Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Appliances Command Line Interface > Appliance interface configuration > Interface ports
Interface ports
show port
Display the status of the specified port on a virtual interface.
show port --module <email|proxy|web|network-agent|analytics-engine>
 
Parameter
Description
module
Appliance module; Email, Proxy, Web, Network Agent, or Analytics Engine.
Command modes
All products.
Examples
(config)# show port --module email
Related commands
 
Command
Description
set port
Open or close the specific port and each interface.
test tcp port
Test whether the TCP port is open for connection.
show diagnostic_ports
Display the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set diagnostic_ports
Set the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set port
Open or close the specific port and each interface.
set port --status <open|close> --protocol <tcp|udp> --port <port_num> --module <email|proxy|web|network-agent|analytics-engine>
 
Parameter
Description
status
Status of the port; open or close.
protocol
Protocol used to read and write data; TCP or UDP.
port
Port to open or close.
module
Appliance module; Email, Proxy, Web, Network Agent, or Analytics Engine.
Command modes
All products.
Examples
(config)# set port --module email --port 25 --protocol tcp --status open
Related commands
 
Command
Description
show port
Display the status of the specified port on a virtual interface.
test tcp port
Test whether the TCP port is open for connection.
show diagnostic_ports
Display the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set diagnostic_ports
Set the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
test tcp port
Test whether the TCP port is open for connection.
test tcp port [--module <email|proxy|web|network-agent|analytics-engine] --dest <ipv4_address|hostname> --port <integer>
 
Parameter
Description
module
(Optional) Appliance module; Email, Proxy, Web, Network Agent, or Analytics Engine.
dest
IPv4 address or hostname.
port
Port to test.
Command modes
All products. Not supported in Azure.
Examples
(config)# test tcp port --port 80 --dest 10.206.22.97
Related commands
 
Command
Description
show port
Display the status of the specific port on a virtual appliance.
set port
Open or close the specific port and each interface.
show diagnostic_ports
Display the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set diagnostic_ports
Set the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
show diagnostic_ports
Display the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
show diagnostic_ports
Command modes
Forcepoint Web Security.
Examples
(view)# show diagnostic_ports
Related commands
 
Command
Description
show port
Display the status of the specified port on a virtual appliance.
set port
Open or close the specific port and each interface.
test tcp port
Test whether the TCP port is open for connection.
set diagnostic_ports
Set the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set diagnostic_ports
Set the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
set diagnostic_ports --status <enabled|disabled>
 
Parameter
Description
status
Status of the port; enabled or disabled.
Command modes
Forcepoint Web Security.
Examples
(config)# set diagnostic_ports --status enabled
Related commands
 
Command
Description
show port
Display the status of the specified port on a virtual interface.
set port
Open or close the specific port and each interface.
test tcp port
Test whether the TCP port is open for connection.
show diagnostic_ports
Display the status of diagnostic ports for use by Forcepoint Technical Support for remote troubleshooting.
Support for IPv6
*
IPv6 support in Forcepoint Web Security and Forcepoint URL Filtering is disabled by default.
 
* 
Important 
After IPv6 support is enabled, subsequent disablement requires a full restart of the appliance.
For all web protection solutions, IPv6 support includes:
*
Dual IP stack configuration for interfaces C and N
*
IPv6 traffic to the Internet or clients on interfaces C and N, including block pages sent on C or N
*
IPv6 static routes
*
SNMP traps and counters for IPv6 data
*
Network diagnostic tools in the Command Line Utility and Command Line Interface
For Forcepoint Web Security, IPv6 support also includes:
*
Dual IP stack implementation on interfaces P1 and P2
*
Traffic to the Internet or clients on interfaces P1 and P2, and their bonded interface (E1/E2), if configured
Limits and restrictions:
*
IPv6-only internal networks are not supported
*
IPv4 must be used to communicate among V Series appliances and with TRITON Architecture components
In any field that accepts an IPv6 address, the address can be entered in any format that conforms with the standard. For example:
*
Leading zeros within a 16-bit value may be omitted.
*
One group of consecutive zeros may be replaced with a double colon.
About appliance management interface (C)
*
Communicates with all Forcepoint management interfaces
*
Communicates with the management server and Forcepoint DLP (if used)
*
Provides inter-appliance communication
*
Optionally provides non-HTTP(S) protocol enforcement
*
Handles Master Database downloads via the Internet (unless you optionally configure P1 for database downloads).
 
* 
Important 
Changing the C interface IP address is not recommended.
The process involves a number of activities, significantly impacts deployment, can cause significant service disruption, and may require you to reinstall of some components.
If your appliance is in production and you must change the C interface IP address, please contact Forcepoint Technical Support for assistance.
About the Content Gateway proxy interfaces (P1, P2)
Content Gateway interfaces P1 and P2 handle traffic directed to and from the Content Gateway proxy module.
*
Both the P1 and P2 can be used to accept users' Internet requests (inbound traffic) and communicate with web servers (outbound traffic). In other words, both interfaces can be configured to handle traffic into and out of the proxy.
*
Typically, P1 is used for both inbound and outbound traffic; P2 is not used.
*
Optionally, configure P1 to accept users' Internet requests (inbound only) and P2 to communicate with web servers (outbound).
*
The gateway is assigned using the command set interface ipv4. Enabling the P2 interface does not automatically move the gateway to the interface.
 
* 
Important 
If you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1. Keep this in mind when you configure Content Gateway.
For example, suppose you are using a transparent proxy deployment, and the P1 interface is connected to a WCCP router. In this case, you must configure Content Gateway to use eth0 for WCCP communications (in Content Gateway manager, see the General tab of the Configure > Networking > WCCP page).
The P1 and P2 interfaces can be in the same or different subnets.
If they are in the same subnet, P2 is the default gateway (which is bound to eth1). Ensure that outbound packets can reach the Internet.
When P1 and P2 are in different subnets, the gateway must be in the same subnet as the appliance interface used to send traffic to the Internet (typically P2). All traffic communicated between Content Gateway and origin servers should go through that interface (P2).
For traffic communicated between Content Gateway and clients, please note:
*
If the clients are in the same subnet as P1, then all traffic communicated between Content Gateway and clients should go through P1.
*
If the clients are not in the same subnet as P1, then client-to-Content Gateway traffic goes through P1, while Content Gateway-to-client traffic goes through P2, regardless of whether an explicit or transparent deployment is used.
Note, however, that you can set up static routes to send client traffic (on subnets not attached to P1) back through P1 (inbound traffic).
About the Network Agent interface (N)
Network Agent can be used to provide security for protocols other than HTTP and HTTPS. It also provides bandwidth optimization data and enhanced logging detail.
Network Agent continually monitors overall network usage, including bytes transferred over the network. The agent sends usage summaries to other TRITON Architecture components at predefined intervals.
Network Agent is typically configured to see both inbound and outbound traffic in your network. The agent distinguishes between:
*
Requests sent from internal machines to internal machines (hits to an intranet server, for example)
*
Requests sent from internal machines to external machines such as Web servers (user Internet requests, for example)
You choose whether blocking information for non-HTTP protocols is routed through interface C or interface N.
 
* 
Note 
When Decryption Port Mirroring is activated with the N interface, the Network Agent module is disabled, and a warning message will display. This affects Network-Agent-related commands.
When Decryption Port Mirroring is disabled, the N interface is returned to the Network Agent function and Network Agent will be re-enabled.
About Forcepoint Email Security interfaces (E1, E2)
Forcepoint Email Security interfaces handle bidirectional email protection traffic.
 
* 
Note 
The names of the interfaces vary depending on the model of appliance.
*
With V10000, E1 and E2 are used.
*
With X10G, V5000, and VMware virtual appliances, P1 and P2 are used.
*
Both the E1 and E2 interfaces (V10000) or P1 and P2 interfaces (other appliances) can be used to accept inbound traffic and send outbound traffic.
*
In many deployments, E1 (or P1) is used for both inbound and outbound traffic; E2 (or P2) is not used.
*
E1 (or P1) can be configured to accept inbound traffic and E2 (or P2) can be configured to send outbound traffic.
 
* 
Important 
On the V10000, if you use the E2 interface, the E1 interface is bound to eth0, and the E2 interface is bound to eth1.
On other appliances, if you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1.
Keep this in mind when you configure Forcepoint Email Security.
If you use both E1 (or P1) and E2 (or P2), and you locate them in the same subnet, then the default gateway is automatically assigned to E2 (which is bound to eth1). Ensure that outbound packets can reach the Internet.
 
* 
Note 
The E1 and E2 interfaces are also available for use on the V10K for Decryption Port Mirroring functionality.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Appliances Command Line Interface > Appliance interface configuration > Interface ports
Copyright 2020 Forcepoint. All rights reserved.