Forcepoint NGFW Admin: NGFW Troubleshooting and Maintenance

Domain 5 covers fault isolation and maintenance: diagnosing policy installation, connectivity and cluster failover, using logs and packet capture, and upgrading or backing up without an outage. The exam favors a sequence: scope the fault, verify state, gather evidence, change one thing, retest.

Diagnostic sequence

• Scope first: one user or all users, one engine or the whole cluster, and whether the fault began after a change.
• Check engine and node status, cluster state, installed policy version, license, disk space and heartbeat.
• Use traffic logs and inspection logs to see whether the connection reached the firewall and which rule or inspection acted.
• Use tcpdump on the relevant interface for packet-level proof; use ping and traceroute for path checks. Run sg-reconfigure when the initial configuration must be redone.
• Policy installation failures commonly come from management connectivity, version mismatch, invalid configuration, expired license or full disk. Read the installation message before changing the policy.

Cluster and upgrade maintenance

• In a cluster, verify which node is active, whether nodes are synchronized, and whether the standby can take over. Suspend a node before maintenance rather than pulling it abruptly.
• Upgrade one node at a time: upgrade the standby, fail over, verify traffic, then upgrade the former active node. Upgrading both at once removes redundancy.
• Check SMC and engine version compatibility before upgrading. Keep a backup and a known-good policy version for rollback.
• Log Server disk exhaustion can stop or drop logging even when traffic still passes; monitor retention and free space.

Worked example

After an engine upgrade, the standby node shows up but does not forward traffic when the active node is suspended. Check that both nodes run the same policy version and compatible engine build, that heartbeat is healthy, and that the CVI is owned by the expected node. Logs show the standby never received the current policy. Reinstall the policy to the cluster, confirm synchronization, then repeat the failover test. Reasoning: an up node is not a ready node; policy version and cluster synchronization must match before failover is trustworthy.

Traps that cost marks

• Upgrading both cluster nodes simultaneously.
• Ignoring the compatibility matrix between SMC and engines.
• Assuming a policy install succeeded because the dialog closed.
• Skipping backups or rollback planning.
• Overlooking a full Log Server disk when logs are missing.