Most engineers think…
Most people assume that if a DLP policy 'shows hits' on the network, it is also stopping the leak. That assumption gets data out the door and gets you caught in an interview.
Forcepoint Network DLP is built around the Protector — a soft appliance that only intercepts traffic — paired with a DLP server that does the actual content analysis. How you wire and run the Protector decides everything: off a SPAN/mirror or TAP it can only watch and report; inline it can block, quarantine or terminate. And email and web are not equal — email can be blocked natively in MTA mode, but web can only be monitored unless a proxy enforces the Protector's verdict over ICAP.
① Data in motion & the Protector's two faces
Data in motion is sensitive content crossing the network at egress — email, web uploads, FTP and other file transfers — inspected before it leaves the perimeter. Forcepoint catches it with the Protector, a soft appliance that intercepts traffic, paired with a DLP server that performs the deep content analysis. The channels it understands are SMTP, HTTP/S, FTP and plain text.
Passive vs inline — the call that decides everything
In monitoring (passive) mode the Protector sits off a switch SPAN/mirror port or a network TAP: one Network interface carries management and has an IP, while Monitoring interfaces have no IP and just receive mirrored traffic. It can detect and report a loss but cannot block it. In inline mode the Protector sits directly in the traffic path, so it can block, quarantine or terminate. You enable each role per module at Settings ▸ Deployment ▸ System Modules.
In an interview, separate the Protector (intercepts traffic on the wire) from the DLP server (does the deep content analysis and produces the verdict). The wiring choice — SPAN/TAP vs inline — is what decides whether it can block at all.
The Protector relies on which component for the deep content analysis?
② Email DLP the MTA way
Email is special: the Protector can monitor or block it natively. Blocking uses explicit MTA mode, where the Protector runs as a real mail relay sitting inline in the mail flow. It receives SMTP, hands message bodies and attachments to the DLP server for policy analysis, then either delivers, blocks, quarantines, or redirects for encryption based on the action plan. Clean mail is forwarded to the Next Hop MTA (Smart Host) — the downstream mail server, set by IP or hostname plus port.
The MTA tab settings to name
On the MTA tab you set the SMTP HELO name, the Next Hop MTA, the Maximum message size (default 33 MB), permitted relay networks (address + subnet), and the critical on-error behaviour: Permit traffic (fail-open — mail flows even if analysis fails) or Block traffic (fail-close). You can also add a footer and delivery-failure notices. TLS on the explicit MTA path is available via a TLS-enabled Postfix build.
A soft appliance that intercepts SMTP/HTTP-S/FTP/plain text. Passive off a SPAN/TAP it only monitors; inline it can block, quarantine or terminate.
The Protector runs as a real mail relay so it can block, quarantine or encrypt email, then forwards clean mail to the Next Hop Smart Host.
A protocol letting a proxy (the client) hand content to the Protector (the server) on port 1344 and enforce the returned block/allow verdict.
A redirection gateway the Protector routes mail to when a subject Encryption Flag or X-header is present, instead of delivering directly.
On the MTA tab, 'Permit traffic' on error is fail-open (mail keeps flowing if analysis breaks) and 'Block traffic' is fail-close. Picking the wrong one either leaks data during an outage or blocks all mail — decide it deliberately, do not leave it on a default.
In explicit MTA mode, where does the Protector forward clean mail?
③ Encryption, quarantine & the release window
Not every match should be blocked outright — sometimes the right action is to encrypt and send. On the Encryption & Bypass tab you enable a redirection (encryption) gateway by IP and port. Mail is routed there when the Subject contains an Encryption Flag or a named X-header is present — added when a user clicks Encrypt in Outlook or when policy requires it. A matching Bypass flag or X-header skips analysis entirely.
Quarantine and the 1-week release
Blocked SMTP incidents — from the Protector or the Email Security module — are held in quarantine and can be released within one week before they expire. Release happens via the Incident Details report or by replying to the notification, and is routed through the release gateway configured at Settings ▸ General ▸ Remediation. Turning on Validate user before releasing limits release to the actual recipients.
A user clicks 'Encrypt' in Outlook. How does the Protector know to route that mail to the encryption gateway?
④ Web DLP over ICAP
Here is the catch that trips people up: the Protector can only monitor web on its own — it sees a copy and reports, but it cannot stop an upload by itself. To block outbound web data you bring in a proxy and the ICAP protocol. The Protector acts as the ICAP server; a third-party (or Forcepoint Web/SWG) proxy is the ICAP client that sends content for inspection and enforces the returned block/allow verdict.
The default ICAP port is 1344. For each outbound HTTP/HTTPS request (and buffered FTP), the proxy passes the content to the Protector, the DLP server evaluates policy, and the proxy permits or blocks the upload. The ICAP config has General, HTTP and FTP tabs. The interview line: web blocking is the proxy enforcing the Protector's verdict — no proxy, no block.
Priya at a Pune fintech BPO faces this
Analysts can still upload spreadsheets of customer PAN/Aadhaar data to personal cloud drives, even though the 'block PII upload' policy shows hits in the reports.
The Protector is wired to a SPAN port (passive) and has no ICAP service bound, so it logs web incidents but cannot block them; the corporate proxy has no ICAP client configured.
In Forcepoint Security Manager, Settings ▸ Deployment ▸ System Modules shows the Protector in Monitoring mode with no ICAP service; the proxy has no ICAP client target.
Settings ▸ Deployment ▸ System Modules + proxy ICAP client configEnable the Protector's ICAP server and point the corporate proxy (ICAP client) at it on port 1344, with the PII policy set to block. Web uploads now flow proxy ▸ Protector ▸ DLP verdict ▸ block.
Re-attempt an upload of a test PAN file: the proxy denies it and an Incident Details entry shows 'blocked' via the ICAP channel.
A policy 'showing hits' is not the same as blocking. Re-test with a real sample upload and read the Incident Details report — it shows the channel (ICAP) and a 'blocked' action. If it only says detected, you are still on a SPAN port with no proxy enforcement.
▶ Watch a PII upload get blocked over ICAP
How a single web upload is inspected and stopped end-to-end. Press Play for the healthy block path, then Break it to see the classic failure.
You need to BLOCK outbound web uploads of PII. The Protector is on a SPAN port. What must you do?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why can Forcepoint block email on its own but needs help to block the web? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Data in motion
- Sensitive data crossing the network at egress — email, web and FTP — inspected before it leaves the perimeter.
- Protector
- Soft appliance that intercepts SMTP/HTTP-S/FTP/plain text for monitoring or inline enforcement, paired with a DLP server for analysis.
- SPAN/mirror port
- Switch port that copies traffic to the Protector for passive monitoring — detect and report, but no blocking.
- Network TAP
- Hardware that duplicates wire traffic so the Protector can passively inspect a copy without being inline.
- Explicit MTA mode
- The Protector runs as a real mail relay inline in the mail flow, so it can block, quarantine or encrypt email.
- Next Hop MTA / Smart Host
- The downstream mail server the Protector forwards clean email to after analysis, set by IP/hostname and port.
- Encryption (redirection) gateway
- Server the Protector routes flagged mail to when a subject Encryption Flag or X-header is present.
- Quarantine / release
- Holding a policy-breaching email pending release (within one week) via the remediation/release gateway, or expiry.
- ICAP
- Protocol on default port 1344 where the proxy (client) hands content to the Protector (server) for a block/allow verdict.
📚 Sources
- Forcepoint Help — When to use the Protector (passive vs inline, channels analysed). help.forcepoint.com/dlp
- Forcepoint Help — Set up SMTP in MTA mode / Protector SMTP service: MTA tab. help.forcepoint.com
- Forcepoint Help — Protector SMTP service: Encryption & Bypass tab. help.forcepoint.com
- Forcepoint Help — Releasing incidents (Remediation / release gateway, 1-week window). help.forcepoint.com
- Forcepoint Help — Configuring ICAP / configure the Protector for ICAP (port 1344). help.forcepoint.com
- Forcepoint — Data Loss Prevention product & Network DLP guide. forcepoint.com
What's next?
Got data in motion? Next, go deep on the classifiers behind the verdict — regex, dictionaries, EDM, IDM, machine learning and OCR — and why fingerprinting is what makes a block trustworthy.