Forcepoint N60 Series Installation instructions

Next Generation
Firewall
Model N60 Series
Models N60 (APP-60C1) and N60L
(APP-60C2) Internet Security Device
Hardware Guide
Revision C

Next Generation Firewall Hardware Guide | Models N60 and N60L
Contents
■Introduction on page 2
■Find product documentation on page 2
■Model N60 features on page 3
■Model N60L features on page 5
■Indicator lights on page 7
■Ethernet port indicators on page 8
■Precautions on page 9
■Install the appliance on page 10
■Turn off the appliance on page 14
■Replace the SIM card for model N60L on page 15
Introduction
Thank you for choosing a Forcepoint appliance.
Familiarize yourself with the appliance ports and indicators and learn how to install the appliance safely.
Find product documentation
In the Forcepoint Customer Hub, you can find information about a released product, including product
documentation, technical articles, and more.
You can get additional information and support for your product in the Forcepoint Customer Hub at
https://support.forcepoint.com. There, you can access product documentation, release notes, Knowledge Base
articles, downloads, cases, and contact information.
You might need to log on to access the Forcepoint Customer Hub. If you do not yet have credentials, create a
customer account. See https://support.forcepoint.com/CreateAccount.
2

Next Generation Firewall Hardware Guide | Models N60 and N60L
Model N60 features
The figures and tables show the appliance components and features.
Front panel
This panel has the following parts.
1 2 3 4
1USB port
2Indicators for Ethernet interface port activity and link status
3Indicators for status, management (MGMT), and high availability (HA)
4Indicators for power (PWR) and disk activity (SSD)
3

Next Generation Firewall Hardware Guide | Models N60 and N60L
Back panel
This panel has the following parts.
1 2 5 63 4
1Grounding point.
2Power connector DC IN — Provides 12V DC power for the appliance.
3Fixed Ethernet ports 2 and 3 from top to bottom.
4Fixed Ethernet ports 0 and 1 from top to bottom.
If you use the appliance in an NGFW Engine cluster, use fixed Ethernet port 0 for the heartbeat
connection between the nodes.
5Console port (speed 115,200 bps) and USB port.
6Power button.
4

Next Generation Firewall Hardware Guide | Models N60 and N60L
Model N60L features
The figures and tables show the appliance components and features.
Front panel
This panel has the following parts.
1SIM card slot
2USB port
3Indicators for Ethernet interface port activity and link status
4Indicators for status, management (MGMT), and high availability (HA)
5Indicators for LTE, power (PWR), and disk activity (SSD)
5

Next Generation Firewall Hardware Guide | Models N60 and N60L
Back panel
This panel has the following parts.
1Grounding point.
2Power connector DC IN — Provides 12V DC power for the appliance.
3Fixed Ethernet ports 2 and 3 from top to bottom.
4Fixed Ethernet ports 0 and 1 from top to bottom.
If you use the appliance in an NGFW Engine cluster, use fixed Ethernet port 0 for the heartbeat
connection between the nodes.
5Console port (speed 115,200 bps) and USB port.
6Power button.
7LTE antenna connectors
6

Next Generation Firewall Hardware Guide | Models N60 and N60L
Indicator lights
Indicator lights show the status of the appliance and any fixed Ethernet ports.
1Ethernet port indicators
2Status indicators
Indicator Color Description
Unlit No link.Activity/
link status
light for
each
Ethernet
port
(Activity)
Green Link OK. Flashes on activity.
Unlit 10 Mbps link.
Amber 100 Mbps link.
Link
speed
light for
each
Ethernet
port (Link)
Green 1 Gbps link.
Unlit The initial configuration has not yet been generated.
Amber Flashes while initial contact is being established. Steady amber when initial contact
has been established, but the NGFW Engine is offline.
Alternates with green when the NGFW Engine is in the standby state.
Status
Green Flashes when initial contact is established, but a policy has not been installed. Steady
green when the NGFW Engine is online.
Unlit The NGFW Engine has made initial contact but no policy is yet installed. MGMT
Green Flashes when the NGFW Engine tries to make initial contact or when the NGFW
Engine is reconnecting to the Log Server. Steady green when initial contact with
the Management Server has been made, the management connection has been
established, and a policy has been installed.
Unlit The NGFW Engine does not have a clustering configuration. HA
Green The NGFW Engine has a clustering configuration.
7

Next Generation Firewall Hardware Guide | Models N60 and N60L
Indicator Color Description
Unlit No power source is connected to the appliance.
Green Power is supplied to the appliance.
PWR
Red The appliance is in a standby state.
SSD Green Flashes on disk activity.
Unlit There is no LTE connection.
Amber The signal strength of the LTE connection is weak.
Amber
and Green
The signal strength of the LTE connection is medium
LTE(N60L
only)
Green The signal strength of the LTE connection is good.
Ethernet port indicators
Ethernet port indicators show the status and speed of the network ports.
1 2
1 2
1Activity/link indicator
2Link speed indicator
Indicator Color Description
Green Steady when link is present. Flashes on activity.Activity/link indicator
Unlit No link.
Unlit 10 Mbps link.
Amber 100 Mbps link.
Link speed indicator
Green 1 Gbps link.
8

Next Generation Firewall Hardware Guide | Models N60 and N60L
Precautions
The precautions provide safety guidance when working with Forcepoint appliances and electrical equipment.
CAUTION
Forcepoint appliances cannot be serviced by end users. Never open the appliance covers for any
reason. Doing so can lead to serious injury and void the hardware warranty.
For additional safety information, see the Forcepoint Product Safety and Regulatory Compliance Guide.
General safety precautions
Read the safety information and follow these rules to ensure general safety whenever you are working with
electronic equipment.
■Keep the area around the appliance clean and free of clutter.
■Use a regulating uninterruptible power supply (UPS) to keep your system operating during power failures and
to protect the appliance from power surges and voltage spikes.
■If you need to turn off or unplug the appliance, always wait at least five seconds before turning on or plugging
in the appliance again.
For information about restricted substances, see Restricted substances for NGFW model N60 appliances.
Operating precautions
Follow these precautions when operating the appliance.
■Do not open the power adapter casing. Only the manufacturer's qualified technician can access and service
power adapters.
■For this specific appliance model, it is recommended to use the power supply that is shipped with the
appliance or additional spare unit from Forecepoint.
Electrical safety precautions
Follow basic electrical safety precautions to protect yourself from harm and the appliance from damage.
■Know the locations of the power on/off button and the emergency turn-off switch, disconnection switch, or
electrical outlet for the room. If an electrical accident occurs, you can quickly turn off power to the system.
■When working with high-voltage components, do not work alone.
■When working with electrical equipment that is turned on, use only one hand. This is to avoid making a
complete circuit, which causes an electric shock. Use extreme caution when using metal tools, which can
easily damage any electrical components or circuit boards the tools come into contact with.
■Do not use mats designed to decrease electrostatic discharge as protection from electric shock. Instead, use
rubber mats that have been designed as electrical insulators.
■If the power supply cable includes a grounding plug, the plug must be plugged into a grounded electrical
outlet.
9

Next Generation Firewall Hardware Guide | Models N60 and N60L
■Use only the power cable or cables supplied with the appliance.
Note
Standby power is supplied to the appliance even when the appliance is turned off.
AC power supply safety precautions
The appliance power inlet is the disconnect device on the appliance.
Install the appliance
There are several tasks that must be completed before the appliance is installed.
These tasks and the installation of the appliance might be done by the same person or by different persons:
■The Security Management Center (SMC) administrator is responsible for the tasks that are needed before the
appliance is installed.
■The on-site installer is responsible for installing the appliance.
For more information, see the Forcepoint Next Generation Firewall Installation Guide.
To prepare for the appliance installation, the SMC administrator must do the following:
1) If the SMC has not yet been installed, install the SMC.
Important
Do not install the SMC on the NGFW appliance.
The SMC can manage many NGFW appliances.
2) In the Management Client component of the SMC, create and configure the NGFW Engine element that
represents the appliance.
3) In the Management Client component of the SMC, save the initial configuration.
The SMC administrator must either:
■Upload the initial configuration to the Installation Server for plug-and-play configuration of the appliance.
Note
There are additional requirements for plug-and play configuration. See Knowledge Base
article 9662.
■Give the on-site installer a USB drive that contains an initial configuration file for each appliance.
The on-site installer must do the following:
1) Inspect the appliance, delivery box, and all components included in the shipment.
Important
Do not use damaged appliances or components.
10

Next Generation Firewall Hardware Guide | Models N60 and N60L
2) Connect all necessary power, network cables and other components, and then turn on the appliance.
If the plug-and-play configuration method is not used, the on-site installer must insert the USB drive that
contains the initial configuration files to configure the NGFW Engine software to an USB port before the
appliance is turned on.
By default, only one power supply is shipped with the appliance. However, an additional power supply can be
ordered and connected for redundancy.
Power supply monitoring is automatically enabled when the appliance is powered on using two power
adapters. When power supply monitoring is enabled and only one power supply is present, a warning is
provided in SMC engine info status pane.
3) When you have finished installing the appliance, inform the SMC administrator so that the administrator can
check the status of the appliance in the Management Client.
Insert a SIM card for model N60L
To use the LTE modem in N60L model, you must insert a separately-purchased SIM card into the appliance.
Before you begin
Before you insert or replace a SIM card, turn off the appliance.
The SIM card must be a Nano-SIM card. Full-sized SIM cards, Mini-SIM cards, and Micro-SIM cards are not
supported.
Note
To use the mobile connection for plug-and-play configuration, make sure that the PIN code query is
disabled on the SIM card. For more information, see Knowledge Base article 17249.
Steps
1) To release the SIM card tray, gently push the SIM card tray.
2) Remove the SIM card tray.
3) With the SIM card contacts facing down, insert the SMC card into the tray, then gently push the tray back into
the SIM card slot.
Attach antennas for model N60L
Before you begin
Before you attach or replace the antennas, you must turn off the appliance.
11

Next Generation Firewall Hardware Guide | Models N60 and N60L
Steps
1) Locate the antennas included in the appliance delivery.
2) Attach the wireless LAN antennas to the connectors on the back panel of the appliance.
3) Tighten the knurled nuts at the base of the antennas to secure them firmly to the appliance.
4) While holding the base of the antennas, position the antennas.
Mount the N60/N60L appliance on a wall
You can optionally mount the N60/N60L appliance on a wall.
Important
There are vents on the sides of the appliance. Keep other objects at least 100mm (4 inches) away
from the appliance to ensure good air flow. Do not stack appliances.
Mounting the appliance on a wall has the following requirements:
■You can mount the appliance in a horizontal orientation only with the connectors for the cables facing down.
■The distance between the holes that you drill for the appliance in the wall must be 120mm (4.7 inches).
■Depending on the wall material, you might need to insert nylon plugs into the mounting holes that you drill for
the appliance. No nylon plugs are supplied with the appliance.
■Two flat undercut screws are required. No screws are supplied with the appliance.
The diameter of the screw heads must be 5.5mm (7/32 inch) and the thickness of the screw heads must be
2mm (5/64 inch).
Select screws that are suitable for the wall material and long enough to provide a firm mounting point for the
appliance. If you have attached the four provided rubber feet to the bottom of the appliance, make sure that
the screws are long enough to provide a firm mounting point for the appliance with the feet attached.
Make sure that the heads of the screws fit into the mounting holes on the bottom of the appliance before you
drill the mounting holes in the wall.
Steps
1) Drill two holes 120mm (4.7 inches) apart in the wall in a horizontal orientation.
Make sure that you leave enough clearance around the appliance.
2) If required, insert nylon plugs into the holes.
3) Insert the two screws into the holes and tighten the screws.
Make sure that the screws are protruding from the wall to provide a firm mounting point for the appliance.
12

Next Generation Firewall Hardware Guide | Models N60 and N60L
4) Align the mounting holes on the appliance with the screws, then place the appliance on the screws so that
the cables are below the appliance.
After the appliance is mounted on the wall and you have connected the cables, do not pull on the cables.
CAUTION
If you need to disconnect any cables after the appliance is mounted on the wall, hold the
appliance in place while you disconnect the cables.
Connect the cables
Connect the network and power cables.
Use at least CAT5e-rated cables for gigabit networks.
Network interfaces at both ends of each cable must have identical speed and duplex settings. These settings
include the automatic negotiation setting. If one end of the cable uses autonegotiation, the other end must also
use autonegotiation. Gigabit standards require interfaces to use autonegotiation. Fixed settings are not allowed at
gigabit speeds.
Connect network cables
Ethernet ports are mapped to interface IDs during the initial configuration. Determine which Ethernet ports to use
for connecting to your networks.
Steps
1) Connect network cables to the Ethernet ports.
If you use the plug-and-play configuration method for a single NGFW appliance, the appliance uses Ethernet
port 0 to contact the Installation Server.
Web based NGFW Configuration Wizard runs on port labeled as LAN (port 2).
If the appliance is a node in an NGFW Engine cluster, connect the cable for the heartbeat connection
between the nodes to interface labeled as HA (port 3).
Connect the power adapter
Use the power cable to plug in the appliance.
Note
We recommend using a UPS to ensure continuous operation and minimize the risk of damage to the
appliance in case of sudden loss of power.
Steps
1) Attach a suitable power plug for your region to the 12V power adapter for the appliance.
Standard power plugs for several regions are included with the delivery.
13

Next Generation Firewall Hardware Guide | Models N60 and N60L
2) Connect the 12V power adapter for the appliance to the DC IN power connector on the back of the
appliance.
3) Plug the power adapter into a grounded, high-quality power strip that offers protection from electrical noise
and power surges.
Port settings for plug-and-play configuration
method
If you use the plug-and-play configuration method for a single NGFW appliance, the appliance uses Ethernet port
0 to contact the Installation Server.
Make sure that the port settings are configured correctly in the Management Client for the initial configuration.
To use the plug-and-play configuration method, the interface that corresponds to Ethernet port 0 in the initial
configuration must have a dynamic IPv4 address.
Turn off the appliance
Most Forcepoint NGFW appliance hardware components are not hot-swappable. Turn off the appliance from the
NGFW Engine command line.
Tip
The SMC administrator can also turn off the appliance remotely using the Management Client. For
more information, see the Forcepoint Next Generation Firewall Product Guide.
Steps
1) Connect to the NGFW Engine command line.
Depending on the appliance type, use one of the following options:
■Connect a computer running a terminal emulator program to the appliance console port, then press
Enter.
■Connect using SSH.
Note
SSH access is not enabled by default.
■Connect a keyboard to a USB port and a monitor to the VGA port, then press Enter.
2) Enter the logon credentials.
The user name is root and the password is the one you set for the appliance.
3) Enter the following command:
halt
14

Next Generation Firewall Hardware Guide | Models N60 and N60L
4) Wait until the power indicator light turns red or is unlit, then unplug all power cables from the appliance.
Replace the SIM card for model N60L
You might need to replace the SIM card for the LTE modem in the model N60L if you change mobile operators, or
if you get a new SIM card from the same mobile operator.
Before you begin
Before you insert or replace a SIM card, turn off the appliance.
The SIM card must be a Nano-SIM card. Full-sized SIM cards, Mini-SIM cards, and Micro-SIM cards are not
supported.
Steps
1) To release the SIM card tray, gently push the SIM card tray.
2) Remove the SIM card tray.
3) Remove the old SIM card from the tray.
4) With the SIM card contacts facing down, insert the SMC card into the tray, then gently push the tray back into
the SIM card slot.
5) Press the power button to start up the appliance.
6) If PIN code query is enabled on the new SIM card and the modem interface is used for the management
connection, change the PIN code.
Note
If the PIN code for the new SIM card is the same as the PIN code for the old SIM card, it is not
necessary to change the PIN code.
a) Log on to the appliance.
The user name is root and the password is the one you set for the appliance.
b) To start the NGFW Configuration Wizard, enter the following command:
sg-reconfigure
c) In the NGFW Configuration Wizard, enter the PIN code.
d) To restart the appliance, enter the following command:
reboot
15

Next Generation Firewall Hardware Guide | Models N60 and N60L
e) In the Management Client, enter the PIN code in the modem interface properties, then refresh the policy
on the NGFW Engine.
Note
Tasks in the Management Client are intended to be done by the SMC administrator.
16

© 2022 Forcepoint
Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint.
All other trademarks used in this document are the property of their respective owners.
Published 23 December 2022