Appliance quick start

Help | i-Series Appliance | Version 1.8.x

Before you begin the appliance quick start setup instructions, you should consider the following issues:

If you plan to deploy a physical appliance, determine appliance rack location.

If you plan to deploy a virtual appliance, verify your system requirements:

VMware vSphere ESXi platform version 5.1 or 5.5

6 CPU cores, 12 GB RAM (minimum)

128 GB hard disk drive

Optional: Silicom network bypass card (Silicom PE2G2BPI80-SD-R) with 2 dedicated network interfaces (must be installed on ESXi in VMDirectPath mode)

Some models of HP hardware do not support VMDirectPath mode.

Determine appliance IP addresses for network deployment.

If you plan to use Active Directory authentication, ensure that your appliance hostname complies with Active Directory hostname requirements. See Appliance hostname for a list of hostname guidelines.

The appliance ships with a pre-installed Web category database. After appliance setup, an update to this database is initiated. During this update, the appliance can analyze traffic using the pre-installed database. Traffic analysis may be more accurate after the full update is complete.

A progress message and status indicator displayed on the Status > General page disappear when the update is complete. This message appears only for the initial update.

If your network includes a firewall, ensure that appropriate ports are open. See Appliance network connection for details.

If you plan to control VLAN traffic in your network, see the Getting Started Guide for information about VLAN tags.

Initial Forcepoint cloud service settings

Perform the following steps in the cloud service portal:

Ensure that your cloud service account is established.

Click Network Devices in the cloud service console to display a list of your network appliances.

Click Add and enter new appliance information. See the Getting Started Guide for detailed information.

Important

Be sure to perform the following:

Generate a CA certificate. Ensure that the certificate is not encrypted.

Import this certificate to all relevant browsers.

Upload this certificate to each appliance using the Certificates tab.

See the Getting Started Guide for detailed instructions.

You should also install a Forcepoint Root Certificate to implement SSL decryption. See the Defining Web Policies topic in Cloud TRITON Manager Help.

Appliance setup and configuration

Perform the following steps to set up and configure a physical appliance:

Verify the contents of the accessory box that was shipped with the appliance. It should include power cable, an appliance bezel, and a quick start poster.

Rack the appliance and plug it in.

Power the appliance on and allow the boot sequence to complete.

Connect a computer with DHCP enabled (such as a laptop) to the appliance C1 interface. Wait a few moments, until the automatic network setup process is complete, to begin appliance configuration.

Log on to the appliance via a Web browser connection (https://169.254.0.2). Credentials are admin/admin.

Complete the appliance First-Time Configuration Wizard. See First-time configuration wizard for wizard instructions.

Log off the appliance and disconnect the computer from the appliance.

See the Getting Started Guide for information regarding virtual appliance setup and configuration.

Appliance network connection

Connect the appliance to your network. The sample diagram shows a possible deployment:

If your network includes a firewall, you need to ensure that destination TCP ports are open for connection to the cloud service. By default, the appliance is configured to use standard destination ports 80 and 443 for these connections.

Alternatively, and depending on your corporate firewall policy, you can configure your appliance to use the following ports, which are used for non-appliance connections to the cloud service:


Port	Purpose
8002	Configuration and policy update information retrieval from the Forcepoint cloud service. This port must be open for an i-Series appliance to retrieve periodic configuration setting and policy updates from the cloud service.
8081	Proxy service. This is where the cloud-based content analysis is provided.
80	Notification page components. The default notification pages refer to style sheets and images served from the cloud service platform. For these pages to appear correctly, this Web site is accessed directly (i.e., not through the cloud service).
443	Service administration. The Forcepoint administration portal is similarly unproxied. Otherwise, it would be possible for you to accidentally block access and then be unable to rectify the situation.

You can switch between the standard and alternative ports at any time using the appliance command-line interface (CLI). See the Getting Started Guide for detailed instructions about switching port settings.

You should also open the outbound Network Time Protocol (NTP) port (UDP 123) to allow system time/clock synchronization in the system.

Appliance registration

Perform the following steps to register the appliance with the cloud service:

In the Forcepoint cloud service console, click Network Devices.

Select the row that contains your new appliance and click Register.

Copy the registration key in the Register Appliance box and click Close.

Appliance registration completion and password change

Perform the following steps to complete appliance registration:

Reconnect to the appliance using the management IP address (C1) or the default address (169.254.0.2) and log in.

Change the appliance password if you have not already done so.

Paste the cloud service registration key into the Registration key field.

At this point, an update to the pre-installed Web category database begins. During this update, the appliance can analyze traffic using the pre-installed database. Note that analysis may be more accurate after the update process completes. A download progress message and status indicator displayed on the Status > General page disappear when the update is complete.