How to configure IP whitelisting in MSME 8.5 for the IP Reputation Agent using the registry

Technical Articles ID: KB82216
Last Modified: 9/18/2014

Environment

McAfee Security for Microsoft Exchange 8.5
Microsoft Windows 2012, 2008 x64-bit, 2003 x64-bit
Microsoft Exchange 2013
Microsoft Exchange 2010 SP2, 2007 SP3 Hub/Edge/ Hub & MB

For product supported environments, see KB82890.

Summary

McAfee Security for Microsoft Exchange (MSME) 8.5 has an IP Reputation feature that allows mail from untrusted IP addresses to be blocked.

This article describes how to use the registry to whitelist IP addresses that have been inadvertently detected and blocked by the MSME IP Reputation Agent, when they should be trusted IP addresses.

Solution

Follow these steps to enable IP whitelisting:

IMPORTANT:

The IP addresses you add will not be checked for reputation.
Before you whitelist an IP address, verify the reputation score of the IP address at: http://www.trustedsource.org/.
McAfee cannot be held liable for any mailboxes that are infected due to whitelisted IP addresses.

Prerequisites:

The MSME 8.5 Anti-spam module must be installed on the Exchange server.
McAfeeTXAgent and McAfeeTXIPAgent must be registered under Exchange Transport Agents. You can verify this by running the Get-TransportAgent cmdlet in the Exchange powershell. For details on how to do this, see KB73997.

Click Start, Run, type regedit and then click OK.
Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee\MSME\SystemState
Under SystemState, create a string value named IPWhiteList.
Double-click IPWhiteList and add the trusted IP addresses, separated by a semicolon (;).
NOTE: Use the following information to guide you when adding IP addresses:

Care should be taken when adding IP addresses to ensure that the correct addresses are whitelisted. You can whitelist individual IP addresses, or you can whitelist a range of addresses using the asterisk. The following are some examples of how you can specify IP addresses to whitelist, as well as some examples that are not supported:

Supported examples:
NOTE: MSME accepts only asterisks(*) as the wildcard character.
- 172.16.221.* - MSME will not calculate the IP reputation if the mail originates from IP addresses 172.16.221.xxx.
- 10.* - MSME will not calculate the score for mails originating from 10.xxx.xxx.xxx.
- 192.168.10.1;172.16.228.* - MSME will not calculate the score for mails from 192.168.10.1 and 172.16.228.xxx IP addresses.
Unsupported examples:
NOTE: In cases where the Exchange IP filtering agent is also installed and configured, you can still whitelist IPs under MSME as explained in the procedure above.
- 172.16.*.10 / 172.16.*2.* / - There should not be any digits after the asterisk.
- 172.16.221.1-172.16.221.255 - A range value is not supported.

Related Information

NOTE: IP address whitelisting only overrides the IP reputation threshold settings. MSME will continue to scan email for corrupt or encrypted content and banned file types, as well as performing content scanning, URL reputation, and anti-malware scanning. If there is a detection, the relevant action will be taken according to the product configuration.

Affected Products

Configuration
Security for Microsoft Exchange 8.5

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to configure IP whitelisting in MSME 8.5 for the IP Reputation Agent using the registry

Environment

Summary

Solution

Related Information

Affected Products

Glossary of Technical Terms

Title

Title

Knowledge Center

How to configure IP whitelisting in MSME 8.5 for the IP Reputation Agent using the registry

Environment

Summary

Solution

Related Information

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title