunnels

These examples illustrate some common uses of route-based tunnels and general steps for how each example is configured.

Example: protecting dynamic routing communications with a route-based tunnel
This scenario shows an example of protecting communications when public Internet networks are used for backup connectivity.
Example: configuring route-based VPNs with external gateways
This scenario shows an example of creating a route-based tunnel between an internal and external network.

Copyright © 2026 Forcepoint LLC