Forcepoint NGFW Admin flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Master NGFW Engine

An NGFW Engine that also hosts the Management Server, allowing it to manage itself and other engines. Non-Master engines are managed remotely by the SMC.

Engine installation wizard

Console-driven tool on a physical appliance that partitions disks, installs the engine image, and configures the management IP and SMC connection.

Cluster heartbeat interface

Dedicated interface or VLAN used by cluster nodes to exchange state and health. Heartbeat failure can cause split-brain, where both nodes become active.

SMC communication port

The engine contacts the Management Server on TCP 443 by default. The SMC pushes policy and configuration over this channel.

Proof-of-serial licensing

A license mechanism where the engine's serial number is registered to enable traffic. An unlicensed engine drops traffic after the grace period.

Virtual engine minimum resources

A virtual NGFW Engine typically needs at least 2 vCPU, 4 GB RAM, and two virtual NICs: one for management and one for traffic.

First-match rule evaluation

Firewall rules are evaluated top-down and the first matching rule applies. Order rules from most specific to most general, ending with deny-all.

Continue rule action

A rule action that logs or inspects traffic but does not terminate evaluation; remaining rules are still checked and can override the result.

Jump rule action

Sends matching traffic to a sub-policy for evaluation, then returns to the parent policy. Useful for organizing large rule sets.

Inspection policy

Attached to a firewall rule to enable IPS, anti-malware, URL filtering, and application control. Without a matching rule, traffic passes uninspected.

Template policy

A shared rule set pushed to multiple engines. Engine-specific policies can extend or override the template for local exceptions.

NAT rule vs firewall rule

NAT rules translate addresses; firewall rules allow or deny traffic. Both must permit the connection, considering pre- or post-NAT addresses.

Policy validation

A pre-install check that blocks installation when elements are unresolved or interfaces are unassigned, showing the specific error in the SMC.

Rule logging option

Per-rule setting that stores matching connections in the log. 'Log Summary' aggregates entries; denied traffic is logged by default.

Static route administrative distance

A metric that ranks routes; lower distance wins. The engine builds its routing table from connected networks, static routes, and dynamic protocols.

Policy-based routing

Routing that matches on source, destination, and service, then forwards to a next-hop or interface. PBR rules are evaluated before the main routing table.

Destination NAT routing

After destination NAT, the engine routes to the translated destination address. Firewall rules must allow the post-NAT destination.

Source NAT return path

After source NAT, return traffic must be routed back to the engine so stateful inspection can match it to the original connection.

VLAN interface requirement

A VLAN interface requires the parent physical interface to be up and the VLAN ID to match the connected switch configuration.

Asymmetric routing impact

Traffic that leaves and returns via different paths breaks stateful inspection, because the engine sees only one direction of the flow.

Multi-link ISP redundancy

Link selection rules choose an outbound link based on source, destination, or probe status. A link is considered up only when probes succeed.

OSPF neighbor requirements

OSPF neighbors must share matching area IDs and authentication settings, and be reachable on the interface where OSPF is enabled.

SMC role-based administration

Limits which domains and engines an administrator can view or edit. Use separate accounts per admin and enable strong authentication.

Log forwarding to SMC

Engines store logs locally and forward them to the SMC log server. The Log Browser filters by engine, rule, source, destination, and action.

SMC alert notifications

The SMC can send email or SNMP traps for engine down, policy install failure, license expiry, and high resource usage.

Engine monitoring views

The SMC shows engine status including CPU, memory, disk, connections, interface statistics, cluster node state, and VPN tunnel status.

SMC configuration backup

Captures the SMC configuration database. Engine backups capture local engine configuration. Schedule backups before upgrades.

SNMP engine monitoring

The engine's SNMP agent exposes interface counters and health metrics. Configure the community string in the SMC.

Engine status check

First troubleshooting step: verify engine status in the SMC (Configured, Not Configured, Error) and connectivity to the SMC on TCP 443.

sg-status command

Engine command-line tool that reports the state of engine services. Use with log files under /var/log for diagnosis.

Policy install failure causes

Common causes are unresolved elements, missing interface assignment, or a rule referencing a deleted element. The SMC install log shows the specific error.

Cluster split-brain

Occurs when heartbeat connectivity fails and both cluster nodes become active, causing duplicate traffic handling and state inconsistency.