Currently one of our customers must fulfill their auditors need to have multi-layer security devices in their environment, including Secure Email Gateway (SEG). Their current environment is using Cisco IronPort and after some discussion they planned to purchase Proofpoint as their second SEG.

Their plan is to put Proofpoint in front of their IronPort. Now will it be a problem for IronPort since Proofpoint will forward the emails to IronPort because Proofpoint IP is internal and internal IPs are always trusted? We have the same problem when we put Proofpoint behind IronPort but we configured Proofpoint to examine one IP hop (skipping IronPort) to look at the senders Public IP. Is there any similar configuration on IronPort?


1 Answer 1


If you place another gateway device between your Ironport and the Internet, then your only option is to disable SenderBase and any other IP-based authorisation in your Incoming Policy definitions in the HAT. You cannot tell the Ironport to obtain the previous-hop IP address from any other method than the incoing TCP connection itself (for obvious reasons - otherwise it would be far too easy to forge).

One option would be to reverse the order of the devices -- IE, put the Ironport between the Internet and the Proofpoint box, and set the Ironport to have a fixed SMTP route to send all incoming email via the ProofPoint. Otherwise, you lose out on the Ironport's Senderbase rules, which are (IMHO) one of the primary benefits of the Ironport.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.