First-time configuration wizard

Help | i-Series Appliance | Version 1.8.x

The Forcepoint i-Series appliance First-Time Configuration Wizard walks you through some initial settings that are important for appliance operation. You must complete the wizard before you can manage the appliance. Canceling the wizard before completing initial appliance configuration logs you out of the appliance, and any settings you may have entered up to that point are not saved.

Before you begin the wizard, you must perform the following tasks:

Rack your appliance and plug it in (if you are deploying a physical appliance).

If you are deploying a virtual appliance, download the OVF file and deploy your virtual appliance. See the Getting Started Guide for details.

Power the appliance on.

Connect a computer to it. Ensure the computer has DHCP enabled.

Access the appliance manager via a Web browser.

See Appliance quick start for details.

Click Next on the Welcome page to start the wizard.

Appliance hostname

In the Hostname page, enter the appliance hostname or fully qualified domain name (FQDN). The name may consist of 1 - 32 alphanumeric characters, dashes, and periods. It must begin with a letter and cannot end with a period.

If you are using Active Directory authentication, see System information for Active Directory hostname requirements.

Format for an appliance hostname is:

hostname

You can also use the format hostname.parentdomain.

Format for the FQDN is:

hostname.parentdomain.com

Click Next to continue with the wizard.

Appliance network interfaces

The Network Interfaces page lets you configure your appliance interfaces for outbound traffic and appliance management. You can also designate your DNS servers on this page.

Web traffic and appliance management

Specify the appliance IP address and subnet mask in the Outbound Traffic section for the network bridge created by the B1 and B2 interfaces. These interfaces are used for all outbound traffic. One interface (B1) handles traffic routed out of your network, and the other (B2) handles traffic to your internal network.


	Note Ensure you have configured valid routing between the bridge interface and any client generating traffic that is intercepted by the appliance (either explicitly for management purposes or transparently for authentication, quota, or confirm actions), taking the VLAN tag into account. See VLAN tag for more information.

Provide the IP address and subnet mask for the C1 interface in the Appliance Management section. The C1 interface is used for appliance management functions. This interface can also be used when the B1/B2 bridge interface is in hardware bypass mode.

You can allow appliance management via the B1 and B2 bridge interfaces along with the C1 interface. Mark the Allow appliance management access in addition to the C1 interface check box to enable this capability. This is the default configuration.


	Note Although by default you may access the appliance manager via either the bridge or management interfaces, use of the management interface for this function is recommended.

If you are deployed on a virtual appliance that does not include the appliance bypass function, use of the C1 interface for appliance management is optional. If you do not define a C1 management interface, then you must use the B1/B2 bridge interface for management purposes. The Use this interface for appliance management check box is marked and not user accessible.

Enter the IP address and subnet mask for the C1 interface. The Allow appliance management access in addition to the C1 interface check box is then accessible for marking or clearing.

DNS servers

You must define a DNS server by entering its IP address in the DNS Servers section IP address field and clicking Add. The IP address appears in the DNS Server IP Address list.

You may define up to 3 DNS servers, each with a different IP address.

After you select an IP address in the DNS Server IP Address list, you can:

Remove the address by clicking Remove.

Move the address up or down in the list, to change the order in which the servers are used to process traffic. Use the up or down arrow to move a selected address, as appropriate.

Click Next to continue with the wizard.

Routing

The Routing page lets you define your default gateway, along with any static routes you may need. You can also specify a VLAN tag for management traffic, which the appliance uses to communicate with Forcepoint cloud and database download services. This tag may also be used by clients that communicate with the appliance bridge interface.


	Note Ensure you have configured valid routing between any client generating traffic that is intercepted by the appliance and the bridge interface, taking into account the VLAN tag that you define on this page.

Default gateway

On the Routing page, specify the IP address of your default gateway for outbound traffic.

In many cases, you need only a gateway specification on this page. However, you can use the Routing Table to configure static routes. Configuring routes on the main bridge interface should not be necessary. For more information, see the Getting Started Guide.

Static routes

To add static routes, click Routing Table, and then Add. Provide the following route information in the Route Properties dialog box:

Destination network

Subnet mask for the destination network

Gateway IP address

Interface used. In the drop-down list, select either Bridge (B1, B2) or Management (C1).

You may edit route properties by clicking the route destination network IP address link to open the Route Properties dialog box.

Remove a route from the table by marking the check box to the left of the desired route's row and clicking Remove.

VLAN tag

The appliance can be configured to analyze virtual LAN (VLAN) tagged and untagged traffic. All VLAN traffic is analyzed unless you define some of that traffic as trusted. You can bypass analysis for untagged traffic and for specific VLAN tags in the Forcepoint cloud service portal. See the Getting Started Guide for configuration details.

The appliance supports the use of a single VLAN tag for management communication traffic from the appliance to the cloud and database download services. This tag is also used by any client that communicates with the appliance bridge interface (B1 and B2) either explicitly for management purposes or transparently for authentication, quota, or confirm actions.

Activate VLAN tag support by marking the Use the following VLAN tag check box. Enter the desired tag in the entry field using a number from 0 to 4094.


	Note If you change the VLAN tag while your client is connected to the appliance management interface, you may lose connectivity with the appliance. Ensure that your client routing includes the new VLAN configuration to recover the connection.

Click Next to continue with the wizard.

Finish

The final page of the wizard summarizes the entries and selections you have made. If you want to change any setting after your review, click Back to access the desired wizard page and edit your settings.

If you are satisfied with your settings, click Finish.

At this point, you are logged off the appliance. You must log back in for your configuration settings to take effect.

When you log back in, you are prompted to change your initial password (if you have not already done so) and register the appliance with the Forcepoint cloud service. See Appliance registration for information.


	Note If you are unable to access the appliance, you can connect to the appliance manager interface at any time via https://169.254.0.2.