---
title: "IP-based policy management in Trellix DLP Network Appliances"
slug: "ip-based-policy-management-in-trellix-dlp-network-appliances"
tags: ["DLPNP 11.11.x", "DLPNM 11.11.x"]
updated: 2026-11-05T14:39:56Z
published: 2026-11-05T14:39:56Z
canonical: "docs.trellix.com/ip-based-policy-management-in-trellix-dlp-network-appliances"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP-based policy management in Trellix DLP Network Appliances

Trellix DLP Network enables you to establish and enforce Web Protection policies based on individual IP addresses or IP ranges, offering an alternative to Active Directory or Lightweight Directory Access Protocol (LDAP) structures.

With IP-based policy management, DLP Administrators can configure specific policy inclusions and exceptions using IP addresses as conditions or exceptions in Web Protection rules. This facilitates tailored enforcement, such as blocking or allowing, for classified data transmitted across the web.

During event processing, Trellix DLP Network Prevent extracts IP address fields from the X-Client-IP ICAP headers supplied by the web proxy. The rule engine then checks these extracted IP addresses against defined network address parameters. For Trellix DLP Network Monitor, web protection rules are applied directly to HTTP traffic

## Configure IP-based rules in Web Protection rules

Within a Web Protection rule condition, select an IP address or range from a predefined IP list. Based on the configured rule and the source or destination IP conditions, the rule engine allows or blocks incoming and outgoing web traffic.

### Task

### Configure IP address inclusions and exceptions

Configure IP address inclusions or exceptions in Trellix DLP Network Web Protection rules to manage policy enforcement based on network location.

1. Create or identify the required network IP address list:
  1. In **Trellix ePO**, go to **DLP Policy Manager**.
  2. Go to **Definitions** → **Network Address (IP Address)**.
  3. Select **Add a new address**. Enter the desired IP addresses to create a network address list.
  4. Select **Save**.
2. Create an IP-based rule:
  1. Navigate to **DLP Policy Manager** → **Rule Sets**.
  2. Click **Actions** → **New Rule** → **Web Protection** to create a new rule.
  3. Enter the **Rule Name**, set **State** to **Enabled**, and select only **Trellix Network DLP**.
  4. Under the **Conditions** tab:
    1. Select the needed classification.
    2. For all the IP addresses that have to be included, in the **Source Network Addresses** field, select the condition (for example, Is one of). Select the pre-added network IP address list from the **Choose from existing values** dialog box.
  5. Under the **Exceptions** tab:
    1. Select **Add Rule Exception**.
    2. Set **State** to **Enabled** and select the desired classification and other values..
    3. For all the IP addresses that have to be excluded, in the **Source Network Addresses** field, set the condition (for example, Is one of). Select the pre-added network IP address list from the **Choose from existing values** dialog box.
  6. Under the **Reactions** tab, select the **Action** and select the desired check boxes in **Report Incident**.
  7. Select **Save**.

1. Apply policy changes:
  1. Go to **Menu** → **Systems** → **System Tree**.
  2. Select the checkbox of one or more appliances that you want to assign the policy to.
  3. Click **Wake Up Agents** to push the policy to Trellix DLP endpoints immediately. The **Wake Up Trellix Agent** window opens.
  4. Next to **Wake-up call** type, select whether to send an **Agent Wake-Up Call** or a **SuperAgent Wake-Up Call**.
  5. Accept the default Randomization (0–60 minutes) or type a different value. If you type 0, agents respond immediately.
  6. Click **OK** to send the wake-up call to the endpoints.

Or, you can use the **Break inheritance and assign the policy and settings below** option to push the policy.

For information, see [Assign and push a policy to a system](https://docs.trellix.com/data-and-email/docs/assign-and-push-a-policy-to-a-system-2).