Holds the external, real-world, internet-facing IP address the remote-access VPN client is connecting from. This is what an admin checks when a raInternalIpAddr-mapped user's session looks suspicious; the real external address reveals whether the client is coming from an expected location or ISP or an unexpected one, useful for spotting credential misuse from an unusual geography. Example: raExternalIpAddr showing an address that geolocates to a country the employee has never traveled to, alongside a currently active session, is a concrete trigger for a security review of that session.