Cisco Cisco Email Security Appliance C160 Mode D'Emploi

As a general rule, when specifying an IP address (of the machine connecting to 
the IronPort appliance — the incoming relay), be as specific as possible. That 
said, IP addresses can also be entered using standard CIDR format or an IP 
address range. For example, if you have several MTAs at the edge of your network 
receiving email, you might want to enter a range of IP addresses to include all of 
your MTAs, such as 10.2.3.1/8 or 10.2.3.1-10.

Use this method to specify a custom header. This is the recommended method. 
The machine connecting to the original sender needs to add this custom header. 
The value of the header is expected to be the IP address of the external sending 
machine. For example:

SenderIP: 7.8.9.1

X-CustomHeader: 7.8.9.1

When entering a header, you do not need to enter the trailing colon.

If your local MX/MTA can receive mail from a variable number of hops, inserting 
a custom header is the only way to enable the Incoming Relays feature. For 
example, in 

 both path C and D lead to IP address 10.2.3.5; however, 

path C has two hops and path D has one. Because the number of hops can vary in 
this situation, you must use a custom header in order to have Incoming Relays 
configured correctly.