True source IP detection

Administrator Help | Forcepoint Email Security | Version 8.5.x

True Source IP detection uses message header information and the number of network hops to an email appliance to determine the IP address of the first sender outside the network perimeter. This feature allows Connection Control techniques (such as reverse DNS lookup and reputation checks) to be applied effectively to sender information, even when the appliance is downstream from a firewall or an internal mail relay.

Define direct relays and network edge locations to determine whether True Source IP detection is performed. A direct relay is the network device that connects directly to the email appliance. All mail from a direct relay device is subject to True Source IP Detection. A network edge is the network device that connects directly to the Internet (e.g., a firewall).

If your subscription includes Forcepoint Email Security Hybrid Module, you can use True Source IP detection with email hybrid service analysis. An Email Hybrid Service IP Group is created based on information entered during a successful email Hybrid Module registration. The IP group appears in the direct relay IP address list on the page Settings > Inbound/Outbound > True Source IP. Although this IP group cannot be edited directly, its content is modified whenever you change an email hybrid service IP address (Settings > Hybrid Service > Hybrid Configuration).


	Note If registration is not successful, the Email Hybrid Service IP Group is empty.

Mark the check box Use True Source IP Detection with email hybrid service analysis to enable True Source IP detection with hybrid service and display the Email Hybrid Service IP Group in the direct relay IP address list. The Email Hybrid Service IP Group does not appear if the check box is not marked.

Configure your direct relay and all network edge devices on the page Settings > Inbound/Outbound > True Source IP as follows:

Click Add.

The Add Direct Relay IP Address/IP Group page displays.

Enter the IP address for the direct relay device to the email appliance, or specify the existing IP group to use for your direct relay.

By default, the direct relay hop number is 1, because it is the closest network device to the email appliance.


	Important The IP address or group that you enter here must not already be defined in the Trusted IP Addresses group (Settings > Inbound/Outbound > IP Groups) or appear in the connection control Allow Access List (Settings > Inbound/Outbound > Connection Control).

In the field Check for header, enter header text to match for true source IP detection.

If this field is empty, the message Received field is analyzed for the true source IP.

Add the network edge device IP address and hop number to the email appliance; click Add Network Edge.

Click OK.

The settings are saved.