True source IP detection

Managing Messages > True source IP detection

Email Security Manager Help | Email Security Solutions | Version 7.8.x

True Source IP detection uses message header information and the number of network hops to Email Security Gateway to determine the IP address of the first sender outside the network perimeter. This feature allows Connection Control techniques (such as real-time blacklists and reputation checks) to be applied effectively to sender information, even when Email Security Gateway is downstream from a firewall or an internal mail relay.

You define direct relays and network edge locations to determine whether Email Security Gateway performs True Source IP detection. A direct relay is the network device that connects directly to Email Security Gateway. All mail from a direct relay device is subject to True Source IP Detection. A network edge is the network device that connects directly to the Internet (e.g., a firewall).

If your subscription includes the email hybrid service, you can use True Source IP detection with hybrid service analysis. A Hybrid Service IP Group is created based on information entered during a successful hybrid service registration. The IP group appears in the direct relay IP address list on the Settings > Inbound/Outbound > True Source IP page. Although this IP group cannot be edited directly, its content is modified whenever you change a hybrid service IP address (Settings > Hybrid Service > Hybrid Configuration).


	Note If hybrid service registration is not successful, the Hybrid Service IP Group is empty.

Mark the Use True Source IP Detection with email hybrid service analysis check box to enable True Source IP detection with hybrid service and display the Hybrid Service IP Group in the direct relay IP address list. The Hybrid Service IP Group does not appear if the check box is not marked.

Configure your Email Security direct relay and all network edge devices in the Settings > Inbound/Outbound > True Source IP page as follows:

1.	Click Add to open the Add Direct Relay IP Address/IP Group page.

2.	Enter the IP address for the direct relay device to Email Security Gateway, or specify the IP group you would like to use for your direct relay.

By default, the direct relay hop number is 1, because it is the closest network device to Email Security Gateway.


	Important The IP address or group that you enter here must not already be defined in the Trusted IP Addresses group (Settings > Inbound/Outbound > IP Groups) or appear in the connection control Allow Access List (Settings > Inbound/Outbound > Connection Control).

3.	Enter header text you want to match for true source IP detection in the Check header entry field.

If this field is empty, the message Received field is analyzed for the true source IP.

4.	Click Add Network Edge to add the network edge device IP address and hop number to Email Security.

Managing Messages > True source IP detection

Support

Search

Article Rating:

Quick Links

Service Requests

How are we doing?