I85PREP
⌘ K
Forcepoint NGFW Admin study materials
Forcepoint NGFW Admin study resources

Forcepoint NGFW Admin: NGFW Routing and Networking

Forcepoint NGFW Admin · Work through your exam, one topic at a time.

All guide sections

NGFW Routing and Networking

Domain 3 covers interface and route configuration, dynamic routing, multi-link ISP handling, antispoofing and VPN routing. The exam tests whether traffic leaves and returns by a path the firewall will accept.

Interfaces and routes

  • Interfaces can be physical, VLAN, tunnel or bridge. In a cluster, unique addresses are NDIs and shared addresses are CVIs.
  • Static routes need a destination network, gateway and metric. A default route sends unknown destinations to the ISP gateway; two defaults need different metrics or a multi-link design.
  • OSPF and BGP are configured in the Engine Editor. Advertise only the networks the firewall should attract, and verify neighbor state and learned routes.
  • Multi-Link provides outbound ISP redundancy and load balancing. It requires a Multi-Link element plus rules that select it; adding a second default route alone is not equivalent.
  • Antispoofing checks that the return path for a source address is plausible. Asymmetric routing, CVI addressing and policy-based routing can all cause valid traffic to be dropped.

VPN routing

  • Policy-based VPN selects traffic in access rules with a VPN action and relies on matching selectors.
  • Route-based VPN uses tunnel interfaces and routes. The tunnel interface must be up, and a route must point remote networks at it; otherwise the tunnel exists but traffic does not use it.
  • NAT and VPN interact: if traffic is hidden before entering a site-to-site tunnel, the remote selector may no longer match.

Worked example

A site has primary ISP 203.0.113.1 and backup 198.51.100.1. The engineer adds two equal-metric default routes and expects failover. Instead, traffic is unstable. The fix is a Multi-Link element with both ISP links, health checks, outbound NAT and access rules that reference it, so failure detection removes the dead link. If the provider offers BGP, advertise the public prefix and prefer the primary path with local preference. Reasoning: equal defaults do not detect a dead upstream; multi-link or BGP supplies the health and path selection.

Traps that cost marks

  • Two default routes with the same metric and no failure detection.
  • Antispoofing drops caused by asymmetric routing.
  • A tunnel interface with no route to the remote network.
  • Multi-Link defined but not referenced in NAT or access rules.
  • OSPF or BGP advertising internal networks to an untrusted neighbor.