Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently one of our customers must fulfill their auditors need to have multi-layer security devices in their environment, including Secure Email Gateway (SEG). Their current environment is using Cisco IronPort and after some discussion they planned to purchase Proofpoint as their second SEG.

Their plan is to put Proofpoint in front of their IronPort. Now will it be a problem for IronPort since Proofpoint will forward the emails to IronPort because Proofpoint IP is internal and internal IPs are always trusted? We have the same problem when we put Proofpoint behind IronPort but we configured Proofpoint to examine one IP hop (skipping IronPort) to look at the senders Public IP. Is there any similar configuration on IronPort?


share|improve this question

If you place another gateway device between your Ironport and the Internet, then your only option is to disable SenderBase and any other IP-based authorisation in your Incoming Policy definitions in the HAT. You cannot tell the Ironport to obtain the previous-hop IP address from any other method than the incoing TCP connection itself (for obvious reasons - otherwise it would be far too easy to forge).

One option would be to reverse the order of the devices -- IE, put the Ironport between the Internet and the Proofpoint box, and set the Ironport to have a fixed SMTP route to send all incoming email via the ProofPoint. Otherwise, you lose out on the Ironport's Senderbase rules, which are (IMHO) one of the primary benefits of the Ironport.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.