NGFW 6.9 Online Help

Home
Traffic inspection policies
Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
Editing policies
The rules in Firewall, IPS, Layer 2 Firewall, and Layer 2 Interface Policies allow you to control how the engines inspect and filter network traffic, and how NAT (network address translation) is applied on Firewalls, Master NGFW Engines, and Virtual Firewalls.
Editing rules in a policy
Editing rules consists of defining matching criteria for different rule cells and making sure that the rules are organized in a logical way in the rule table.

About this Help
This online help was created for Forcepoint Next Generation Firewall (Forcepoint NGFW), version 6.9.0.
Introduction to the Forcepoint Next Generation Firewall solution
Before setting up Forcepoint Next Generation Firewall (Forcepoint NGFW), it is useful to know what the different components do and what engine roles are available.
Deployment
Before you can set up the system and start configuring elements, you must consider how the different SMC components should be positioned and deployed.
Setting up
After deploying the SMC components, you are ready to start using the Management Client and carrying out some of the first configuration tasks.
Monitoring
You can use the SMC to monitor system components and third-party devices. You can also view and filter logs, and create Reports from them.
Controlling NGFW Engines
You can command and set options for engines through the Management Client or on the engine command line. You can also stop traffic manually.
SMC configuration
Security Management Center (SMC) configuration allows you to customize how the SMC components work.
NGFW Engine configuration
You can create and modify Firewalls, IPS engines, Layer 2 Firewalls, Master NGFW Engines and Virtual NGFW Engines. You can configure the NGFW Engine properties, activate optional features, and configure advanced NGFW Engine settings.
Routing
Use the Management Client to configure static or dynamic routing, and use a Multi-Link configuration to manage and distribute inbound and outbound connections.
Traffic inspection policies
Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
- Creating and managing policy elements
  Policy elements are containers for the rules that determine how NGFW Engines, Master NGFW Engines, and Virtual NGFW Engines examine traffic. The policy elements for the engines include Template Policies, Policies, and Sub-Policies.
- Ethernet rules
- Access rules
  Access rules are lists of matching criteria and actions that define how the engine treats different types of network traffic. They are your main configuration tool for defining which traffic is stopped and which traffic is allowed.
- NAT rules
- Inspection Policy elements
  Inspection Policy elements define how the engines look for patterns in traffic allowed through the Access rules and what happens when a certain type of pattern is found.
- Editing policies
  The rules in Firewall, IPS, Layer 2 Firewall, and Layer 2 Interface Policies allow you to control how the engines inspect and filter network traffic, and how NAT (network address translation) is applied on Firewalls, Master NGFW Engines, and Virtual Firewalls.
  - Getting started with editing policies
    Rules in policies are instructions to the engines for handling traffic.
  - The different parts of the policy editing view
    The tabs and options shown in the policy editing view depend on the type of policy you are editing.
  - Editing rules in a policy
    Editing rules consists of defining matching criteria for different rule cells and making sure that the rules are organized in a logical way in the rule table.
    - Editing rule tables
      Use the right-click menu options to add, remove, and organize rules.
    - Editing rule cells
      Rule cells define the matching criteria for the rules.
    - Define Source, Destination, and Service criteria in rules
      You can create detailed sets of matching criteria for the rule in the Source, Destination, and Service cells.
    - Adding comments in policies
      You can add comments to the Comment cell in each rule or you can insert Rule Sections to add comment rows to the policy.
    - Rule identifiers and how they work
      The ID and Tag for each rule are automatically created and updated. You can optionally specify a name for each rule.
    - Naming rules
      You can optionally add a name or short description to a rule to help identify it.
    - Searching in rules
      You can search rules in rule tables and on the Inspection tab of Inspection Policies.
    - Run a rule counter analysis
      Each rule contains a Hits cell that shows how many times each rule in your policy has matched network traffic. Viewing the rule hits allows you to find valid rules that match traffic that the engine does not encounter in the network.
  - Add Insert Points in Policy Templates
    Insert Points mark the positions where rules can be added.
  - Automatic rules and how they work
    When you enable a feature that requires traffic between certain components to be allowed, rules allowing the traffic are automatically created.
  - Configure settings for Automatic rules
    View a summary of Automatic rules and manage related settings in the Engine Editor.
  - Add Ethernet rules
    Ethernet rules define which Ethernet protocol packets the engines stop, and which packets are allowed through.
  - Add Access rules
    Access rules are used in Firewall, IPS, Layer 2 Firewall, and Layer 2 Interface Policies.
  - Add NAT rules
    NAT rules define how NAT is applied to matching connections.
  - Add Inspection rules
    Inspection rules filter traffic based on traffic patterns. Inspection rules are stored in Inspection Policy elements.
  - Add Exception rules
    Inspection Exceptions allow you to make changes to the Inspection Policy that are not applied to all connections.
  - Specify rule validity times
    You can specify when Access rules, inspection Exception rules, and rules in Alert policies are enforced.
  - Validate rules automatically
    You can automatically validate the rules in a policy at any time.
  - How default rules can be changed
    Rules inherited from the default Template policies cannot be edited directly. Instead, you can create a copy of the default Template policies.
- Defining IP addresses
  When you define IP addresses as elements, you can use the same definitions in multiple configurations for multiple components.
- Working with Service elements
  Service elements match traffic based on protocol or port and set options for advanced inspection of traffic. Service elements are used in Firewall Policies, IPS Policies, Layer 2 Firewall Policies, and Layer 2 Interface Policies.
- Defining Situation elements
  Situation elements contain the context information that defines the pattern that the NGFW Engine looks for in the inspected traffic. Situation elements also define the patterns that match events in the traffic.
- Using Network Application elements
  Network Application elements collect combinations of identified characteristics and detected events in traffic to dynamically identify traffic related to the use of a particular network application.
- Defining User Response elements
  With the User Response element, you can send customized replies to users, instead of just closing an HTTP or HTTPS connection.
- Quality of Service
  The Quality of Service (QoS) features allow you to manage bandwidth and prioritize connections on the NGFW Engines. QoS features are available on Firewalls, IPS NGFW Engines, Layer 2 Firewalls, Master NGFW Engines, Virtual Firewalls, Virtual IPS NGFW Engines, and Virtual Layer 2 Firewalls.
- File filtering
  Monitoring and restricting what data is sent out is an important part of data loss prevention (DLP). File filtering allows you to restrict the file types that are allowed in and out through the firewall, and to apply malware detection to files.
- Integrating Endpoint Context Agent
  If you have installed Forcepoint Endpoint Context Agent (ECA) clients on the endpoints in your network, you can collect information about endpoint clients, and use the information for access control in the SMC.
- Filtering URLs
  URL filtering allows you to filter URLs based on categories of content or lists of individual URLs.
- Anti-malware scanning
  An anti-malware scanner compares network traffic against an anti-malware database to search for malware. If malware is found, the traffic is stopped or content is stripped out.
- Protocol Agents on NGFW Engines
  Protocol elements of the Protocol Agent type are special modules for some protocols and services that require advanced processing. Protocol Agents can enforce policies on the application layer.
- Sidewinder Proxies
  Sidewinder Proxies are software modules that provide network level proxies, protocol validation, and configurable application level protocol filtering and translation on Forcepoint Next Generation Firewall.
- Setting up TLS inspection
  The TLS inspection feature decrypts TLS connections so that they can be inspected for malicious traffic and then re-encrypts the traffic before sending it to its destination.
- Forward traffic to a proxy service for external inspection
  In addition to inspecting traffic on the NGFW Engine, you can transparently forward traffic to a proxy service in the cloud or on premises. For example, you can forward all HTTP and HTTPS traffic to the Forcepoint Web Security Cloud service.
- Blacklisting IP addresses
  Blacklisting is a way to temporarily block unwanted network traffic either manually or automatically with blacklist requests from an NGFW Engine or Log Server. Firewalls, IPS engines, Layer 2 Firewalls, and Virtual NGFW Engines can use a blacklist for blocking traffic.
Users and authentication
User accounts are stored in internal databases or external directory servers. You can use Forcepoint NGFW in the Firewall/VPN role or external authentication servers to authenticate users.
Virtual private networks
Forcepoint NGFW supports both policy-based and route-based VPN (virtual private network) tunnels between VPN gateways. For full remote access, Forcepoint NGFW supports both IPsec and SSL VPN tunnels for VPN clients.
Maintenance and upgrades
Maintenance includes procedures that you do not typically need to do frequently.
Troubleshooting
Troubleshooting helps you resolve common problems in the Forcepoint NGFW and SMC.
Appendices

Editing rules in a policy

Editing rules consists of defining matching criteria for different rule cells and making sure that the rules are organized in a logical way in the rule table.

Editing rule tables
Use the right-click menu options to add, remove, and organize rules.
Editing rule cells
Rule cells define the matching criteria for the rules.
Define Source, Destination, and Service criteria in rules
You can create detailed sets of matching criteria for the rule in the Source, Destination, and Service cells.
Adding comments in policies
You can add comments to the Comment cell in each rule or you can insert Rule Sections to add comment rows to the policy.
Rule identifiers and how they work
The ID and Tag for each rule are automatically created and updated. You can optionally specify a name for each rule.
Naming rules
You can optionally add a name or short description to a rule to help identify it.
Searching in rules
You can search rules in rule tables and on the Inspection tab of Inspection Policies.
Run a rule counter analysis
Each rule contains a Hits cell that shows how many times each rule in your policy has matched network traffic. Viewing the rule hits allows you to find valid rules that match traffic that the engine does not encounter in the network.

© 2020 Forcepoint
Published 8 December 2020