Create Master NGFW Engine elements

(Not available for clusters)

(Not available for clusters)

(Optional)

• Malware signature mirror
• Domain names
• URL filtering categorization services

(Firewall/VPN role only) For DNS relay, specifies the IP addresses of external DNS servers to which the engine forwards DNS requests from clients in the internal network.

If you have configured at least one Physical Interface with a dynamic IP address or one static NetLink with a DNS IP address, the default value of the DNS IP Addresses field is The engine uses NetLink-specific DNS IP addresses.

• IP Address — Adds an IP Address element that represents a single IP address.
• Network Element — Adds a Network element that represents a network space.

(Optional)

• Select — Select an existing Tools Profile element.
• None — Removes all previously selected Tools Profile elements.
• New — Create a Tools Profile element.

(Optional)

(Optional)

When selected, the NGFW Engine uses the specified NTP server by default.

Lists the available NTP servers. The following right-click actions are available:

• Select — Allows you to add an NTP Server element to the cell. Opens the Select Element dialog box.
• Remove — Removes the row from the table.
• Clear — Removes the NTP Server element from the cell.

• Layer 3 Physical Interface

  (Available for Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• Layer 2 Physical Interface

  (Available for Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• Physical Interface

  (Available for all engine types except Single Firewalls, Firewall Clusters, Virtual Firewalls, and Master NGFW Engines in the Firewall/VPN role)

• VLAN Interface

  (Available for all engine types)

• IPv4 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Firewalls)

• IPv6 Address

  (Not available for Virtual IPS engines or Virtual Layer 2 Firewalls)

• ADSL Interface

  (Available for Single Firewalls and Firewall Clusters)

• Tunnel Interface

  (Available for Single Firewalls, Firewall Clusters, and Virtual Firewalls)

• Modem Interface

  (Available for Single Firewalls)

• Wireless Interface

  (Available for Single Firewalls)

• SSID Interface

  (Available for Single Firewalls)

• Switch

  (Available for Single Firewalls)

• Port Group Interface

  (Available for Single Firewalls)

(Not Virtual Firewalls)

• Primary — Specifies the Primary Control IP address for Management Server contact.
• Backup (Optional) — Specifies the Backup Control IP address that is used if the Primary Control IP address is not available.

(Clusters and Master NGFW Engines only)

• Primary — Specifies communications between the nodes. We recommend that you use a Physical Interface, not a VLAN Interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation.
  CAUTION:
  Primary and Backup Heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information.
• Backup — Used if the Primary Heartbeat Interface is unavailable. It is not mandatory to configure a backup Heartbeat Interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is disturbed. We strongly recommend that you use a dedicated interface for the backup heartbeat as well.

When selected, the NGFW Engine opens a connection to the Management Server and maintains connectivity. This option is always used with a dynamic control IP address, so it is always selected if the control IP address is dynamic.

If the connection is not open when you command the engine through the Management Client, the command is left pending until the engine opens the connection again.

The IP address of the selected interface is used when an engine contacts an external authentication server.

This option does not affect the routing of the connection with the authentication server. The IP address is used only as a parameter inside the authentication request payload to give a name to the request sender.

• Tree View — Displays the routing configuration as a tree of interfaces, Router elements, NetLink elements, and destination networks.
• Table View — Displays the routing configuration as a table of destination networks, routing gateways, interfaces, and NetLink elements.

• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the default route to the routing configuration.
• Show Default Route — Highlights the default route in the Tree View or the Table View.

• Destination — The destination IP address or network.
• Gateway — The IP address of the gateway device. You can also double-click the field and select a gateway device for the route.
• Add — Adds the route to the routing configuration.

• Source — The source IP address.
• Destination — The destination IP address.
• Query — Highlights the route in the Tree View or the Table View.

(IPv4 only)

(IPv6 only)

(IPv4 only)

(IPv6 only)

(Optional)

• None — Does not create any log entry.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers an alert entry.

• Never — The engine does not check for updates. You must update the anti-malware database manually.
• When Anti-Malware Daemon Starts — The anti-malware daemon starts, for example, when the anti-malware feature is enabled or when the engine restarts.
• Every Hour — The engine checks for updates once an hour.
• Daily — The engine checks for updates once a day. Set the Time of day that the engine checks for updates.
• Weekly — The engine checks for updates once a week. Set the Day and Time of day that the engine checks for updates.

(Optional)

• Cloud Sandbox - Forcepoint Advanced Malware Detection — The engine uses the cloud sandbox for Forcepoint Advanced Malware Detection.
• Local Sandbox - Forcepoint Advanced Malware Detection — The engine uses the local sandbox for Forcepoint Advanced Malware Detection.
  Note: To use the local sandbox for Forcepoint Advanced Malware Detection, you must have a Forcepoint Advanced Malware Detection appliance.
• Local Sandbox - McAfee Advanced Threat Defense (ATD) — The engine uses McAfee Advanced Threat Defense.
  Note: McAfee Advanced Threat Defense is no longer supported in NGFW version 6.4.0 and later. We recommend that you use Forcepoint Advanced Malware Detection instead.
• None — The engine does not use a sandbox.

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

• None — Disables file reputation services.
• Threat Intelligence Exchange (TIE) — Enables the use of McAfee TIE file reputation services for file filtering.
• Global Threat Intelligence (GTI) — Enables the use of McAfee GTI file reputation services for file filtering.

(Optional)

Add — Allows you to add an HTTP Proxy to the list.

Remove — Removes the selected HTTP Proxy from the list.

(Firewall/VPN role only)

(Firewall/VPN role only)

(Firewall/VPN role only)

(Firewall/VPN role only)

• None — Does not create any log entry.
• Alert — Triggers an alert entry.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Stored — Creates a log entry that is stored on the Log Server.
• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view (if someone is viewing it) but is not stored.

• Edit Value — Opens the Alias Value Properties dialog box.
• Set to Any — The Alias element matches any value.
• Set to None — Disables translation for the Alias element.

(IPS only)

When selected, the NGFW Engine dynamically reduces the number of inspected connections if the load is too high.

Some traffic might pass through without any access control or inspection if this option is selected. Bypassed traffic is not counted when a possible license throughput limit is enforced. The bypass does not affect traffic subject to TLS Inspection.

If this option is not selected, the NGFW Engine inspects all connections. Some connections might not get through if the IPS engine gets overloaded.

The maximum amount of time the Management Server tries to connect to an NGFW Engine.

A consistently slow network connection might require increasing this value. The default value is 120 seconds.

Without this feature, you must switch to the previous configuration manually through the engine's boot menu.

Each certificate for system communications is valid for three years. If the certificate expires, other components refuse to communicate with the NGFW Engine.

(Firewalls only)

(IPS engines and Layer 2 Firewalls only)

(Firewalls only)

When connection tracking is enabled, reply packets are allowed as part of the allowed connection without an explicit Access rule.

You can override this engine-specific setting and configure connection tracking for TCP, UDP, and ICMP traffic in Access rules.

• Normal — The engine drops ICMP error messages related to connections that are not currently active in connection tracking. A valid, complete TCP handshake is required for TCP traffic. The engine checks the traffic direction and the port parameters of UDP traffic.
• Strict — The engine does not permit TCP traffic to pass through before a complete, valid TCP handshake is performed.
• Loose — The engine allows some connection patterns and address translation operations that are not allowed in the Normal mode. This mode can be used, for example, if routing is asymmetric and cannot be corrected or if the use of dynamic routing protocols causes the engine to receive non-standard traffic patterns.

(Not Virtual NGFW Engines)

(Not editable on IPS engines)

When the engine receives fragmented packets, it defragments the packets for inspection. The original fragments are queued on the engine until the inspection is finished. If the option is not selected, the packets are sent onwards as if they had arrived unfragmented.

(Not Virtual NGFW Engines)

(Not Virtual NGFW Engines)

(IPS engines and Layer 2 Firewalls only)

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

• Terminate and Log Connection — Stops the matching connections. This option is the default setting.
• Only Log Connection — Does not stop the matching connections. Creates a Terminate (passive) log entry for the matching connections. This option is useful for testing which types of connections are stopped.

(Firewalls only)

• Discard Silently — The connection is silently dropped.
• Refuse With TCP Reset — The connection is refused, and a TCP reset packet is returned.

(Optional)

• None — SYN rate limits are disabled.
• Automatic — The engine automatically calculates the Allowed SYNs per Second and Burst Size values for the interface based on the engine’s capacity and memory size.
• Custom — Enter custom values for Allowed SYNs per Second and Burst Size.

(Custom only)

(Custom only)

(Not Virtual NGFW Engines)

• Stop Traffic — The engine stops processing traffic and goes offline.
• Discard Log — Log entries are discarded in four stages, according to available space. Monitoring data is discarded first, followed by log entries marked as Transient and Stored, and finally log entries marked as Essential. The engine keeps processing traffic.

(Antispoofing Log Event Type for Firewalls only)

• Disabled — Scan detection is not enabled.
• Off (Can Be Overridden in Policy) — Scan detection is not enabled, but you can override this setting in individual Access rules. This option is the default setting.
• On (Can Be Overridden in Policy) — Scan detection is enabled. You can override this setting in individual Access rules if scan detection is not needed or to avoid false positives.

• Transient — Creates a log entry that is displayed in the Current Events mode in the Logs view, but is not stored.
• Stored — Creates a log entry that is stored on the Log Server.
• Essential — Creates a log entry that is shown in the Logs view and saved for further use.
• Alert — Triggers the alert you select.