Installation, deployment, and upgrade

Release Notes | I Series Appliance | Updated: 01-May-2019

Installation and set up for the Forcepoint I Series appliance are summarized on the Quick Start poster that was shipped with your appliance. Click here to view a copy of the quick start guide.

See the Getting Started Guide for information about system configuration.


	Important Use of Microsoft Internet Explorer 8 (or below) on a Windows XP machine is not supported.

If your network includes a firewall, you need to ensure that destination TCP ports are open for connection to the cloud service. By default, the appliance is configured to use standard destination ports 80 and 443 for these connections.


	Note Upgrade from a previous appliance version that uses different default port settings does not automatically change port configuration settings. If you want to use destination ports 80 and 443, you should modify appliance settings manually after the upgrade process.

Alternatively, and depending on your corporate firewall policy, you can configure your appliance to use the following ports, which are used for non-appliance connections to the cloud service:


Port	Purpose
8002	Configuration and policy update information retrieval from the Forcepoint cloud service. This port must be open for an I Series appliance to retrieve periodic configuration setting and policy updates from the cloud service.
8081	Proxy service. This is where Forcepoint cloud-based content analysis is provided.
80	Notification page components. The default notification pages refer to style sheets and images served from the Forcepoint cloud service platform. For these pages to appear correctly, this web site is accessed directly (i.e., not through the Forcepoint cloud service).
443	Service administration. The Forcepoint administration portal is similarly unproxied. Otherwise, it would be possible for you to accidentally block access and then be unable to rectify the situation.

You can switch between the standard and alternative ports at any time using the appliance command-line interface (CLI). See the Getting Started Guide for detailed instructions about switching port settings.

You should also open the outbound Network Time Protocol (NTP) port (UDP 123) to allow time/clock synchronization in the system.


	Note The transfer of new password and appliance registration information between the cloud portal and the appliance takes several minutes. You may experience a delay when logging in after a change is made to these settings.

Deployment

Additional considerations should be examined for some I Series appliance deployments, including those that use:

an I Series virtual appliance

endpoint devices or PAC-enabled clients that communicate directly with the cloud

See Mixed-mode deployment issues for information about handling traffic via these devices.

Virtual appliance

The I Series virtual appliance may be deployed with or without the network bypass capability. Download the appliance image (OVF format) from the Forcepoint My Account Downloads page, and see the Getting Started Guide for virtual appliance deployment instructions.


	Note If you want to deploy a virtual appliance with the network bypass capability, your hardware must support the ESXi DirectPath I/O function.

If you plan to deploy a virtual appliance, you should verify the following system requirements:

VMware vSphere ESXi platform versions 5.1, 5.5, or 6.0

6 CPU cores, 12 GB RAM (minimum)

128 GB hard disk drive

Optional: Silicom network bypass card (Silicom PE2G2BPI80-SD-R) with 2 dedicated network interfaces (must be installed on ESXi in VMDirectPath mode)

Some models of HP hardware do not support VMDirectPath mode.

Mixed-mode deployment issues

If your network includes an I Series appliance along with endpoint devices or PAC-enabled clients that communicate with the cloud directly (for example, roaming users), you may encounter additional deployment issues. You should consider the following port information before you deploy:

Use of the site's egress as a policy connection is not supported. As a result, endpoint or PAC-enabled clients are treated as roaming users regardless of whether they are connected within the network LAN.

Endpoint device and PAC-enabled client traffic directly to the cloud service in a network that includes an I Series appliance is supported on ports 8081 and 8082. If the deployment requires the use of ports 80 and 443 for endpoint client traffic, please contact Forcepoint Technical Support.

When a Forcepoint Endpoint requests a PAC file download, the cloud service can return a custom PAC file that first directs endpoint traffic to the appliance rather than redirecting it to the cloud service. Please contact Forcepoint Technical Support for assistance to activate this feature.

Endpoint device traffic directly to the cloud service in a network that includes an I Series appliance is supported on port 80, but traffic from a PAC-enabled client on port 80 is not supported.

Applications that use HTTP (e.g., IM clients) may still try to use port 80 or 443 for outbound traffic. This traffic is intercepted and processed by the I Series appliance, which may lead to inconsistent behavior. This potential problem should be checked on a per-site, per-application basis, and a resolution determined based on a customer's actual needs, for example:

Block the applications at the firewall level

Use other ports for the applications

Upgrade

Use the following steps to upgrade from a previous version of the Forcepoint I Series appliance:

Click Network Devices in the cloud portal.

Select the appropriate appliance for the upgrade and click Properties & Statistics.

Click Version History.

Find the desired upgrade and click the Download icon in the Action column. This operation downloads the upgrade to the selected appliance.

Clicking the View icon in the Description column opens the Release Notes for that upgrade.

In the I Series appliance Configuration > Upgrade Management page, find the upgrade in the table at the top of the screen. The upgrade status should be Downloaded (you may need to refresh the screen to see the change). Click the Install icon to install the upgrade.


	Important Upgrade status may display as "Failed" after a successful upgrade. This incorrect error message may appear if you refresh the appliance user interface immediately after the upgrade operation. Please wait approximately 5 minutes to refresh the user interface after the upgrade. If the problem persists after this time period, please contact Forcepoint Technical Support.