Create Master NGFW Engines or Virtual NGFW Engines

(Optional)

(Optional)

(Not available for clusters)

(Not available for clusters)

(Optional)

Specifies the IP addresses of the DNS servers that the NGFW Engine uses. DNS IP addresses are IP addresses of external DNS servers. NGFW Engines use these DNS servers to resolve Domain names to IP addresses. NGFW Engines need DNS resolution to contact services that are defined using URLs or domain names, and to resolve fully qualified domain names (FQDNs) used in policies.

(Firewall/VPN role only) For DNS relay, specifies the IP addresses of external DNS servers to which the NGFW Engine forwards DNS requests from clients in the internal network. When DNS relay is configured, these DNS servers are used unless domain-specific DNS servers are specified in a DNS Relay Profile element.

If you have configured at least one Physical Interface with a dynamic IP address or one static NetLink with a DNS IP address, the default value of the DNS IP Addresses field is The engine uses NetLink-specific DNS IP addresses.

• IP Address — Adds an IP Address element that represents a single IP address.
• Network Element — Adds a Network element that represents a network space.

(Appliances only)

(Optional)

(Optional)

To add several addresses, separate the addresses with a comma.

• Select — Opens a dialog box where you can select an existing DNS Relay Profile element.
• None — Removes the previously selected DNS Relay Profile element. Selecting None deactivates DNS Relay.
• New — Allows you to create a new DNS Relay Profile element. Opens the DNS Relay Profile Properties dialog box.

When According to Routing is selected, the source IP address is automatically selected based on the route to the external DNS server.

(Optional)

Lists the available NTP servers. Double-click the cell to select an NTP server.

The Layer 2 Interface Policy that contains rules for traffic detected by layer 2 physical interfaces.

All layer 2 physical interfaces on the NGFW Engine use the same Layer 2 Interface Policy. If there are no layer 2 physical interfaces, this setting is ignored.

When selected, the NGFW Engine dynamically reduces the number of inspected connections if the load is too high.

Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection.

If this option is not selected, the NGFW Engine inspects all connections. Some connections might not get through if the engine gets overloaded.

• Layer 3 Physical Interface

  (Available for Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• Layer 2 Physical Interface

  (Available for Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• Physical Interface

  (Available for all engine types except Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• VLAN Interface

  (Available for all engine types)

• IPv4 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Firewalls)

• IPv6 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Firewalls)

• ADSL Interface

  (Available for Single Firewalls and Firewall Clusters)

• Tunnel Interface

  (Available for Single Firewalls, Firewall Clusters, and Virtual Firewalls)

• Modem Interface

  (Available for Single Firewalls)

• Wireless Interface

  (Available for Single Firewalls)

• SSID Interface

  (Available for Single Firewalls)

• Switch

  (Available for Single Firewalls)

• Port Group Interface

  (Available for Single Firewalls)

(Not Virtual Firewalls)

• Primary — Specifies the Primary Control IP address for Management Server contact.
• Backup (Optional) — Specifies the Backup Control IP address that is used if the Primary Control IP address is not available.

(Clusters and Master NGFW Engines only)

• Primary — Specifies communications between the nodes. We recommend that you use a Physical Interface, not a VLAN Interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation.
  CAUTION:
  Primary and Backup Heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information.
• Backup — Used if the Primary Heartbeat Interface is unavailable. It is not mandatory to configure a backup Heartbeat Interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is interrupted. We strongly recommend that you use a dedicated interface for the backup heartbeat as well.

On Master NGFW Engines, you cannot use shared interfaces as a heartbeat interface.

The IPv4 address or IPv6 address of the selected interface is used when an NGFW Engine contacts an external authentication server.

This option does not affect the routing of the connection with the authentication server. The IP address is used only as a parameter inside the authentication request payload to give a name to the request sender.

• Use Loopback IP Address in Unnumbered Tunnel Interface — Uses an IP address listed in the table as the source IP address of traffic sent from the NGFW Engine node.
• Use Default Outgoing IP Address in Unnumbered Tunnel Interface — Uses the default outgoing IP address defined in the Interface Options pane as the source IP address of traffic sent from the NGFW Engine node.

(Clusters only)

(Clusters only)

(Optional)

• Tree View — Displays the routing configuration as a tree of interfaces, Router elements, NetLink elements, and destination networks.
• Table View — Displays the routing configuration as a table of destination networks, routing gateways, interfaces, and NetLink elements.

• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the default route to the routing configuration.
• Show Default Route — Highlights the default route in the Tree View or the Table View.

• Destination — The destination IP address or network.
• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the route to the routing configuration.

• Source — The source IP address.
• Destination — The destination IP address.
• Query — Highlights the route in the Tree View or the Table View.

(Optional, BGP only)

(Optional, all protocols)

(IPv4 only)

(IPv6 only)

(IPv4 only)

(IPv6 only)

(Optional)

This option is required for client certificate authentication.

• All — Users can authenticate through all interfaces.
• Selected — Users can only authenticate through the selected interfaces.

(Optional)

(Optional)

(Optional)

(Optional)

(Optional)

(Optional)

• There is both an Internal RSA CA for Gateways and an Internal ECDSA CA for Gateways.
• The Internal CA for Gateways is in the process of being renewed and both the previous CA and the new CA are temporarily available.

• None — Does not create any log entry.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers the alert you select.

• Never — The NGFW Engine does not check for updates. You must update the anti-malware database manually.
• When Anti-Malware Daemon Starts — Checks when the anti-malware daemon starts. The daemon starts, for example, when the anti-malware feature is enabled or when the NGFW Engine restarts.
• Every Hour — Checks for updates once an hour.
• Daily — Checks for updates once a day. Set the time of day.
• Weekly — Checks for updates once a week. Set the day and time of day.

(Optional)

• None — The NGFW Engine does not use a sandbox.
• Cloud Sandbox - Forcepoint Advanced Malware Detection — The engine uses the cloud sandbox for Forcepoint Advanced Malware Detection.
• Local Sandbox - Forcepoint Advanced Malware Detection — The engine uses the local sandbox for Forcepoint Advanced Malware Detection.
  Note: To use the local sandbox for Forcepoint Advanced Malware Detection, you must have a Forcepoint Advanced Malware Detection appliance.
• Local Sandbox - McAfee Advanced Threat Defense (ATD) — The engine uses McAfee Advanced Threat Defense.
  Note: McAfee Advanced Threat Defense is no longer supported in NGFW version 6.4.0 and higher. We recommend that you use Forcepoint Advanced Malware Detection instead.

(Optional)

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Optional)

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

• None — Disables file reputation services.
• Threat Intelligence Exchange (TIE) — This option is included for backward compatibility with legacy NGFW software versions. McAfee Threat Intelligence Exchange (TIE) is no longer supported in NGFW 6.10 and higher.
• Global Threat Intelligence (GTI) — Enables the use of McAfee GTI file reputation services for file filtering.

(Optional)

(Optional)

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

• On — The NGFW Engine always uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic.
• Off — The NGFW Engine never uses the default NAT address as the public IP address.
• Automatic — The NGFW Engine automatically determines whether to use the default NAT address based on the routing configuration. If there are routes that use NetLinks, the NGFW Engine uses the default NAT address as the public IP address if there is not a more specific NAT definition that matches the traffic.

When you select On or Automatic, a NAT rule is generated at the end of the IPv4 or IPv6 NAT rules in the policy.

(Firewall/VPN role only)

(Firewall/VPN role only)

• None — Does not create any log entry.
• Alert — Triggers an alert entry.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Stored — Creates a log entry that is stored on the Log Server.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored.

• Edit Value — Opens the Alias Value Properties dialog box.
• Set to Any — The Alias element matches any value.
• Set to None — Disables translation for the Alias element.

(Optional)

Click Remove to remove the selected element.

(Optional)

• SSL 3.0
• TLS 1.0
• TLS 1.1
• TLS 1.2

• New — Creates an element of the specified type.
• Show Deleted Elements — Shows elements that have been moved to the Trash.

• Expand All — Expands all levels of the status tree.
• Collapse All — Collapses all levels of the status tree.
• Refresh View — Updates the view.

• IPsec VPN — The mobile VPN only supports IPsec tunnels.
• SSL VPN — The mobile VPN only supports SSL VPN tunnels.
• Both IPsec & SSL VPN — The mobile VPN supports IPsec and SSL VPN tunnels.

(When VPN Type is SSL VPN)

(When VPN Type is SSL VPN)

(When VPN Type is SSL VPN)

• Anti-Virus is enabled — Requires anti-virus software to be enabled on the computers of mobile VPN users.
• Firewall is enabled — Requires firewall software to be enabled on the computers of mobile VPN users.
• Windows Update is enabled — Requires the Windows Update service to be enabled on the computers of mobile VPN users.

• Disabled (IPsec VPN type only) — DHCP is not enabled.
• Direct — When selected, the engine sends a normal DHCP client broadcast message to a DHCP server located in a directly connected network.
  Note: This option is included for backward compatibility with legacy NGFW software versions.
• Relay — When selected, the engine sends unicast DHCP relay messages for VPN clients’ DHCP requests.

(When DHCP Mode is Direct)

(When DHCP Mode is Relay)

(When DHCP Mode is Direct)

(When DHCP Mode is Relay)

(Optional)

• Add User Information — When selected, VPN Client user information (in the form user@domain) is automatically added to the Remote ID option field in the DHCP Request packets.
• Add Group Information — When selected, VPN Client user information (in the form group@domain) is automatically added to the Remote ID option field in the DHCP Request packets.
• None — When selected, no user or user group information is added to the Remote ID option field in the DHCP Request packets.

(Optional)

(When VPN Type is IPsec VPN)

• Trust all — The VPN gateway trusts all certificate authorities. This option is the default setting.
• Trust only selected — The VPN gateway trusts only the certificate authorities that you select in the table.

(IPS only)

When selected, the NGFW Engine dynamically reduces the number of inspected connections if the load is too high.

Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection.

If this option is not selected, the NGFW Engine inspects all connections. Some connections might not get through if the IPS engine gets overloaded.

(Not Virtual NGFW Engines)

The maximum amount of time the Management Server tries to connect to an NGFW Engine.

A consistently slow network connection might require increasing this value. The default value is 120 seconds.

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

Without this feature, you must switch to the previous configuration manually through the boot menu of the NGFW Engine.

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

Each certificate for system communications is valid for three years. If the certificate expires, other components refuse to communicate with the NGFW Engine.

(Firewalls only)

(Not Virtual NGFW Engines)

(FIPS-Compatible Operating Mode only)

(FIPS-Compatible Operating Mode only)

(Firewalls only)

(Not Virtual NGFW Engines)

(Firewalls only)

(Firewalls only)

(IPS engines and Layer 2 Firewalls only)

When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule.

You can override this NGFW Engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules.

• Normal — The NGFW Engine drops ICMP error messages related to connections that are not currently active in connection tracking. A valid, complete TCP handshake is required for TCP traffic. The NGFW Engine checks the traffic direction and the port parameters of UDP traffic.
• Strict — The NGFW Engine does not permit TCP traffic to pass through before a complete, valid TCP handshake is performed.
• Loose — The NGFW Engine allows some connection patterns and address translation operations that are not allowed in the Normal mode. This mode can be used, for example, if routing is asymmetric and cannot be corrected or if the use of dynamic routing protocols causes the NGFW Engine to receive non-standard traffic patterns.

(Not Virtual NGFW Engines)

(Not editable on IPS engines)

When selected, fragmented packets are sent onwards using the same fragmentation as when they arrived at the NGFW Engine.

When the NGFW Engine receives fragmented packets, it defragments the packets for inspection. The original fragments are queued until the inspection is finished. If the option is not selected, the packets are sent onwards as if they had arrived unfragmented.

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

(IPS engines and Layer 2 Firewalls only)

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

(Not Master NGFW Engines)

• Discard Silently — The connection is silently dropped.
• Refuse With TCP Reset — The connection is refused, and a TCP reset packet is returned.

• None — SYN rate limits are disabled.
• Automatic — The NGFW Engine automatically calculates the Allowed SYNs per Second and Burst Size values for the interface based on the NGFW Engine capacity and memory size.
• Custom — Enter custom values for Allowed SYNs per Second and Burst Size.

(When SYN Rate Limits is Custom)

(When SYN Rate Limits is Custom)

• Disabled — Scan detection is not enabled.
• Off (Can Be Overridden in Policy) — Scan detection is not enabled, but you can override this setting in individual Access rules. This option is the default setting.
• On (Can Be Overridden in Policy) — Scan detection is enabled. You can override this setting in individual Access rules if scan detection is not needed or to avoid false positives.

• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers the alert you select.

• Disabled — DoS protection is not enabled.
• Off (Can Be Overridden in Policy) — DoS protection is not enabled, but you can override this setting in individual Access rules. This option is the default setting.
• On (Can Be Overridden in Policy) — DoS protection is enabled. You can override this setting in individual Access rules.

• Off — SYN flood protection is not enabled.
• Low — Allows the most SYN-ACK timeouts before the NGFW Engine requires a full TCP handshake with the client before it communicates with a server.
• Medium — Allows a medium number of SYN-ACK timeouts before the NGFW Engine requires a full TCP handshake with the client before it communicates with a server. This option is the default setting.
• High — Allows the fewest SYN-ACK timeouts before the NGFW Engine requires a full TCP handshake with the client before it communicates with a server.

(Optional)

• Off — Slow HTTP Request Protection is not enabled.
• Low — Allows the slowest data transfer rate before the blacklist timeout is applied. This option is the default setting.
• Medium — Allows a moderately slow data transfer rate before the blacklist timeout is applied.
• High — Allows the least slow data transfer rate before the blacklist timeout is applied.

• Off — TCP reset protection is not enabled. This option is the default setting.
• Low — Allows the most TCP reset requests before the NGFW Engine considers itself to be under attack.
• Medium — Allows a medium number of TCP reset requests before the NGFW Engine considers itself to be under attack.
• High — Allows the fewest TCP reset requests before the NGFW Engine considers itself to be under attack.

Double-click the Timeout(s) cell to change the value. Click Add to add an element to the table, or Remove to remove the selected element. To set the selected protocols and values back to default settings, click Set to Default.