Re-registering Forcepoint DLP components

Changing the Management Server | Forcepoint DLP | 8-June-2020

Re-register all Forcepoint DLP servers, agents, and protectors when the IP address or hostname of the Forcepoint management server changes.

Before starting the process, be sure to have the user name and password of a Forcepoint DLP administrator account with System Modules privileges.

Re-register Forcepoint DLP servers and agents

Go to each server and machine with a Forcepoint DLP agent installed and do the following:

Launch the Forcepoint Security Installer.

In the installer, select the Modify link next to Forcepoint DLP.

Accept the defaults in the installer screens and click Next, until the "Register with the Management Server" screen appears.

In the Register with the Management Server screen, enter the new IP address of the Forcepoint management server along with the user name and password of a Security Manager administrator with Forcepoint DLP System Modules permissions.

When the installers finish:

Log on to the Data Security module of Security Manager and go to the Settings > Deployment > System Modules page.

Verify that the components appear in the tree view.

Click Deploy.

Re-register ISO/Appliance protector

To re-register protector appliances:

Log on to each protector as root.

Enter the following command:

wizard securecomm

Enter the management server IP address along with the user name and password of a Forcepoint DLP administrator with System Modules privileges.

Log onto the Data Security module of the Forcepoint Security Manager and go to the Settings > Deployment > System Modules page.

Verify that the protector appears in the tree view.

Click Deploy.

Re-register Forcepoint DLP Protector software package

To re-register Forcepoint DLP Protector software package:

Log on as root.

Enter the following command:

sudo -i wizard securecomm

Enter the management server IP address along with the user name and password of a Forcepoint DLP administrator with System Modules privileges.

Log onto the Data Security module of the Forcepoint Security Manager and go to the Settings > Deployment > System Modules page.

Verify that the protector appears in the tree view.

Click Deploy.

Re-register Content Gateway

To enable the Forcepoint Web Security DLP Module, connect Content Gateway to the Forcepoint DLP components on the management server:

Ensure that Content Gateway and management server systems are running and accessible, and that their system clocks are approximately synchronized.

Ensure the Content Gateway machine has a fully qualified domain name (FQDN) that is unique in the network. Hostname alone is not sufficient.

If Content Gateway is deployed as a transparent proxy, ensure that traffic to and from the appliance management interface (C) is not subject to transparent routing. If it is, the registration process will be intercepted by the transparent routing and will not complete properly.

Make sure that the IPv4 address of the eth0 NIC on the Content Gateway machine is available (not required if Content Gateway is located on a Forcepoint appliance). The management server uses the eth0 NIC during the registration process.

After registration, the IP address can move to another network interface on the same machine; however, that IP address is used for configuration deployment and must be available as long as the 2 modules are registered.

In the Content Gateway manager, go to the Configure > Basic > General tab.

Make sure that the Integration > Web DLP (integrated on-box) option is turned On, then click the Not Registered link.

The Configure > Security > Web DLP registration screen opens.

Enter the IP address of the Forcepoint management server.

Enter the user name and password for a Forcepoint DLP administrator with Manage System Modules privileges.

Click Register. A reminder to synchronize the system time between the Content Gateway and management server machines is displayed.

10.

If registration succeeds, a Forcepoint DLP Configuration page displays. Set the following configuration options:

Enable the Analyze FTP Uploads option to send FTP uploads to Forcepoint DLP for analysis and policy enforcement.

Enable the Analyze Secure Content option to send decrypted HTTPS posts to Forcepoint DLP for analysis and policy enforcement.

These options can be accessed from the Configure > Security > Web DLP > General tab.

11.

Click Apply, then restart Content Gateway.

12.

Go to the Data Security module of the Security Manager and click Deploy to complete the registration process.

Troubleshooting the connection between Content Gateway and Forcepoint DLP

If Content Gateway cannot register with Forcepoint DLP components (an error appears in the Content Gateway manager), be sure that a ping from the proxy machine to the Forcepoint management server succeeds.

If the ping fails, use the ipconfig command on the management server machine to verify its IP address.

If the proxy is on a Forcepoint appliance, try pinging the IPv4 address of the appliance's C interface from the management server.

If the proxy is not on an appliance, try pinging the IPv4 address of the Content Gateway host system eth0 network interface from the management server.

The registration process requires that Content Gateway is reachable on eth0. After registration, the IP address may move to another network interface on the system, but that IP address must remain available while the modules are being registered.

If Content Gateway is deployed as a transparent proxy and the communication interface ("C" on a Forcepoint appliance) is subject to transparent routing, the registration process was likely intercepted by the transparent routing and prevented from completing. Ensure that traffic to and from the communication interface is not subject to transparent routing.

If registration still fails, make sure that neither the proxy machine nor the management server has a machine name with a hyphen in it. This has been known to cause registration problems.

And make sure the Content Gateway machine has a fully qualified domain name (FQDN) that is unique in the network. Hostname alone is not sufficient to register the proxy with the management server.