Introduction

Forcepoint GRE Guide | Forcepoint Web Security Cloud and Hybrid Solutions

Forcepoint GRE connectivity can be used to forward traffic from your network's edge devices to the Forcepoint cloud service over a GRE tunnel. This guide introduces the basics of Forcepoint's GRE solution, and provides information on planning and deploying GRE in your network.

Introduction to the Forcepoint GRE solution

Generic Routing Encapsulation (GRE) is a tunneling protocol used to encapsulate and route data via a virtual point-to-point connection. Forcepoint GRE supports manual end user authentication and transparent identification via NTLM. Transparent authentication allows users to browse the Internet without explicitly providing logon credentials.

Typical uses for the GRE service include providing Forcepoint Web Security Cloud/Hybrid protection for:

Remote offices

Guest Wi-Fi networks

Organizations that do not want a Group Policy Object (GPO) or browser configuration

Organizations that are unable to or do not want to install an endpoint on client machines

Organizations with a "bring your own device" policy.

Benefits

Using GRE to forward traffic to the cloud service can provide a number of benefits. These include:

Easy to configure

Connection to two Forcepoint points of presence for redundancy

No need to install endpoint software on client machines or deploy browser configuration PAC files through Group Policy Objects - ideal for BYOD or guest networks.

Your network's internal IP addresses are available to the cloud service, so:

Policies can be created based on internal IP addresses or address ranges

Authentication bypass can be set based on IP addresses or address ranges

Reports can be created using internal IP addresses to identify individual users.

Capacity planning

Forcepoint GRE supports up to 5Gbps throughput per tunnel and 1,000,000 concurrent connections.

By default, tunnels are configured for 200Mbps throughput. Customers requiring more than the default can submit a request to Forcepoint Technical Support.

Supported devices

Most devices that support GRE tunneling, and that are able to forward port 80 and port 443 traffic to the tunnel, can be used with the service. Forcepoint recommends using the latest firmware for your device.

Redundancy and failover

By default, two Forcepoint points of presence are provided for GRE connectivity. Forcepoint strongly recommends configuring your device to fail over to a second point of presence (data center or local PoP) cluster to achieve geographic redundancy.


	Note Connection redundancy is a requirement for the Forcepoint Web Security Cloud SLA. Redundancy can be achieved by configuring connections to both point of presence addresses provided and configuring your device to fail over in the event of network disruption.

Point of Presence locations

Point of Presence (data center or local PoP) IP addresses for Forcepoint's GRE service are listed in the article IP addresses for GRE connectivity in the Forcepoint Knowledge Base.

To decide which points of presence are best for your environment, consider:

Which points of presence are nearest

Any geographical or data sovereignty concerns around where users browse or where their reporting data is stored.


	Note Cross-point of presence failover can change an end user's browsing experience. For example, some sites may change localization or presentation between a UK PoP and a German PoP (for example, www.google.co.uk might automatically redirect to www.google.de or www.google.nl, depending on which points of presence users' traffic is directed though). Bear in mind that point of presence failover should be an exceptional occurrence, so this behavior might be acceptable in emergency circumstances.

Use the Cloud Service Status option provided in the banner of the Cloud Security Gateway Portal for tunnel system status. You must first subscribe to the physical data center connected to the Points of Presence configured on the Web > Device Management page of the portal.