Multi-layer inspection combines access control, application identification, deep inspection, and file filtering flexibly to optimize security and system performance.

Access control includes packet filtering, connection tracking, URL categories, network application detection, user identification, authentication, and endpoint context information. Forcepoint NGFW in the Firewall/VPN role uses state tables to track connections and check whether a packet is a part of an established connection. Forcepoint NGFW in the Firewall/VPN role can also act as a packet filter for types of connections that do not require stateful access control. By default, all Firewall Access rules implement stateful access control.

Deep inspection checks the actual data being transferred. Deep inspection detects harmful patterns in network traffic. Traffic normalization is used to prevent advanced evasion methods, which are intended to allow harmful traffic to bypass network security devices.

File filtering includes file reputation, anti-malware, and sandbox scans.

Forcepoint NGFW in the Firewall/VPN role can apply application level inspection with or without proxying the connections. Protocol Agents provide protocol validation for specific protocols. Protocol Agents are also used to handle protocols that generate complex connection patterns, to redirect traffic to proxy services, and to change data payload if necessary.

Advanced traffic inspection

Multi-Link provides redundant ISP connections for SD-WAN.

Multi-Link allows you to configure redundant ISP connections using standard network connections, without the need for redundant external routers and switches. You can use any IP-based connection with a dedicated IP address range as part of a Multi-Link configuration. You can also define standby links that are used only when primary links fail.

Traffic is dynamically balanced across the different links based on a performance measurement or based on the links’ relative bandwidths. New connections automatically start to use other links when the Firewall detects that one of the links fails. The Firewall uses NAT to direct the traffic through the different links to make the source IP address valid for the link used.

Standby NetLinks act as backup Internet connections that are only activated if all primary NetLinks fail. Using standby NetLinks provides High Availability of Internet connectivity, but is less expensive than having multiple NetLinks active at the same time. Using Multi-Link for load balancing can also help reduce costs. Traffic can be balanced between two or more slower, less expensive, Internet connections instead of one faster connection. Most often, multiple network links are used to guarantee continuity of Internet access, but you can also use Multi-Link to provide redundant links for internal networks.

Multi-Link technology provides highly available network connections for the following scenarios:

• Outbound connections — Multi-Link routing makes sure that outbound traffic always uses the optimal link toward its destination and allow you to configure standby links as backups. The traffic can be distributed across the links in several different ways.
• Inbound connections — The built-in inbound traffic management feature can use Multi-Link to guarantee continuity of the services that your company offers to external users.
• VPN connections — The Multi-Link tunnel selection for VPN traffic is done independently from other types of traffic. Standby links can also be selected independently for a VPN. Connections that use Multi-Link VPN tunnels are transparently moved to other NetLinks even if the NetLink that they are using fails.

Built-in inbound traffic management