Fortinet 4.0 Patch 2 FortiMail Secure Messaging Platform Administration Guide
Anúncio
Anúncio
FortiMail™ Secure
Messaging Platform
Version 4.0 Patch 2
Administration Guide
FortiMail™ Secure Messaging Platform Administration Guide
Version 4.0 Patch 2
Revision 6
11 March2010
© Copyright 2010 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Regulatory compliance
FCC Class A Part 15 CSA/CUS
Caution: Risk of explosion if battery is replaced by incorrect type.
Dispose of used batteries according to instructions.
Contents
Contents
Introduction ............................................................................................ 11
What’s new ............................................................................................. 17
Key concepts & workflow...................................................................... 19
Disclaimer messages & customized appearance ..................................................... 21
Special characters with regular expressions & wild cards ........................................ 31
About the web-based manager............................................................. 35
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
3
4
Contents
Basic mode ............................................................................................. 41
Advanced mode ..................................................................................... 49
Monitor .................................................................................................... 51
Viewing the pending & individual automatic greylist entries ..................................... 73
Viewing the consolidated automatic greylist exemptions.......................................... 75
Maintenance ........................................................................................... 97
Backing up your configuration using a FortiManager unit....................................... 100
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Contents
Configuring FortiGuard updates & FortiGuard Antispam queries ......................... 110
System .................................................................................................. 121
Configuring administrator accounts & access profiles .......................................... 144
About administrator account permissions & domains............................................. 144
Configuring RAID on FortiMail-2000A/B or FortiMail-4000A models...................... 154
Example: Active-passive HA group in gateway mode ............................................ 182
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
5
6
Contents
Mail Settings ......................................................................................... 199
Configuring the host name, port numbers, relay, mail queue, & DSN .................... 199
Customizing replacement messages & quarantine report contents ....................... 206
User ....................................................................................................... 241
Policy..................................................................................................... 259
Which policy/profile is applied when an email has multiple recipients?.................. 261
Profile .................................................................................................... 285
Configuring antispam profiles and antispam action profiles ................................. 297
Viewing information about the FortiGuard Antivirus signatures database .............. 317
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Contents
Configuring content profiles and content action profiles....................................... 318
How to enable & configure authentication of email users....................................... 332
Preparing your LDAP schema for FortiMail LDAP profiles ..................................... 347
AntiSpam .............................................................................................. 379
Configuring email quarantines & quarantine reports.............................................. 379
Configuring the system quarantine administrator account & disk quota................. 387
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
7
8
Contents
Backing up, batch training, & monitoring the Bayesian databases......................... 424
Email Archiving .................................................................................... 431
Log & Report ........................................................................................ 437
Configuring logging to a Syslog server or FortiAnalyzer unit.................................. 441
Configuring incoming or outgoing directionality of a report profile.......................... 446
Installing firmware ............................................................................... 451
Fine tuning............................................................................................ 463
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Contents
Troubleshooting................................................................................... 469
Setup for email users........................................................................... 479
Accessing mailboxes through POP3 or IMAPv4 (server mode) ............................. 484
Sending email from an email client (gateway and transparent mode)................... 484
Appendix A: Supported RFCs............................................................. 485
Appendix B: Maximum Values Matrix ................................................ 487
Appendix C: Port Numbers ................................................................. 491
Index...................................................................................................... 495
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
9
Contents
10
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Introduction Registering your Fortinet product
Introduction
Welcome and thank you for selecting Fortinet products for your network protection.
FortiMail™ Secure Messaging Platforms (FortiMail units) are an integrated hardware and software solution that provides powerful and flexible logging and reporting, antispam, antivirus, and email archiving capabilities to incoming and outgoing email traffic. FortiMail units have reliable and high performance features for detecting and blocking spam messages and malicious attachments. Built on Fortinet’s FortiOS™, FortiMail antivirus technology extends full content inspection capabilities to detect the most advanced email threats.
This topic includes:
•
Registering your Fortinet product
•
Customer service & technical support
•
•
•
•
Registering your Fortinet product
Before you begin, take a moment to register your Fortinet product at the Fortinet Technical
Support web site, https://support.fortinet.com
.
Many Fortinet customer services, such as firmware updates, technical support, and
FortiGuard Antivirus and other FortiGuard services, require product registration.
For more information, see the Fortinet Knowledge Base article Registration Frequently
Asked Questions .
Customer service & technical support
Fortinet Technical Support provides services designed to make sure that you can install your Fortinet products quickly, configure them easily, and operate them reliably in your network.
To learn about the technical support services that Fortinet provides, visit the Fortinet
Technical Support web site at https://support.fortinet.com
.
You can dramatically improve the time that it takes to resolve your technical support ticket by providing your configuration file, a network diagram, and other specific information. For a list of required information, see the Fortinet Knowledge Base article Technical Support
Requirements .
Training
Fortinet Training Services provides classes that orient you quickly to your new equipment, and certifications to verify your knowledge level. Fortinet provides a variety of training programs to serve the needs of our customers and partners world-wide.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
11
Documentation Introduction
12
Documentation
The Fortinet Technical Documentation web site, http://docs.fortinet.com
, provides the most up-to-date versions of Fortinet publications, as well as additional technical documentation such as technical notes.
In addition to the Fortinet Technical Documentation web site, you can find Fortinet technical documentation on the Fortinet Tools and Documentation CD, and on the Fortinet
Knowledge Base.
Fortinet Tools & Documentation CD
Many Fortinet publications are available on the Fortinet Tools and Documentation CD shipped with your Fortinet product. The documents on this CD are current at shipping time. For current versions of Fortinet documentation, visit the Fortinet Technical
Documentation web site, http://docs.fortinet.com
.
Fortinet Knowledge Base
The Fortinet Knowledge Base provides additional Fortinet technical documentation, such as troubleshooting and how-to-articles, examples, FAQs, technical notes, a glossary, and more. Visit the Fortinet Knowledge Base at http://kb.fortinet.com
.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document to [email protected]
.
Scope
To learn about the training services that Fortinet provides, visit the Fortinet Training
Services web site at http://campus.training.fortinet.com
, or email them at [email protected]
.
This document describes how to use the web-based manager of the FortiMail unit. It assumes you have already successfully installed the FortiMail unit by following the instructions in the FortiMail Installation Guide .
At this stage:
• You have administrative access to the web-based manager and/or CLI.
• The FortiMail unit is integrated into your network.
• The operation mode has been configured.
• The Quick Start Wizard has been completed. The system time, DNS settings, administrator password, and network interfaces have been configured.
• Firmware, FortiGuard Antivirus, and FortiGuard Antispam updates have been completed.
• DNS records for your mail domains have been updated.
• For transparent mode or gateway mode, you have verified that the network routes all email through the FortiMail unit.
• For server mode, you have verified that the network allows the FortiMail unit access to and from other email servers and MTAs, typically including those on the Internet, and from email users with IMAP, POP3 or webmail access.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Introduction Conventions
Once that basic installation is complete, you can use this document. This document explains how to use the web-based manager to:
• maintain the FortiMail unit, including backups
• reconfigure basic items that were configured during installation
• configure advanced features, such as customized antispam scans, email archiving, logging, and reporting
This document does not cover commands for the command line interface (CLI). For information on the CLI, see the FortiMail CLI Reference .
This document is intended for administrators, not end users. If you are an email user, please click the Help link in FortiMail webmail to see the webmail online help instead, or contact your administrator.
Conventions
Fortinet technical documentation uses the conventions described below.
IP addresses
To avoid publication of public IP addresses that belong to Fortinet or any other organization, the IP addresses used in Fortinet technical documentation are fictional and follow the documentation guidelines specific to Fortinet. The addresses used are from the private IP address ranges defined in RFC 1918: Address Allocation for Private Internets, available at http://ietf.org/rfc/rfc1918.txt?number-1918 .
Cautions, Notes, & Tips
Fortinet technical documentation uses the following guidance and styles for cautions, notes and tips.
Caution: Warns you about commands or procedures that could have unexpected or undesirable results including loss of data or damage to equipment.
Note: Presents useful information, usually focused on an alternative, optional method, such as a shortcut, to perform a step.
Tip: Highlights useful additional information, often tailored to your workplace activity.
Typographical conventions
Fortinet documentation uses the following typographical conventions:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
13
Conventions Introduction
Table 1: Typographical conventions in Fortinet technical documentation
Convention
Button, menu, text box, field, or check box label
CLI input
Example
From Minimum log level, select Notification.
CLI output
Emphasis
File content
Hyperlink
Keyboard entry
Navigation
Publication config system dns set primary <address_ipv4> end
FGT-602803030703 # get system settings comments : (null) opmode : nat
HTTP connections are not secure and can be intercepted by a third party.
<HTML><HEAD><TITLE>Firewall
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this service.</H4>
Visit the Fortinet Technical Support web site, https://support.fortinet.com
.
Type a name for the remote VPN peer or client, such as
Central_Office_1.
Go to VPN > IPSEC > Auto Key (IKE).
For details, see the FortiGate Administration Guide .
Command syntax conventions
The command line interface (CLI) requires that you use valid syntax, and conform to expected input constraints. It will reject invalid commands.
Brackets, braces, and pipes are used to denote valid permutations of the syntax.
Constraint notations, such as <address_ipv4>, indicate which data types or string patterns are acceptable value input.
Table 2: Command syntax notation
Convention
Square brackets [ ]
Description
A non-required word or series of words. For example:
[verbose {1 | 2 | 3}] indicates that you may either omit or type both the verbose word and its accompanying option, such as: verbose 3
14
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Introduction Conventions
Table 2: Command syntax notation
Angle brackets < >
Curly braces { }
A word constrained by data type.
To define acceptable input, the angled brackets contain a descriptive name followed by an underscore ( _ ) and suffix that indicates the valid data type. For example:
<retries_int> indicates that you should enter a number of retries, such as 5.
Data types include:
• <xxx_name>: A name referring to another part of the configuration, such as policy_A.
• <xxx_index>: An index number referring to another part of the configuration, such as 0 for the first static route.
• <xxx_pattern>: A regular expression or word with wild cards that matches possible variations, such as *@example.com to match all email addresses ending in @example.com.
• <xxx_fqdn>: A fully qualified domain name (FQDN), such as mail.example.com.
• <xxx_email>: An email address, such as [email protected].
• <xxx_url>: A uniform resource locator (URL) and its associated protocol and host name prefix, which together form a uniform resource identifier (URI), such as http://www.fortinet.com/.
• <xxx_ipv4>: An IPv4 address, such as 192.168.1.99.
• <xxx_v4mask>: A dotted decimal IPv4 netmask, such as
255.255.255.0.
• <xxx_ipv4mask>: A dotted decimal IPv4 address and netmask separated by a space, such as
192.168.1.99 255.255.255.0.
• <xxx_ipv4/mask>: A dotted decimal IPv4 address and CIDRnotation netmask separated by a slash, such as such as
192.168.1.99/24.
• <xxx_ipv6>: A colon( : )-delimited hexadecimal IPv6 address, such as 3f2e:6a8b:78a3:0d82:1725:6a2f:0370:6234.
• <xxx_v6mask>: An IPv6 netmask, such as /96.
• <xxx_ipv6mask>: An IPv6 address and netmask separated by a space.
• <xxx_str>: A string of characters that is not another data type, such as P@ssw0rd. Strings containing spaces or special characters must be surrounded in quotes or use escape sequences. See the FortiMail CLI Reference .
• <xxx_int>: An integer number that is not another data type, such as 15 for the number of minutes.
A word or series of words that is constrained to a set of options delimited by either vertical bars or spaces.
You must enter at least one of the options, unless the set of options is surrounded by square brackets [ ].
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
15
Conventions Introduction
Table 2: Command syntax notation
Options delimited
by vertical bars |
Options delimited by spaces
Mutually exclusive options. For example:
{enable | disable} indicates that you must enter either enable or disable, but must not enter both.
Non-mutually exclusive options. For example:
{http https ping snmp ssh telnet} indicates that you may enter all or a subset of those options, in any order, in a space-delimited list, such as: ping https ssh
Note: To change the options, you must re-type the entire list. For example, to add snmp to the previous example, you would type: ping https snmp ssh
If the option adds to or subtracts from the existing list of options, instead of replacing it, or if the list is comma-delimited, the exception will be noted.
16
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
What’s new
What’s new
This chapter lists and describes some of the new features and changes since the previous version, FortiMail v4.0 patch 1. For upgrade information, see the Release Notes available with the firmware, and
“Installing firmware” on page 451 .
• Convert HTML email to plain text – HTML email can contain phishing hyperlinks, corrupted images, and scripts. You can now strip HTML tags from parts of email that use Content-Type: text/html in order to neutralize these types of attacks.
Alternatively, you can apply any other content action profile action when HTML tags are detected. For details, see
“Configuring content profiles” on page 318 .
• Per-domain maximum message size – You can now enforce a separate maximum message size for each protected domain. Previously, maximum message size could only be enforced through a session profile. For details, see
“Configuring protected domains” on page 211
.
• BCC in action profiles – You can now blind carbon copy (BCC) an email as the action to perform when an email matches an antispam or content profile. For details, see
“Configuring content action profiles” on page 326 and
“Configuring antispam action profiles” on page 312
.
• Deliver to an alternate mail host in action profiles – You can now deliver the email to a mail host other than the one indicated by MX lookup or your mail relay configuration when an email matches an antispam or content profile. For details, see
“Configuring content action profiles” on page 326 and
“Configuring antispam action profiles” on page 312
.
• Action on email lacking attachments – You can now apply a content action profile
.
• Configurable RADIUS attribute to endpoint IP address mapping – You can now specify the RADIUS attribute (other than the default attribute 8) for the endpoint IP address to map. This is a CLI only feature. For more information, see the FortiMail CLI
Reference.
• Support for multiple NTP servers – You can now add a maximum of 10 NTP servers
.
• Introduction of slow mail queue – Now there are two type of mail queues: normal mail queue and slow mail queue. Email messages will be move from the normal mail queue to the slow mail queue after three failed delivery attempts, so as to improve the
normal queue performance. For details, see “Managing the deferred mail queue” on page 60 .
• Configurable action for FortiGuard black IP scan – You can now specify an antispam action profile for the spam detected by the FortiGuard black IP scan. For
details, see “Configuring antispam profiles” on page 297 .
• Separate realtime mail statistics for incoming and outgoing email – You can now view the statistics for either the incoming email, or outgoing email, or both. For details, see
“Viewing the email statistics” on page 58 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
17
What’s new
• Support for a total of three remote Syslog servers – Only two were supported before. For details, see
“Configuring logging to a Syslog server or FortiAnalyzer unit” on page 441 .
• Access to email quarantines from log viewer – You can now access the email
.
• Recipient verification with SMTP server using VRFY command – RCPT command was used before. You can now use either the VRFY command or RCPT command. For
details, see “Configuring protected domains” on page 211 .
• Separate action for encrypted email – You can now specify a separate action taken
.
18
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow Management methods
Key concepts & workflow
This section describes the tools that you can use to configure your FortiMail unit, and describes how the features of FortiMail units work together.
This topic includes:
•
•
•
•
How FortiMail units process email
•
Management methods
After you install the FortiMail unit, you can configure and manage it with either of:
• the web-based manager (see
“About the web-based manager” on page 35 )
• and/or the command line interface (CLI)
Note: The CLI is only available to administrator accounts whose Domain is System. It is
not available to domain (tiered) administrator accounts. For more information on domain administrators, see
“About administrator account permissions & domains” on page 144
.
Depending on the FortiMail unit’s model number, you may also be able to reset the configuration and to configure basic settings such as operation mode and IP addresses using the buttons and LCD on the front panel. For details, see
“Configuring the idle timeout & LCD panel options” on page 135 .
The web-based manager has two management modes:
• Basic mode: Provides easy navigation using a simplified set of menu options that allow for many, but not all, typical FortiMail unit configurations. Less frequently used options are hidden, and some configurations are simplified by providing you with predefined configuration sets.
Note: Basic mode is only available to administrator accounts whose Domain is System. It is
not available to domain (tiered) administrator accounts. For more information on domain administrators, see
“About administrator account permissions & domains” on page 144
.
• Advanced mode: Provides the full set of menu options which allows you to achieve more complex configurations.
You can switch between the two modes. For more information, see
“About the web-based manager” on page 35
.
If you have completed physical installation and initial configuration of your FortiMail unit, you have already connected to one of these management methods. For information about installing your FortiMail unit and connecting to the web-based manager and/or the CLI, see the FortiMail Installation Guide or the FortiMail QuickStart Guide .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
19
Configuration workflow Key concepts & workflow
20
Note: This Administration Guide describes the web-based manager. For equivalent documentation of the CLI, see the FortiMail CLI Reference .
Configuration workflow
The web-based manager presents a large number of configuration options. Some options require prior configuration of other options, or will not function correctly or cannot be tested until other required components are functional.
Depending on the operation mode you use, the general configuration workflow may vary.
In general, you may find it helpful to use the following order:
1 Complete the physical installation and initial configuration of your FortiMail unit according to the FortiMail Install Guide .
2 Adjust antispam profiles that will be used in antispam policies. For details, see
3 Adjust and/or configure additional policies. For details, see “Policy” on page 259
.
4 Configure logging and reports. For details, see
.
Modes of operation
You can install the FortiMail unit to operate in either:
• gateway mode
• transparent mode
• server mode
Which mode of operation you choose will vary by its appropriateness to your network topology and other requirements.
If you have completed physical installation and initial configuration of your FortiMail unit, you have already selected a mode of operation. For information about appropriate network topologies for each mode of operation, see the FortiMail Installation Guide .
Note: All modes can scan for viruses and spam, but each mode of operation has some features are specific to it. This Administration Guide notes features of the webbased manager that do not appear in all modes of operation.
In most cases, you will select the mode of operation once, and will not change it: changing the mode of operation could require you to adjust your network topology, configuration of the MX entry of DNS records for your protected domains, and other setup considerations that are specific to the nature of each mode of operation. Should you want to change the
How FortiMail units process email
FortiMail units receive email for defined email domains and control relay of email to other domains. Email passing through the FortiMail unit can be scanned for viruses and spam.
Policies and profiles govern how the FortiMail unit scans email and what it does with email messages containing viruses or spam. For information about policies, see the
. For information about profiles, see “Profile” on page 285
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow How FortiMail units process email
In addition to policies and profiles, other configured items, such as email domains, may affect how your FortiMail unit processes email.
Email domains
An email domain is a set of email accounts that reside on a particular email server. The email domain name is the portion of the user’s email address following the “@” symbol.
FortiMail units can be configured to protect email domains (referred to as “protected domains” in this Administration Guide) by defining policies and profiles to scan and relay email that is incoming to or outbound from protected domains.
If the FortiMail unit is operating in gateway mode or transparent mode, there is one local email domain that represents the FortiMail unit itself. If the FortiMail unit is operating in server mode, protected domains reside locally on the FortiMail unit’s built-in email server.
For information about creating protected domains, see “Configuring protected domains” on page 211 .
In transparent mode, each network interface includes a proxy and/or implicit MTA that receives and relays email. By default, the proxy/implicit MTA responds to SMTP greetings
(HELO/EHLO) using the host name of the SMTP server of the protected domain. For information about configuring the proxies, see
“Configuring the proxies & implicit relay” on page 229
. For information on configuring the SMTP greeting, see
“Configuring protected domains” on page 211 .
Access control rules
The access control rules allow you to control how email messages move to, from, and through the FortiMail unit. Using access control rules the FortiMail unit can analyze email messages and take action based on the result. Messages can be examined according to the sender email address, recipient email address, and the IP address or host name of the system delivering the email message.
Each access control rule specifies an action to be taken for matching email.
Recipient address verification
Recipient address verification ensures that the FortiMail unit rejects email with invalid recipients and does not scan or send them to the protected email server. This verification can reduce the load on the FortiMail unit when a spammer tries to send messages to every possible recipient name on the email server.
If you want to use recipient address verification, you need to verify email recipient addresses by using either the email server or an LDAP server.
Usually you can use the email server to perform address verification. This works with most email servers that provide a User unknown response to invalid addresses.
For instructions on configuring recipient address verification, see
“Configuring protected domains” on page 211 .
Disclaimer messages & customized appearance
You can customize both the disclaimer and replacement messages, as well as the appearance of the FortiMail unit interface.
The disclaimer message is attached to all email, generally warning the recipient the contents may be confidential. See
“Configuring global disclaimers” on page 205
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
21
How FortiMail units process email
22
Key concepts & workflow
Replacement messages are messages recipients receive instead of their email. These can include warnings about messages sent and incoming messages that are spam or infected with a virus. See
“Customizing replacement messages & quarantine report contents” on page 206 .
You can customize the appearance of the FortiMail unit web pages visible to mail administrators to better match a company look and feel. See
“Customizing the appearance” on page 141
.
Advanced delivery features
Processing email takes time. That can cause delays that result in client and server timeouts. To reduce this problem, you can:
• defer delivery to process oversize email at a time when traffic is expected to be light
• send delivery status notifications (DSN)
For detailed information, see
“Configuring the host name, port numbers, relay, mail queue,
.
Antispam techniques
Spam detection is a key feature of the FortiMail unit. The feature is based on two tiers of spam defense:
•
•
Each tier plays an important role in separating spam from legitimate email. FortiGuard
Antispam delivers a highly-tuned managed service for the classification of spam while the
FortiMail unit offers superior antispam detection and control technologies.
In addition to scanning incoming email messages, FortiMail units can also inspect the content of outgoing email messages. This can help eliminate the possibility that an employee or a compromised computer could send spam, resulting in the blacklisting of your organization’s email servers.
For more information on FortiMail antispam techniques, see
.
FortiMail antispam techniques
The following table highlights some of the FortiMail antispam techniques. For information
about how these techniques are executed, see “Order of execution” on page 24 .
Table 3: FortiMail antispam technique highlights
Forged IP scanning
See “Forged IP scan” on page 299
.
Greylist scanning
DNSBL scanning
SURBL scanning
Deep header scanning
Bayesian scanning
Heuristic scanning
Image spam scanning
See “Configuring greylisting” on page 400
.
In addition to supporting Fortinet’s FortiGuard Antispam DNSBL service, the FortiMail unit supports third-party DNS Blacklist servers. See
“DNSBL scan options” on page 301 .
In addition to supporting Fortinet’s FortiGuard Antispam SURBL service, the FortiMail unit supports third-party Spam URI
Realtime Block Lists servers. See
“SURBL scan options” on page 303 .
See “Deep header scan options” on page 302
.
See “Training the Bayesian databases” on page 421
.
See “Heuristic scan options” on page 306 .
See “Image spam scan options” on page 311
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow How FortiMail units process email
PDF scanning
Black/white lists
Banned word scanning
Whitelist word scanning
Sender reputation
See “Scan Conditions options” on page 311
.
• For information on global black/white lists, see
“Configuring the global black list & white list” on page 392
.
• For information on domain-wide black/white lists, see
“Configuring the per-domain black lists & white lists” on page 394
.
• For information on personal black/white lists, see
“Configuring the personal black lists & white lists” on page 396
.
•
For information on session black/white lists, see “Click the arrow to expand Lists.” on page 296 .
See “Banned word scan options” on page 308 .
See “Whitelist word scan options” on page 309 .
See “Viewing the sender reputation statuses” on page 76 .
FortiGuard Antispam service
The FortiGuard Antispam service is a Fortinet-managed service that provides a threeelement approach to screening email messages.
• The first element is a DNS Black List (DNSBL) which is a “living” list of known spam origins.
• The second element is an in-depth email screening based on a Uniform Resource
Identifier (URI) contained in the message body – commonly known as Spam URI
Realtime Block Lists (SURBLs).
• The third element is the FortiGuard Antispam Spam Checksum Blocklist (SHASH) feature. Using SHASH, the FortiMail unit sends a hash of an email to the FortiGuard
Antispam server which compares the hash to hashes of known spam messages stored in the FortiGuard Antispam database. If the hash results match, the email is flagged as spam.
FortiGuard query results can be cached in memory to save network bandwidth. For information on configuring caching and other FortiGuard Antispam services, see
“Configuring FortiGuard updates & FortiGuard Antispam queries” on page 110 .
FortiGuard Antispam DNSBL
To achieve up-to-date real-time identification, the FortiGuard Antispam service uses globally distributed spam probes that receive over one million spam messages per day.
The FortiGuard Antispam service uses multiple layers of identification processes to produce an up-to-date list of spam origins. To further enhance the service and streamline performance, the FortiGuard Antispam service continuously retests each of the “known” identities in the list to determine the state of the origin (active or inactive). If a known spam origin has been decommissioned, the FortiGuard Antispam service removes the origin from the list, thus providing customers with both accuracy and performance.
The FortiMail FortiGuard Antispam DNSBL scanning process works this way:
1 Incoming email (SMTP) connections are directed to the FortiMail unit.
2 Upon receiving the inbound SMTP connection request, the FortiMail unit extracts the source information (sending server’s domain name and IP address).
3 The FortiMail unit transmits the extracted source information to Fortinet’s FortiGuard
Antispam service using a secure communication method.
4 The FortiGuard Antispam service checks the sender’s source information against its
DNSBL database of known spam sources and sends the results back to the FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
23
How FortiMail units process email
24
Key concepts & workflow
5 The results are cached on the FortiMail unit.
• If the results identify the source as a known spam source, the FortiMail unit acts according to its configured policy.
• The cache on the FortiMail unit is checked for additional connection attempts from the same source. The FortiMail unit does not need to contact the FortiGuard
Antispam service if the results of a previous connection attempt are cached.
• Additional connection requests from the same source do not need to be submitted to the FortiGuard Antispam service again because the classification is stored in the system cache.
Once the incoming connection has passed the first pass scan (DNSBL), and has not been classified as spam, it will then go through a second pass scan (SURBL) if the administrator has configured the service.
FortiGuard Antispam SURBL
To detect spam based on the message body URIs (usually web sites), Fortinet uses
FortiGuard Antispam SURBL technology. Complementing the DNSBL component, which blocks messages based on spam origin, SURBL technology blocks messages that have spam hosts mentioned in message bodies. By scanning the message body, SURBL is able to determine if the message is a known spam message regardless of origin. This augments the DNSBL technology by detecting spam messages from spam source that may be dynamic, or a spam source that is yet unknown to the DNSBL service. The combination of both technologies provides a superior managed service with higher detection rates than traditional DNSBLs or SURBLs alone.
The FortiMail FortiGuard Antispam SURBL scanning process works this way:
1 After accepting an incoming SMTP connection (passed first pass scan), the email message is received.
2 After an incoming SMTP connection has passed the DNSBL scan, the FortiMail unit accepts delivery of email messages.
3 The FortiMail unit generates a signature (URI) based on the contents of the received email message.
4 The FortiMail unit transmits the signature to the FortiGuard Antispam service.
5 The FortiGuard Antispam service checks the email signature against its SURBL database of known signatures and sends the results back to the FortiMail unit.
6 The results are cached on the FortiMail unit.
• If the results identify the signature as known spam email content, the FortiMail unit acts according to its configured policy.
• Additional connection requests with the same email signature do not need to be reclassified by the FortiGuard Antispam service, and can be checked against the classification in the system cache.
• Additional messages with the same signature do not need to be submitted to the
FortiGuard Antispam service again because the signature classification is stored in the system cache.
Once the message has passed both elements (DNSBL and SURBL), it goes to the next layer of defense – the FortiMail unit that includes additional spam classification technologies.
Order of execution
FortiMail units perform each of the antispam scanning and other actions in the following sequence, from the top of the table towards the bottom. Disabled scans are skipped.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow How FortiMail units process email
Note: This table does not include everything the FortiMail unit does when a client connects to deliver email. Only the antispam techniques, and other functions having an effect on the antispam techniques, are included. Other non-antispam functions may be running in parallel to the ones in the table.
Note: The PDF file type scan does not appear in this table. When enabled, the PDF file type converts the first page of any PDF attachments into to a format the heuristic, banned word, and image spam scanners are able to scan. If any of these scanners are enabled, they will scan the first page of the PDF at the same time they examine the message body, according to the sequence in the table below.
Table 4: Execution sequence of antispam techniques
Check
Client initiates communication with the FortiMail unit
Sender / endpoint reputation
Sender rate control
Check Involves
Client IP address (for sender reputation) or client endpoint ID or
MSISDN (for endpoint reputation)
Client IP address
Action If Positive
If the client IP/MSISDN/email address is in the sender reputation database, check the score and enable any appropriate restrictions, if any.
Apply any connection limitations specified in the session profile.
Proceed to the next check.
Access control rules
(Phase I)
Client IP address If the combination of client IP, the domain/email address of the sender, and the domain/email of the recipient matches an access control rule (Policy >
Access Control > Receive), the
FortiMail unit performs the action selected in the access control rule, which is one of the following:
• BYPASS: Accept and relay the email, skipping all subsequent antispam checks
except greylisting if the sender or recipient belongs to a protected domain.
• RELAY: Accept and relay the email if it passes subsequent antispam checks. Do not apply greylisting.
• REJECT: Reject the email and return SMTP reply code
550 to the client.
• DISCARD: Accept the email, but silently delete it instead of delivering it. Neither the sender nor the recipient are notified of the deletion.
HELO/EHLO received from SMTP client
Action If Negative
Add the address to the sender/endpoint reputation database and keep a reputation score based on the email received.
Proceed to the next check.
In there are no connection limitations, or if no session profile applies, proceed to the next check.
If a matching access control rule does not exist, and if the recipient is a member of a protected domain, the default action is
RELAY; if the recipient is not a member of a protected domain, the default action is
REJECT.
For more information,
see “Configuring access control rules” on page 262 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
25
How FortiMail units process email
26
Key concepts & workflow
Table 4: Execution sequence of antispam techniques
HELO/EHLO
MAIL FROM: and RCPT TO: commands received from SMTP client
Sender domain checks
Domain of envelope sender
(MAIL FROM:)
If any of the domain checks (the
listed in Unauthenticated
Session Settings in the session profile) fail, an error is returned to the SMTP client. The error depends on which particular check failed.
Sender system white list
(Phase I)
Sender system black list
(Phase I)
Sender domain white list
(Phase I)
Sender domain black list
(Phase I)
Access control rules
(Phase II)
Domain of the
HELO/EHLO command
Client IP address and email address/domain of the envelope sender
(MAIL FROM:)
Client IP address and email address/domain of the envelope sender
(MAIL FROM:)
Client IP address and email address/domain of the envelope sender
(MAIL FROM:)
Client IP address and email address/domain of the envelope sender
(MAIL FROM:)
Envelope sender and recipient
(MAIL FROM: and
RCPT TO:)
If invalid characters appear in the domain, reject the
HELO/EHLO command. Session will not continue until a proper
HELO/EHLO command is received.
If the client IP or email address/domain of the sender appear in the system white list, deliver the email and cancel remaining antispam checks.
If the client IP or email address/domain of the sender appear in the system black list, invoke the black list action for the email.
If the client IP or email address/domain of the sender appear in the domain white list, deliver the message and cancel remaining antispam checks.
If the client IP or email address/domain of the sender appear in the domain black list, invoke the black list action for the message.
If the combination of client IP, the domain/email address of the sender, and the domain/email of the recipient matches an access control rule (Policy >
Access Control > Receive), the
FortiMail unit performs the action selected in the access control rule, which is one of the following:
• BYPASS: Accept and relay the email, skipping all subsequent antispam checks
except greylisting if the sender or recipient belongs to a protected domain.
• RELAY: Accept and relay the email if it passes subsequent antispam checks. Do not apply greylisting.
• REJECT: Reject the email and return SMTP reply code
550 to the client.
• DISCARD: Accept the email, but silently delete it instead of delivering it. Neither the sender nor the recipient are notified of the deletion.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
If a matching access control rule does not exist, and if the recipient is a member of a protected domain, the default action is
RELAY; if the recipient is not a member of a protected domain, the default action is
REJECT.
For more information,
see “Configuring access control rules” on page 262 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow How FortiMail units process email
Table 4: Execution sequence of antispam techniques
Recipient domain checks
Recipient system white list
(Phase I)
Recipient system black list
(Phase I)
Domain of envelope recipient
(RCPT TO:)
Envelope recipient
(RCPT TO:)
Envelope recipient
(RCPT TO:)
If any of the domain checks (the
Reject if recipient and helo domain match but sender
domain is different checks listed
in Unauthenticated Session
Settings in the session profile) fail, an error is returned to the
SMTP client. The error depends on which particular check failed.
If the client IP or email address/domain of the recipient appears in the system white list, deliver the email and cancel remaining antispam checks.
If the client IP or email address/domain of the recipient appears in the system black list, invoke the black list action for the email.
Recipient domain white list
(Phase I)
Recipient domain black list
(Phase I)
Envelope recipient
(RCPT TO:)
Envelope recipient
(RCPT TO:)
If the client IP or email address/domain of the recipient appears in the domain white list, deliver the message and cancel remaining antispam checks.
If the client IP or email address/domain of the recipient appears in the domain black list, invoke the black list action for the message.
Session recipient white list
(Phase I)
Session recipient black list
(Phase I)
Greylist
Envelope recipient
(RCPT TO:)
Envelope recipient
(RCPT TO:)
If the recipient appears in the session recipient white list, deliver the message and cancel remaining antispam checks.
If the recipient appears in the session recipient black list, reject the message.
System black list
(Phase II)
Envelope sender
(MAIL FROM:), envelope recipient
(RCPT TO:), and client IP subnet address
If the sender is in the greylist database or if the client IP subnet appears in the greylist exempt list, the message is passed to the next check.
Note: This check is omitted if the access control rule’s action is RELAY.
DATA command received from SMTP client
System white list
(Phase II)
Message header sender (From:)
If the email address/domain of the sender appears in the system white list, deliver the message and cancel remaining antispam checks.
Message header sender (From:)
If the email address/domain of the sender appears in the system black list, invoke the black list action for the message.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
If the sender is not in the greylist database, a temporary failure code is returned to the
SMTP client.
Proceed to the next check.
Proceed to the next check.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
27
How FortiMail units process email Key concepts & workflow
Table 4: Execution sequence of antispam techniques
Session sender white list
(Phase II)
Session sender black list
(Phase II)
Personal white list
Envelope sender
(MAIL FROM:) and message header sender (From:)
Envelope sender
(MAIL FROM:) and message header sender (From:)
Envelope sender
(MAIL FROM:) and message header sender (From:)
If the email address/domain of the sender appears in the session sender white list, deliver the message and cancel remaining antispam checks.
If the email address/domain of the sender appears in the session sender black list, the black list action is invoked.
Personal black list
FortiGuard
Antispam
Envelope sender
(MAIL FROM:) and message header sender (From:)
If the email address/domain of the sender appears in the personal black list, the message is discarded.
End of message (EOM) command received from SMTP client
Antivirus Message body and attachments
If an infected message is detected, and the antispam profile is configured to treat viruses as spam, the default spam action will be invoked on the infected message.
Every URI in the message body
If Black IP scan is enabled, all IP addresses in the message header are also checked.
If the FortiGuard scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
Forged IP
DNSBL
Last hop IP address
If Black IP scan is enabled, all IP addresses in the message header are also checked.
If Headers analysis is enabled, the entire header is examined for characteristics of spam.
Client IP address
If the email address/domain of the sender appears in the personal white list, deliver the message and cancel remaining antispam checks.
If the forged IP scanner determines the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
SURBL Every URI in the message body
If the DNSBL scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the SURBL scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
28
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow Using regular expressions
Table 4: Execution sequence of antispam techniques
Heuristic
Bayesian
White List
Word
Banned Word
Dictionary
Image Spam
Deep Header
Content
Message body
Message body
Message subject and/or body
Message subject and/or body
Message body
Embedded images
If Aggressive scan is enabled, attached images are also examined.
Message header
Attachments (for content scan) and message body (for content monitor scan)
If the heuristic antispam scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the Bayesian scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the whitelisted word scanner determines that the message is not spam, deliver the message and cancel remaining antispam checks.
If the banned word scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the dictionary scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the image spam scanner determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the deep header scan determines that the message is spam, the configured individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
If the content scanner determines that the message is spam or prohibited, the action configured in the content profile individual action is invoked. If the individual action is set to default, then the antispam profile default action is used.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Proceed to the next check.
Using regular expressions
Some FortiMail features support the use of wild card characters (* or ?) or Perl-style regular expressions in order to create patterns that match multiple IP addresses, email addresses, or other data.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
29
Using regular expressions
30
Key concepts & workflow
For detailed information on using regular expressions, see http://perldoc.perl.org/perlretut.html
.
Special characters with regular expressions & wild cards
A wild card character is a special character that represents one or more other characters.
The most commonly used wild card characters are the asterisk (*), which typically represents zero or more characters, and the question mark (?), which typically represents any one character.
In Perl-style regular expressions, the period (.) character refers to any single character. It is similar to the question mark (?) character in wild card match pattern. As a result, example.com not only matches example.com but also example, examplebcom, exampleccom, and so forth.
To match a special character such as “.” and “*” use the backslash ( \ )escape character.
For example, to match example.com, the regular expression should be: example\.com
In Perl regular expressions, an asterisk (*) matches the character before it 0 or more times, not 0 or more times of any character. For example, example*.com matches exampleeeeee.com but does not match example.com.
To match any character 0 or more times, use “.*” where “.” means any character and the
“*” means 0 or more times. For example, the wild card match pattern exampl*.com should therefore be exampl.*\.com.
Word boundary
In Perl-style regular expressions, the pattern does not have an implicit word boundary. For example, the regular expression test not only matches the word “test” but also any word that contains “test”, such as attest”, “mytest”, “testimony”, “atestb”. The notation \b specifies the word boundary. To match exactly the word “test”, the expression should be
\btest\b.
Case sensitivity
Regular expression pattern matching may be case sensitive. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i will block all instances of “bad language”, regardless of case.
Syntax
Table 5 lists some example regular expressions, and describes matches for each expression. Regular expressions on FortiMail units use Perl-style syntax.
Table 5: Regular expression syntax
Expression abc
^abc abc$ a|b
^abc|abc$ ab{2,4}c ab{2,}c ab*c ab+c
Matches abc (the exact character sequence, but anywhere in the string) abc at the beginning of the string abc at the end of the string
Either a or b abc at either the beginning or the end of the string a followed by two, three or four b characters, followed by c a followed by at least two “b”s followed by a “c” a followed by any number (zero or more) of “b”s followed by a “c” a followed by one or more b's followed by a c
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow Using regular expressions
Table 5: Regular expression syntax (Continued) ab?c
a.c
a\.c
[abc]
[Aa]bc
[abc]+
[^abc]+
\d\d
/i
\w+
100\s*mk abc\b start\B
\x
/x a followed by an optional “b” followed by a” c”; that is, either “abc” or “ac” a followed by any single character (not newline) followed by a “c” a.c
Any one of a, b or c
Either Abc or abc
Any combination of one or more a, b, and/or c characters (such as a, abba, or acbabcacaa)
Any combination of one or more characters that does not contain an a, b, and/or c (such as defg)
Any two decimal digits, such as 42; same as \d{2}
Makes the pattern case insensitive. For example, /bad language/i blocks bad language, Bad LAnguaGe, etc.
A word (a nonempty sequence of alphanumeric characters and underscores), such as foo, 12bar8, or foo_1
100 and mk separated by zero or more white space characters (spaces, tabs, newlines) abc when followed by a word boundary (for example, abc! but not abcd) start when not followed by a word boundary (for example, starting but not start time)
Ignores white space that is neither preceded by a backslash character nor within a character class. Use this to break up a regular expression into (slightly) more readable parts.
Used to add regular expressions within other text. If the first character in a pattern is forward slash (/), the / is treated as the delimiter. The pattern must contain a second /. The pattern between / will be taken as a regular expression, and anything after the second / will be parsed as a list of regular expression options (i, x, etc). An error occurs If the second
/ is missing. In regular expressions, the leading and trailing space is treated as part of the regular expression.
Examples
To block any word in a phrase
/block|any|word/
To block purposefully misspelled words
Spammers often insert other characters between the letters of a word to fool spam blocking software.
/^.*v.*i.*a.*g.*r.*o.*$/i
/cr[eéèêë][\+\-\*=<>\.\,;!\?%&§@\^°\$£€\{\}()\[\]\|\\_01]dit/i
To block common spam phrases
The following phrases are some examples of common phrases found in spam messages.
/try it for free/i
/student loans/i
/you’re already approved/i
/special[\+\-\*=<>\.\,;!\?%&~#§@\^°\$£€\{\}()\[\]\|\\_1]offer/i
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
31
Using regular expressions Key concepts & workflow
32
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Key concepts & workflow Using regular expressions
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
33
Using regular expressions Key concepts & workflow
34
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
About the web-based manager System requirements
About the web-based manager
This chapter describes aspects that are general to use of the web-based manager, a graphical user interface (GUI) that you can use to access the FortiMail unit from within a current web browser.
This topic includes:
•
•
•
•
•
•
•
Buttons, menus, and the displays
•
System requirements
The management computer that you use to access the web-based manager must have:
• a compatible web browser, such as Microsoft Internet Explorer 6.0 or greater, or
Mozilla Firefox 3.0 or greater
• Adobe Flash Player 10 or greater plug-in
To minimize scrolling, the computer’s screen should have a resolution that is a minimum of
1280 x 1024 pixels.
URL for access
The web-based manager can be accessed by URL using the network interfaces’ IP addresses or, if the FortiMail unit is operating in transparent mode, the management IP address.
Table 6: Accessing the FortiMail by IP address
Operation mode
Gateway or
Server
Role URL for HTTPS access
Email user https://<interface IP address>
Administrator https://<interface IP address>/admin
Default URL (port1)* https://192.168.1.99/ https://192.168.1.99/admin
Transparent Email user https://<management IP address> https://192.168.1.99/
Administrator https://<management IP address>/admin https://192.168.1.99/admin
*Default URL is before you have configured the IP addresses of the network interfaces, which occurs during installation, before the scope of this Administration Guide. See the FortiMail Install
Guide .
If these IP addresses are not public IP addresses, you may need to access the FortiMail unit through its public IP address instead. For more information on connecting to your
FortiMail unit locally or through your network, see the FortiMail Install Guide .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
35
Settings About the web-based manager
For information on enabling remote access and configuring IP addresses using the advanced mode of the web-based manager, see
“Configuring the network interfaces” on page 121
and
“About the management IP” on page 122
. You may also need to configure from which hosts the FortiMail unit will accept login attempts for your administrator
.
For high availability (HA) groups of FortiMail units, you should generally connect to the
primary unit. For more information, see “Administering an HA group” on page 189 .
Settings
Some settings for the web-based manager apply regardless of which administrator account you use to log in. Global settings include the idle timeout, TCP port number on which the web-based manager listens for connection attempts, the network interface(s) on which it listens, and the language of its display.
For details, see “Configuring the idle timeout & LCD panel options” on page 135 and
“Editing network interfaces” on page 123 .
Basic mode vs. advanced mode
The web-based manager enables you to configure the FortiMail unit by connecting to the
FortiMail unit through a web browser. The web-based manager has two modes: basic mode and advanced mode.
• Basic mode: Provides easy navigation using a simplified set of menu options that allow for many, but not all, typical FortiMail unit configurations. Less frequently used options are hidden, and some configurations are simplified by providing you with predefined configuration sets.
Note: Basic mode is only available to administrator accounts whose Domain is System. It is
not available to domain (tiered) administrator accounts. For more information on domain administrators, see
“About administrator account permissions & domains” on page 144
.
• Advanced mode: Provides the full set of menu options which allows you to achieve more complex configurations.
You can switch between the basic mode and advanced mode of the web-based manager at any time with no configuration loss. If, for example, you prefer basic mode but need to configure an item that is displayed only in advanced mode, you could switch to advanced mode, configure the item, then switch back to basic mode. To switch between the two modes, click either Basic Mode >> or Advanced Mode >>.
Basic mode is explained in
“Basic mode” on page 41 . Advanced mode is explained in
and its subsequent chapters.
Quick Start Wizard
If you are configuring your FortiMail unit for the first time, you may want to use the Quick
Start Wizard. The Quick Start Wizard leads you through required configuration steps, helping you to quickly set up your FortiMail unit.
36
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
About the web-based manager Quick Start Wizard
All settings configured by the Quick Start Wizard can also be configured through the basic and advanced modes of the web-based manager. However, the Quick Start Wizard presents each setting in the necessary order, and contains descriptions to assist you in configuring each setting. These descriptions are not available in either the basic mode or advanced mode of the web-based manager.
Completing the Quick Start Wizard will:
• change the default password of the admin administrator account
• configure system settings such as IP address, netmask, DNS, and gateway
• configure local host settings such as host name
• configure one or more protected domains
• set the level of incoming and outgoing antispam controls
• turn incoming and outgoing antivirus scanning on or off
• create two report profiles: predefined_report_yesterday and predefined_report_last_week
Caution: Before running the Quick Start Wizard, select the operation mode of the FortiMail unit, such as gateway mode, transparent mode, or server mode. Failure to select the operation mode before running the Quick Start Wizard may require you to run the Quick
Start Wizard again after changing the operation mode, as changing the operation mode may reset or change part of the configuration performed by the Quick Start Wizard. For more information on selecting the operation mode, see
Caution: Back up the configuration before beginning this procedure. This procedure may reset many of the configuration file changes that you have made to the FortiMail unit. For
more information on creating a backup, see “Backup and restore” on page 97
.
To begin the Quick Start Wizard, click Quick Start Wizard, then click Yes to confirm.
Figure 1: Quick Start Wizard
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
37
Themes About the web-based manager
For full setup procedures, see the FortiMail Installation Guide .
Themes
You can switch the color of the web-based manager’s menus and buttons in order to suit your preference or to improve visibility.
To switch between the available display colors, click the Next Theme button located at the top of the web-based manager.
Buttons, menus, and the displays
A navigation menu is located on the left side of the web-based manager. To expand or collapse an area of the menu, click the + or - button located next to the area’s name, or click the name of the area itself. To view the tabs located within a submenu, click the name of the submenu.
Within each submenu is one or more tabs, which are displayed to the right of the menu.
Each tab displays or allows you to modify settings, using a similar set of buttons. (Color of the buttons may vary by which theme you have selected. See
Table 7: Common buttons and menus
Appearance Description
Click to collapse a visible area.
Click to expand a hidden area.
Click to view the first page’s worth of records within the tab.
If this button is grey, you are already viewing the first page.
Click to view the previous page’s worth of records within the tab.
If this button is grey, you are viewing the first page.
To go to a specific page number in the records for that tab, type the page number and press Enter.
The total number of pages depends on the number of records per page.
Click to view the next page’s worth of records within the tab.
If this button is grey, you are viewing the last page.
Click to view the last page’s worth of records within the tab.
If this button is grey, you are already viewing the last page.
Click to refresh the tab’s display.
While the tab is loading the new display, this button is animated.
To change the size of each page’s worth of records in the tab, either click and select one of the numbers in the drop-down list, or type the number and press Return.
The total number of pages depends on the number of records per page.
Click to create a new entry using only typical default values as a starting point.
New...
38
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
About the web-based manager Language support
Table 7: Common buttons and menus
Clone...
Edit...
Delete...
Click to create a new entry by duplicating an existing entry.
To use this button, you must first click to select an existing entry upon which the new entry will be based.
Alternatively, you can right-click an entry and select Clone.
Click to modify an existing entry.
To use this button, you must first click to select which existing entry you want to modify
Alternatively, you can double-click the existing entry, or rightclick the entry and select Edit.
Click to remove an existing entry.
To use this button, you must first click to select which existing entry you want to remove.
Alternatively, you can right-click an entry and select Delete.
To delete multiple entries, either mark the checkboxes of each entry that you want to delete, or right-click and click Select All, then click Delete.
Common buttons are not described in subsequent sections of this Administration Guide.
Some tabs have unique buttons, or special behaviors associated with common buttons.
Those buttons are described in their corresponding section of the Administration Guide.
Language support
Characters such as ñ, é, symbols, and ideographs are sometimes acceptable input.
Support varies by the nature of the item being configured.
For example, the host name must not contain special characters, and so the web-based manager and CLI will not accept most symbols and non-ASCII encoded characters as input when configuring the host name. This means that languages other than English often are not supported. But dictionary profiles support terms encoded in UTF-8, and therefore support a number of languages.
To use other languages in those cases, you must use an encoding that supports it.
It is simplest to use only US-ASCII characters when configuring the FortiMail unit using the web-based manager or CLI. Using only ASCII, you do not need to worry about:
• mail transfer agent (MTA) encoding support
• mail user agent (MUA) language support
• web browser language support
• Telnet and/or SSH client support
• font availability
• compatibility of your input’s encoding with the encoding/language setting of the webbased manager
• switching input methods when entering a command word such as get in ASCII but a setting that uses a different encoding
Note: If you choose to configure parts of the FortiMail unit using non-ASCII characters, verify that all systems interacting with the FortiMail unit also support the same encodings.
You should also use the same encoding throughout the configuration if possible in order to avoid needing to switch the language settings of the web-based manager and your web browser or Telnet/SSH client while you work.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
39
Language support About the web-based manager
40
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
Basic mode
The basic mode of the web-based manager provides easy navigation using a set of menu options that is more simple than the advanced mode. Less frequently used options are hidden, and some configurations are simplified by providing you with pre-defined configuration sets.
When you log in, the web-based manager initially appears in basic mode if that preference has been configured for your administrator account. Otherwise, it starts in advanced mode. For more information, see
“Configuring administrator accounts” on page 147
.
To manually switch from the advanced mode to the basic mode of the web-based manager, click Basic Mode >>.
This topic includes areas of the menu that are unique to basic mode:
•
Note: This topic does not describe areas of basic mode that also appear in the advanced mode of the web-based manager. For menu options that appear in both the advanced
mode and basic mode, see the advanced mode chapters, beginning with “Advanced mode” on page 49 .
AntiSpam
After you have integrated the FortiMail unit into your network by configuring the network interfaces and protected domains, you can configure the antispam and antivirus features of the FortiMail unit to protect your SMTP servers and email users. The AntiSpam submenu of the Settings menu enables you to customize these features.
Antispam and antivirus settings can be configured separately for incoming and outgoing
Note: The Antispam menu of the basic mode of the web-based manager presents simplified controls for typical antispam and antivirus configurations. If you need to achieve a more sophisticated configuration, additional settings are available in profiles and recipientbased and IP-based policies in the advanced mode of the web-based manager. For more
information, see “Profile” on page 285 and
.
The AntiSpam submenu includes:
•
: Where you can select from predefined sets of antispam and antivirus actions for incoming email, and configure the connection with the protected email server.
•
Incoming Action : Where you can configure antispam and antivirus actions for incoming
email, such as tagging, quarantining, or discarding.
•
: Where you can select from predefined sets of antispam and antivirus actions for outgoing email, and configure access control rules for SMTP clients that are allowed to send outgoing email.
•
: Where you can configure antispam and antivirus actions for outgoing email, such as tagging, quarantining, or discarding.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
41
AntiSpam Basic mode
Incoming vs. outgoing email
Available FortiMail features and their behavior vary by the direction of each email.
• Incoming email messages consist of messages sent to the SMTP servers that are protected domains of the FortiMail unit. For example, if the FortiMail unit is configured to protect the SMTP server whose domain name is example.com, the FortiMail unit treats all email messages sent to example.com as incoming email. For information about configuring protected domains, see
“Configuring protected domains” on page 211 .
• Outgoing email messages consist of messages sent to recipients on domains that the
FortiMail unit has not been configured to protect. For example, if the FortiMail unit is
not configured to protect the domain example.com, all email messages sent to recipients at example.com will be treated as outgoing email, regardless of their origin.
Incoming
The Incoming tab displays the antispam and antivirus settings for each protected domain, and enables you to customize these default settings.
To view the incoming antispam and antivirus settings, go to Settings > AntiSpam >
Incoming.
Figure 2: Viewing the list of antivirus and antispam settings for email incoming to each protected domain
42
Domain
AntiSpam
AntiVirus
The name of the protected domain. For information on configuring protected domains, see
“Configuring protected domains” on page 211 .
The current antispam settings level, such as Medium.
This setting will be Advanced if:
• you have created the protected domain, but have not yet selected an antispam level, and the FortiMail unit is currently using default antispam settings, or
• you have used the advanced mode of the web-based manager to configure the FortiMail unit to use profiles other than those such as such as
antispam_basic_predefined_high, which correspond to the antispam levels in the basic mode of the web-based manager
The current antivirus setting, such as Enabled.
This setting will be Advanced if:
• you have created the protected domain, but have not yet selected to enable or disable antivirus processing, and the FortiMail unit is currently using default antivirus settings, or
• you have used the advanced mode of the web-based manager to configure the FortiMail unit to use profiles other than those such as such as
antivirus_basic_predefined_enable, which correspond to the antivirus setting in the basic mode of the web-based manager
To edit incoming antispam and antivirus settings
1 Go to Settings > AntiSpam > Incoming.
2 Click the row corresponding to the protected domain whose antispam and antivirus settings you want to modify, then click Edit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
3 Configure the following:
Figure 3: Editing the antispam and antivirus settings for email incoming to a protected domain
Domain
AntiSpam Level
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144 .
Select one of the following:
• Off: No antispam scanning.
• Low: Good spam detection rate.
• Medium: Better spam detection rate with a small impact on system performance.
• High: Best spam detection rate with an additional impact on system performance.
Select Enabled to perform antivirus scanning. AntiVirus level
4 Click OK.
Incoming Action
The Incoming Action tab enables you to select which action the FortiMail unit will take against spam and virus-infected email if it is incoming to a protected domain.
Note: For more information on determining directionality, see “Incoming vs. outgoing
recipient-based policies” on page 259
and “Incoming vs. outgoing SMTP connections” on page 231
.
To configure the actions
1 Go to Settings > AntiSpam > Incoming Action.
2 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
43
AntiSpam Basic mode
Figure 4: Editing the actions on spam and viruses incoming to a protected domain
44
AntiSpam Actions
Tag email’s subject line
Insert new header
Reject
Discard
Enable and enter the text that will appear in the subject line of the email, such as “[spam]”, in the With value field. The FortiMail unit will prepend this text to the subject line of spam before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the message header. For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Custom-Header: Detected as spam by profile 22.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as
these are forbidden by RFC 2822 .
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
Quarantine Enable to redirect spam to the per-recipient quarantine. For more information, see
“Managing the personal quarantines” on page 63 . Also configure:
• Delete messages after n days: Enter the number of days you want to keep the quarantined email. Enter a small enough value that will prevent the size of the quarantine from exceeding the available disk space. If you enter 0 to prevent automatic deletion of quarantined files, you must periodically manually remove old files.
AntiVirus Actions
Replace virus body
Reject
Discard
3 Click Apply.
Indicates that the FortiMail unit will replace infected attachments with a replacement message. You can customize replacement
.
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
Enable to reject infected email and reply to the SMTP client with
SMTP reply code 550.
Enable to accept infected email, but then delete it instead of delivering the email, without notifying the SMTP client.
Outgoing
After you have created a protected domain, the FortiMail unit will apply default outgoing antispam and antivirus settings to the protected domain. The Outgoing tab enables you to customize these default settings.
To view the outgoing antispam and antivirus settings, go to Settings > AntiSpam >
Outgoing.
Figure 5: Editing the antispam and antivirus settings for email outgoing to an unprotected domain
AntiSpam level
AntiVirus level
Access control
Select one of the following:
• Off: No antispam scanning.
• Low: Good spam detection rate.
• Medium: Better spam detection rate with a small impact on system performance.
• High: Best spam detection rate with an additional impact on system performance.
Enable to perform antivirus scanning.
Click to configure rules to allow specific SMTP clients to send email from your protected domains.
Proper access control rules prevent your FortiMail unit from being an open relay. Open relays are often used by spammers, and therefore are often blacklisted by other mail servers.
Access control rules allow, discard, reject, or relay email based on the sender, recipient, IP address, or a reverse DNS lookup of the domain name of the
connecting SMTP server. For details, see “Configuring access control rules” on page 262
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
45
AntiSpam Basic mode
Outgoing Action
The Outgoing Action tab enables you to select which action the FortiMail unit will take against spam and virus-infected email if it is outgoing to a mail domain that is not protected.
and “Incoming vs. outgoing SMTP connections” on page 231
.
To configure the actions
1 Go to Settings > AntiSpam > Outgoing Action.
2 Configure the following:
Figure 6: Editing the actions on spam and viruses outgoing to an unprotected domain
AntiSpam Actions
Tag email’s subject line
Enable and enter the text that will appear in the subject line of the email, such as “[spam]”, in the With value field. The FortiMail unit will prepend this text to the subject line of spam before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
46
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Basic mode AntiSpam
Insert new header Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the message header. For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Custom-Header: Detected as spam by profile 22.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as these are forbidden by RFC 2822 .
Reject
Discard
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
AntiVirus Action s
Replace virus body
Reject
Discard
Indicates that the FortiMail unit will replace infected attachments with a replacement message. You can customize replacement messages. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206 .
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
Enable to reject infected email and reply to the SMTP client with
SMTP reply code 550.
Enable to accept infected email, but then delete it instead of delivering the email, without notifying the SMTP client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
47
AntiSpam Basic mode
48
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Advanced mode
Advanced mode
The advanced mode of the web-based manager provides the full set of menu options, allowing you to achieve more complex configurations than the basic mode of the webbased manager.
When you log in, the web-based manager initially appears in basic mode if that preference has been configured for your administrator account. Otherwise, it starts in advanced mode. For more information, see
“Configuring administrator accounts” on page 147
.
To manually switch from the basic mode to the advanced mode of the web-based manager, click Advanced Mode >>.
The following chapters describe the menu options that appear in the advanced mode of the web-based manager, and includes the following topics:
•
•
•
•
•
•
•
•
•
•
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
49
Advanced mode
50
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing overall system statuses
Monitor
The Monitor menu displays system usage, mail queues, log messages, reports, and other status-indicating items.
It also allows you to manage the contents of the mail queue and quarantines, and the sender reputation and endpoint reputation scores.
This topic includes:
•
Viewing overall system statuses
•
Managing the deferred mail queue
•
•
•
Viewing the sender reputation statuses
•
Viewing the endpoint reputation statuses
•
•
•
Viewing overall system statuses
Monitor > System Status displays system statuses, most of which pertain to the entire system, such as CPU usage and current IP sessions. It also displays items that span multiple features, such as email statistics.
This topic includes:
•
•
•
Viewing the list of current IP sessions
Viewing the dashboard
Monitor > System Status > Status displays first after you log in to the web-based manager.
It contains a dashboard with widgets that each indicate performance level or other status.
By default, widgets appear which display the serial number and current system status of the FortiMail unit, including uptime, system resource usage, alert messages, host name, firmware version, system time, and email throughput.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the dashboard, go to Monitor > System Status > Status.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
51
Viewing overall system statuses
Figure 7: Viewing the dashboard
Monitor
52
The dashboard is customizable. You can select which widgets to display, where they are located on the tab, and whether they are minimized or maximized.
To move a widget, position your mouse cursor on the widget’s title bar, then click and drag the widget to its new location.
To show or hide a widget, in the upper left-hand corner, click Add Content, then mark the check boxes of widgets that you want to show.
Options vary slightly from widget to widget, but always include options to close or minimize/maximize the widget.
Figure 8: A minimized widget
Widget title
Disclosure arrow
Refresh
Close
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing overall system statuses
Widget Title
Disclosure arrow
Refresh
Close
The name of the widget.
Select to maximize or minimize the widget.
Select to update the displayed information.
This option does not appear on the System Command widget.
Select to hide the widget on the dashboard. You will be prompted to confirm the action. To show the widget again, select Add Content near the top of the tab.
The available dashboard widgets are:
•
•
•
•
•
•
•
System Information widget
The System Information widget displays the serial number and basic system statuses such as the firmware version, system time, and up time.
In addition to displaying basic system information, the System Information widget enables you to configure the operation mode, and to change the firmware.
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
Figure 9: System Information widget
Serial number
Up time
The serial number of the FortiMail unit. The serial number is unique to the
FortiMail unit and does not change with firmware upgrades.
The time in days, hours, and minutes since the FortiMail unit was started or rebooted.
The current time according to the FortiMail unit’s internal clock. System time
Firmware version The version of the firmware installed on the FortiMail unit. Click Update to
change the firmware. For more information, see “Installing firmware” on page 453 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
53
Viewing overall system statuses
54
Monitor
Operation mode Select one of the following operation modes of the FortiMail unit:
• Gateway: Use when you do not want your email server to be visible to email users for security reasons. You will need to modify the email clients of your email users, the MX records on DNS servers for your protected domains, and policies on NAT devices such as routers and firewalls to route incoming email through the FortiMail unit for it to be scanned.
• Server: Use if you need an SMTP server with integrated advanced antispam and antivirus capabilities.
• Transparent: Use when a network is complex and you do not want to change the IP address scheme.
Administrators whose Domain is System and whose access profile contains
Read-Write permission in the Others category can change the FortiMail unit from one operation mode to another.
Caution: Operation modes reflect the nature of the network topology in which you deploy the FortiMail unit, and other considerations. A significantly different deployment may be required, especially for transparent mode. For guidance, related settings, and configuration of systems with which the FortiMail unit must interact, see the FortiMail Install Guide .
Caution: Back up the configuration before beginning this procedure. This procedure may reset many of the configuration file changes that you have made to the FortiMail unit, including settings that do not apply to the new
operation mode. For more information on creating a backup, see “Backup and restore” on page 97 .
Note: If the FortiMail unit is operating in gateway mode, you must configure the MX record of the DNS server for each protected domain to direct all email to this FortiMail unit instead of the protected SMTP servers.
HA mode
Log disk
The configured and effective (that is, current) HA operation mode.
For more information, see
“Monitoring the HA status” on page 163 .
The capacity and usage level of the hard disk that the FortiMail unit uses to store log messages.
For more information on logging, see
“About FortiMail logging” on page 437 .
Mailbox disk The capacity and usage level of the hard disk that the FortiMail unit uses to store archived email and quarantined spam.
“Configuring the email archiving policy” on page 433 .
For information on using the advanced mode of the web-based manager to
configure the RAID level of the mailbox disk, see “Configuring RAID” on page 151 .
Email throughput The total number of email processed per minute, as an average over the last
60-minute period.
License Information widget
The License Information widget displays the last queried license statuses for
FortiGuard Antispam and FortiGuard Antivirus.
If you do not want to allow the FortiMail unit to automatically download antivirus definition updates from the FortiGuard Distribution Network (FDN), you can also use the
License Information widget to manually upload an antivirus definitions update file. To upload the file, first download the antivirus definition file to your management computer from the Fortinet Technical Support web site, https://support.fortinet.com
, then click
Update.
Note: Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing overall system statuses
Figure 10: License Information widget
System Resource widget
The System Resource widget displays the CPU, memory, and disk space usage. It also displays the system load and current number of IP sessions.
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
Figure 11: System Resource widget
CPU usage
Memory usage
Log disk usage
Mail disk usage
System load
Active sessions
History >>
The current CPU usage displayed as a dial gauge and as a percentage.
The web-based manager displays CPU usage for core processes only. CPU usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded.
The current memory (RAM) usage displayed as a dial gauge and as a percentage.
The web-based manager displays memory usage for core processes only.
Memory usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded.
The current percentage used of the local disk used to store log messages.
For more information on storing log messages, see
“Configuring RAID” on page 151 and
“Configuring logging to the hard disk” on page 439
.
The current percentage used of the local disk used to store mail data. For more information on storing mail data, see
“Configuring RAID” on page 151
and
“Selecting the mail data storage location” on page 208
.
The current system load rating.
The current number of IP sessions. Click to display a list of those sessions’
details. For more information, see “Viewing the list of current IP sessions” on page 59
.
Click to switch the widget’s display to the system resources history graphs.
To return to the bar graph display, in the widget’s title bar, click Refresh.
The system resources history can also be viewed in this widget. The system resources history contains four (4) graphs. Each graph displays readings of one of the system resources: CPU, memory, IP sessions, and network bandwidth usage. Each graph is divided by a grid.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
55
Viewing overall system statuses
Figure 12: Viewing the system resources history
Monitor
56
CPU Usage
History
Memory Usage
History
The amount of workload of the CPU, relative to its maximum.
The amount of memory (RAM) in use, relative to its maximum.
Network Usage
History
The amount of network bandwidth usage, relative to the number of units displayed in the upper left corner of the graph.
Session History The amount of IP sessions, relative to the number of units displayed in the upper left corner of the graph.
You can view the connections to and from the FortiMail unit. For more information, see
“Viewing the list of current IP sessions” on page 59 .
• Horizontal axis: Indicates time, with each grid square representing approximately three (3) seconds. The most recent time is towards the right side of the graph.
• Vertical axis: Indicates the usage level, with each grid square representing one fifth
(20%) of either the:
• maximum possible usage (CPU Usage History and Memory Usage History), or
• number of units currently in the upper left corner of the graph; this number of units is not constant, but instead scales to more clearly show trends at higher or lower levels of usage, such as scaling from 100 kilobits per second (Kbps) to 1 megabit
(Mbps) (Session History and Network Utilization History)
Greater usage levels are towards the top of the graph.
• Red line: Indicates the usage level of that resource over the previous 60 seconds.
If you do not initially see the red line in a graph, look at the bottom edge of the graph. If the system resource usage is very low, such as when the CPU is idle, the red line may coincide with the bottom edge of the graph.
To view the system resources history, go to Monitor > System Status > Status, then, in the
System Resource widget, click History >>. To return to the current system resources, click the Refresh icon on the widget’s title bar.
Statistics Summary widget
The Statistics Summary widget contains a table-format summary of charts that can also be
viewed on the Mail Statistics tab. For details, see “Viewing the email statistics” on page 58 .
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing overall system statuses
System Command widget
The System Command widget enables you to restart, shut down, or reload the configuration of the FortiMail unit.
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
Before rebooting or halting the FortiMail unit, you may want to consider notifying your email users, as it could result in temporary interruptions to connectivity.
Figure 13: Viewing the system command widget
To restart the FortiMail unit
1 Go to Monitor > System Status > Status.
2 Click Restart.
A confirmation dialog appears.
3 Click OK to confirm.
The FortiMail unit restarts. If you want to continue configuring the FortiMail unit, refresh your browser and log in again.
To shut down the FortiMail unit
1 Go to Monitor > System Status > Status.
2 Click Shut Down.
A confirmation dialog appears.
3 Click OK to confirm.
The FortiMail unit halts the software. For FortiMail-400 models, you can now safely turn off the power using the power button on the back of the FortiMail unit. For FortiMail-
100, FortiMail-2000, or FortiMail-4000 models, you can now safely turn off the power by unplugging the FortiMail unit.
To reload the FortiMail unit
1 Go to Monitor > System Status > Status.
2 Click Reload.
A confirmation dialog appears.
3 Click OK to confirm.
The FortiMail unit reloads its configuration from its last saved version, and logs you out.
Any changes that were in progress but not yet saved, such as GUI pages that were not applied or CLI commands where you had not yet entered next or end, are lost. If you want to continue configuring the FortiMail unit, refresh your browser and log in again.
Statistics History widget
The Statistics History widget contains charts that can also be viewed on the Mail Statistics
tab. For details, see “Viewing the email statistics” on page 58
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
57
Viewing overall system statuses Monitor
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
Fortinet RSS Feed widget
The Fortinet RSS Feed widget provides a convenient display of the latest security advisories and discovered threats from Fortinet.
To view the widget, go to Monitor > System Status > Status. If the widget is not currently shown, in the upper left-hand corner, click Add Content, and mark the check box for the widget.
Figure 14: Viewing the Fortinet RSS feed
58
Viewing the email statistics
The Mail Statistics tab contains summaries of the numbers of email messages in each time period that the FortiMail unit detected as containing viruses, spam, or neither.
For email messages classified as spam, mail statistics include which FortiMail feature classified the email as spam, such as Bayesian antispam databases, access control rules, the system-wide black list, or email user-configured black lists.
For email not classified as spam by any antispam scan, mail statistics label it as
Not Spam.
In addition to viewing overall trends via the graph, you can also view details at each point in time. To view these details, hover your mouse over a bar in the graph. A tool tip will appear next to that point on the graph, including the name of the antispam category, message count, and percentage relative to the overall mail volume at that time.
To use the Mail Statistics tab, you must first configure your FortiMail unit to detect spam
and/or viruses. For more information, see “Profile” on page 285
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing overall system statuses
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view mail statistics, go to Monitor > System Status > Mail Statistics.
Figure 15: Viewing email, spam, and virus statistics
Message Direction Filter the mail statistics by email directions. For details about email directions, see
“Incoming vs. outgoing recipient-based policies” on page 259
.
• All: All the email messages precessed by the FortiMail unit.
• Incoming: Email messages destined to protected domains.
• Outgoing: Email messages destined to unprotected domains.
• Unknown: SMTP connections that are rejected or discarded before the FortiMail unit starts to process the email messages. For example, some connections may be rejected due to sender reputation or sender rate limit. At this stage, the FortiMail unit does not even know the email message’s destination yet. For details about the execution order of
FortiMail antispam techniques, see
“Order of execution” on page 24
.
Click to manually refresh the page, displaying current email statistics.
Refresh
(circular arrows icon on the right side of each section’s title bar)
Setting
(gear icon on the right side of each section’s title bar)
Select the interval, such as 30 seconds, between automatic refreshes of the page. Refreshing the page displays current email statistics.
Viewing the list of current IP sessions
The Sessions tab displays information about the IP connections to and from the FortiMail unit.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the session list, go to Monitor > System Status > Sessions.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
59
Managing the deferred mail queue
Figure 16: Viewing the list of current IP sessions
Monitor
60
(No column heading.)
Protocol
From IP
From Port
To IP
To Port
Expire(secs)
The sort order of the entry in the page. The current sort order varies by which column heading you last clicked.
Note: This number might not be the sequential order of session establishment.
The service protocol of the connection, such as ICMP, UDP, or TCP.
The source IP address of the connection.
The source port number of the connection, which, on a connection initiator, can vary by which sockets are available.
The destination IP address of the connection.
The destination port number of the connection, such as 25 for typical connections to SMTP servers or relays.
If To IP is the IP address of a server or SMTP relay, To Port is often either the server’s listening port number, or a port forward or virtual IP address on a network address translation (NAT) device such as a router or firewall that forwards packets to the server.
The time to live (TTL), in seconds, after which the connection expires and is removed from the list of current sessions. The TTL is extended if additional packets are sent or received for this connection.
Managing the deferred mail queue
The FortiMail unit prioritizes the mail queue into two types:
• Regular mail queue -- When the initial attempt to deliver an email fails, the FortiMail unit moves the email to the regular mail queue.
• Slow mail queue -- After another two failed delivery attempts, the FortiMail unit moves the email to the slow mail queue. This allows the FortiMail unit to resend valid email quickly, instead of keep resending invalid email (for example, email destined to an invalid MTA).
Note: After the undelivered email remains in the deferred queue for five minutes, the mail will be displayed under Monitor > Mail Queue > Mail Queue. This also means that email staying in the deferred queue for less than five minutes are not displayed on the Mail
Queue tab.
Delivery failure can be caused by various temporary reasons such as interruptions to network connectivity, and so FortiMail units will periodically retry delivery. (Administrators can also manually initiate a retry.) If the email is subsequently sent successfully, the
FortiMail unit simply removes the email from the queue. It does not notify the sender. But if delivery continues to be deferred, the FortiMail unit eventually sends an initial delivery status notification (DSN) email message to notify the sender that delivery has not yet succeeded. Finally, if the FortiMail unit cannot send the email message by the end of the
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing the deferred mail queue time limit for delivery retries, the FortiMail unit sends a final DSN to notify the sender about the delivery failure and deletes the email message from the deferred queue. If the sender cannot receive this notification, such as if the sender’s SMTP server is unreachable or if the sender address is invalid or empty, the FortiMail unit will save a copy of the email in the dead mail folder. For more information, see
“Managing undeliverable mail” on page 62 .
For information on configuring the delivery retry interval, maximum amount of time that an
.
When you delete a deferred email, the FortiMail unit will send an email message, with the deleted email attached to it, to notify the sender.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view, delete, or re-attempt to send an email in the deferred mail queue, go to Monitor >
Mail Queue > Mail Queue.
Note: To reduce the amount of hard disk space consumed by quarantined mail, regularly release or delete the contents of each recipient’s quarantine.
Figure 17: Managing the deferred mail queue
Resend
Type
In the check box column, mark the check boxes in the rows corresponding to the email messages that you want to immediately retry to send, then click Resend.
To determine if these retries succeeded, click Refresh. If a retry succeeds, the email will no longer appear in either the deferred mail queue or the dead mail folder. Otherwise, the retry has failed.
Select the directionality and priority level of email to filter the mail queue display.
For details about email directionality, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
• Default: Displays all the email in the regular mail queue.
• Incoming: Only displays the incoming email in the regular mail queue.
• Outgoing: Only displays the outgoing email in the regular mail queue.
• Default-slow: Displays all the email in the slow mail queue.
• Incoming-slow: Displays the incoming email in the slow mail queue.
• Outgoing-slow: Displays the outgoing email in the slow mail queue.
Search...
Select to filter the mail queue display by entering criteria that email must match in order to be visible.
The index number of the entry on the page.
(No column heading.)
(Check box in column heading.)
To select all email messages in the queue, mark the check box in the column heading.
To select individual email messages in the queue, mark the check box in each row corresponding to the email that you want to delete or retry to send.
Session ID The Session-Id: message header of the email.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
61
Managing the deferred mail queue Monitor
Envelope From The sender (MAIL FROM:) of the email.
Envelope To
Reason
The recipient (RCPT TO:) of the email.
The reasons why the email has been deferred, such as DNS lookup failure or refused connections.
First Processed The date and time that the FortiMail unit first tried to send the email.
Last Processed The date and time that the FortiMail unit last tried to send the email.
Tries The number of times that the FortiMail unit has tried to send the email.
Managing undeliverable mail
The Dead Mail tab displays the list of email messages that are in the dead mail folder.
Unlike the deferred mail queue, the dead mail folder contains copies of delivery status notification (DSN) email messages, also called non-delivery reports (NDR).
DSN are sent from the FortiMail unit ("postmaster") to an email’s sender when the email is considered to be more permanently undeliverable because all previous retry attempts of the deferred email message have failed. These email messages from
"postmaster" include a copy of the original email message for which the DSN was generated.
If an email cannot be sent nor a DSN returned to the sender, it is usually because both the recipient and sender addresses are invalid. Such email messages are often sent by spammers who know the domain name of an SMTP server but not the names of its email users, and are attempting to send spam by guessing at valid recipient email addresses.
The FortiMail unit can automatically delete old dead mail. For details, see
“The number of days a dead mail is to be kept” on page 204 .
Tip: Alternatively, you can:
• to prevent dead mail to invalid recipients, enable recipient address verification, rejecting email with invalid recipients. Rejecting email with invalid recipients also prevents quarantine mailboxes for invalid recipients from consuming hard disk space. For details, see
Address Verification” on page 217
.
• to forward dead mail to a valid recipient’s mailbox, if the FortiMail unit is operating in server mode, create a local email account named "postmaster" to receive these email messages, or create an alias named "postmaster" to an existing email account, instead
and
“Configuring aliases” on page 252
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view or delete undeliverable email, go to Monitor > Mail Queue > Dead Mail.
Figure 18: Managing undeliverable email
62
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing the quarantines
Delete In the check box column, mark the check boxes in the rows corresponding to the email messages that you want to delete, then click Delete.
(No column heading.) The index number of the entry on the page.
(Check box in column heading.)
To select all email messages in the dead mail folder, mark the check box in the column heading.
To select individual email messages in the dead mail folder, mark the check box in each row corresponding to the email that you want to select.
From
To
Subject
Date
The sender (MAIL FROM:) of the email.
The recipient (RCPT TO:) of the email.
The subject line of the email.
The date and time of the email.
Managing the quarantines
You can quarantine email messages based upon the content of the email messages, such as whether the email is spam or contains a prohibited word or phrase. FortiMail units have two types of quarantine:
• Personal quarantine: Quarantines email messages into separate folders for each recipient address in each protected domain. The FortiMail periodically sends quarantine reports to notify recipients, their designated group owner, and/or another email address of the email messages that have been added to the quarantine folder for that recipient. See
“Managing the personal quarantines” on page 63 .
• System quarantine: Quarantines email messages into a system-wide quarantine.
Unlike the per-recipient quarantine, the FortiMail unit does not send a quarantine report and a FortiMail administrator should review the quarantined email messages to decide if they should be released or deleted. See
“Managing the system quarantine” on page 69 .
To quarantine spam and/or email with prohibited content, you must select a quarantine
and
“Configuring content profiles and content action profiles” on page 318
.
All FortiMail models can be configured to remotely store their quarantined email messages in a centralized quarantine hosted on a FortiMail-2000 model or greater. For
more information, see “Selecting the mail data storage location” on page 208 .
Managing the personal quarantines
The Personal Quarantine tab displays a list of personal quarantines, also called perrecipient quarantines.
When incoming email matches a policy in whose profile you have configured the FortiMail unit to quarantine the email to the personal quarantine, the FortiMail unit will save the email to its hard drive and not deliver it to the recipient. Instead, the FortiMail unit will periodically send a quarantine report to email users, their designated group owner, or another recipient (if you have configured one using the advanced mode of the web-based manager).
The quarantine report, by default sent once a day at 9 AM, lists all email messages that were withheld since the previous quarantine report. Using the quarantine report, email users can review email message details and release any email messages that are false positives by clicking the link associated with them. The email message will then be released from the quarantine and delivered to the email user’s inbox. Using the web-
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
63
Managing the quarantines Monitor based manager, FortiMail administrators can also manually release or delete quarantined email. For more information on deleting email that has been quarantined to the per-
recipient quarantine, see “Managing the personal quarantines” on page 63
. For information on configuring the schedule and recipients of the quarantine report, see
“Configuring global quarantine report settings” on page 380
.
You can configure the FortiMail unit to send email to the per-recipient quarantine by selecting Quarantine in action profiles, content profiles and antispam profiles. For more information, see
“Configuring antispam action profiles” on page 312
and
“Configuring content profiles” on page 318 .
Unlike the system-wide quarantine, the per-recipient quarantine can be accessed remotely by email users so that they can manage their own quarantined email. For
.
Note: To reduce the amount of hard disk space consumed by quarantined mail, regularly release or delete the contents of each recipient’s quarantine.
Note: Email users can also manage their own per-recipient quarantines through quarantine reports. For more information, see
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read-Write permission to the Quarantine category. For details,
see “About administrator account permissions & domains” on page 144
.
To view the list of per-recipient quarantine folders for a protected domain
1 Go to Monitor > Quarantine > Personal Quarantine.
2 Select the name of a protected domain from Domain.
Figure 19: Viewing the list of personal quarantines
64
Delete
Compact
In the check box column, mark the check boxes in the rows corresponding to the quarantine folders that you want to delete, then click Delete.
Caution: Per-recipient quarantine folders contain both the email user’s recipient quarantine and other data such as the email user’s preferences and personal white lists and black lists. Deleting a quarantine folder will delete contained spam, but will also delete that other personal data. To avoid this, delete email inside the quarantine folder, but not the quarantine folder itself. For more information, see
“Managing the personal quarantines” on page 63
.
In the check box column, mark the check boxes in the rows corresponding to the quarantine folders that you want to compact, then click Compact.
For performance reasons, when you delete an email, it is marked for deletion but not actually removed from the hard disk at that time, and so still consumes some disk space. Compaction reclaims this hard disk space.
Note: Folder sizes are updated once an hour. The reduction in folder size will not be immediately reflected after you compact a folder.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing the quarantines
Send quarantine report to...
Search
(button)
Search
(followed by dropdown list and text box)
Either:
• to send a quarantine report for all personal quarantines in the selected domain, mark the check box in the check box column heading
• to send a quarantine report for some personal quarantines in the selected domain, in the check box column, mark the check boxes of each personal quarantine for which you want to send a quarantine report then click this button, and into For past hours enter the number of previous hours’ worth of spam to include in the quarantine report.
To periodically send quarantine reports, configure a quarantine report schedule.
For more information, see “Configuring global quarantine report settings” on page 380 and
“Quarantine Report Setting” on page 222 .
Note: The quarantine report is sent to the recipient email address configured in
“Configuring global quarantine report settings” on page 380
or
“Quarantine Report Setting” on page 222
, which might not be the same as the name of the personal quarantine mailbox. For example, you could configure [email protected] to be the recipient of all quarantine reports for the protected domain example.com.
Click to create a search filter that will be used to search email in the per-
To filter the display of the per-recipient quarantines, from the drop-down list, select how you want entries to match your filter criteria (such as Regular
Expression), then in the text box, enter your filter criteria (such as user.*\@example\.com), then press Enter.
Mailboxes not matching your filter criteria will be hidden.
To show all mailboxes for the selected domain again, delete your filter criteria, then press Enter.
Domain Select the name of a protected domain to view per-recipient quarantines for recipients in that protected domain.
For more information on protected domains, see
“Configuring protected domains” on page 211
.
The index number of the entry in the list.
(No column heading.)
(Check box in column heading.)
Mailbox
Size
To select all quarantine folders, mark the check box in the check box column heading.
To select some quarantine folders, in the check box column, mark the check box in the rows of each quarantine folder that you want to select.
The recipient email address for which the FortiMail unit has quarantined email into a personal quarantine mailbox.
To view email in a personal quarantine, double-click the row of that mailbox. To return to the list of personal quarantines for the selected domain, click Back.
Note: The name in Mailbox might not match the email address as it appears on the protected SMTP server if, for example, you have configured address mappings, aliases, or recipient address rewriting on the FortiMail unit or at other points during the email processing stream. To locate the personal quarantine for an email user or alias, search for the recipient email address exactly as it appears when an email to that individual or group passes through the FortiMail unit, before any subsequent redirection.
The size of the quarantine folder in kilobytes (KB).
Note: Folder sizes are updated once an hour.
You can view, delete, and release email that has been quarantined to each personal quarantine mailbox.
Note: To reduce the amount of hard disk space consumed by quarantined mail, regularly release or delete the contents of each recipient’s quarantine.
Note: Email users can also manage their own per-recipient quarantines through quarantine reports. For more information, see
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
65
Managing the quarantines
To view email messages that are inside a personal quarantine mailbox
1 Go to Monitor > Quarantine > Personal Quarantine.
2 Double-click the row corresponding to that mailbox.
3 To view one of the email in the mailbox, double-click it.
Figure 20: Viewing a mailbox in a personal quarantine
Monitor
(No column heading.) The index number of the email message.
To view the email message, double-click it. A pop-up window appears which displays the email message. If the message body and subject line are not sufficient to help you decide whether you want to release or delete the email, you can click the Detailed Header link to view additional message headers.
(Check box in column heading.)
View
Delete
Release
Back
From
Subject
Date
To select all email in the personal quarantine, mark the check box in the check box column heading.
To select some email in the personal quarantine, in the check box column, mark the check box in the rows of each quarantine folder that you want to select.
Mark the check box in the row corresponding to the email that you want to view, then click this button to display it.
To delete all email in the current view, mark the check box in the check box column heading, then click Delete.
To delete individual email messages, mark check boxes in the rows of the email messages you want to delete, then click Delete.
To release all email messages in the quarantine for this recipient, mark the check box in the check box column heading, then click Release.
To release individual email messages in the quarantine for this recipient, mark check boxes in the rows of the email messages that you want to release, then click Release.
In the popup window, you can select to release email to the original recipient and/or to other recipients. If want to release email to other recipient, enter the email address. You can add up to five email addresses.
Click to return to the list of personal quarantine mailboxes for the selected protected domain.
The display name of the sender, such as "User 1".
The subject line of the email.
The date and time of that the email was sent.
Received
Envelope From
The date and time that the email was quarantined.
The email address of the sender as it appears in the message envelope
(MAIL FROM:), such as [email protected].
66
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor
Figure 21: Viewing an email message in a personal quarantine mailbox
Managing the quarantines
How to enable, configure, and use per-recipient quarantines
In general, to use per-recipient quarantines, you should complete the following:
1 Configure the host name and local domain name of the FortiMail unit. For details, see
“Configuring the host name, port numbers, relay, mail queue, & DSN” on page 199 .
For information on how to configure DNS records to support your FortiMail unit’s local domain and fully qualified domain name (FQDN), see the FortiMail Install Guide .
If you want to specify an alternate FQDN that will be used only by web release/delete
2 Select the recipients, delivery schedule, and release methods of the quarantine report, which lists recent additions to the per-recipient quarantine. For details, see
“Configuring protected domains” on page 211 for quarantine report settings that are
domain-specific, or
“Configuring global quarantine report settings” on page 380 for
quarantine report settings that are system-wide.
3 If email users will release/delete email from their quarantine by sending email, configure the user name portion (also known as the local-part) for the quarantine control email addresses. (The domain-part will be the local domain name of the
FortiMail unit.) For details, see “Configuring the quarantine control accounts” on page 389 .
4 For gateway mode or transparent mode, configure authentication profiles that will allow email users to authenticate when accessing their per-recipient quarantine.
Alternatively, if email users require only HTTP/HTTPS access, you may configure PKI user accounts.
For server mode, configure the email user accounts. Email users will be able to authenticate using this account to access their per-recipient quarantine.
For details, see
“How to enable & configure authentication of email users” on page 332 .
Note: You can allow unauthenticated HTTP/HTTPS access to the per-recipient quarantine
during a limited period following the sending of the quarantine report. For details, see “Time
Limited Access Without Authentication” on page 381 and “Expiry Period” on page 381
.
5 Enable quarantine reports in each email user’s preferences. Both FortiMail
, or the online help for FortiMail webmail and per-recipient quarantines.
6 If the FortiMail unit is operating in server mode and you want to enable web
release/delete, configure resource profiles in which “Webmail access”
is enabled.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
67
Managing the quarantines Monitor
7 Enable the Quarantine and Send quarantine report option in incoming antispam and/or
content profiles. If you want to allow email users to release and/or delete email from
their quarantine by email or web release/delete, also enable Email release and Web
For details, see “Configuring antispam action profiles” on page 312
and/or
“Configuring content action profiles” on page 326 .
8 Select the antispam and/or content profiles in incoming recipient-based policies. If you configured a resource profile in step
, also select the resource profile.
If the FortiMail unit is operating in gateway mode or transparent mode and you want to
enable web release/delete, enable Allow quarantined email access through webmail in
each incoming recipient-based policy.
For details, see
“Controlling email based upon the recipient” on page 272
.
9 Either email users or FortiMail administrators can manage email in the per-recipient quarantines. For details, see
“Managing the personal quarantines” on page 63 and
.
Searching email in the per-recipient quarantine
You can search the per-recipient quarantine for email messages based on their contents, senders, recipients, and time frames, across any or all protected domains.
The search action involves the following steps:
• First, create a search task, where you can specify search criteria.
• Second, view the search results.
See below for detailed instructions.
Figure 22: Searching a personal quarantine
68
To search the per-recipient quarantine
1 Go to Monitor > Quarantine > Personal Quarantine.
2 Click the Search... button. A new tab called Personal Quarantine Search appears, displaying all the search tasks if there is any.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing the quarantines
3 Click New to add a search task.
4 Configure one or more of the following search criteria.
Email messages must match all criteria that you configure in order to be included in the search results. For example, if you configure From and Subject, only email messages matching both From and Subject will be included in the search results.
From
To
Cc
Subject
Text
Time
User
Domain
Enter the email address of the sender.
Enter the email address of the recipient.
Enter the carbon copy email addresses.
Enter the subject line.
Enter text that appears on the message body.
Select the range of time of email messages that you want to include in the search results.
Enter the user name portion (also known as the local-part) of recipient email addresses whose quarantine folders you want to search.
To select which protected domains’ per-recipient quarantines will be searched, in the text area on the left, select the names of one or more protected domains, then click the right arrow to move them into the text area on the right.
You must select at least one protected domain to search.
5 Click Create to execute and save the task. The task name is the time when the task is created. The Personal Quarantine Search tab displays the search tasks and their search status as follows:
• Done -- the FortiMail unit has finished the search. You can click the View Search
Result button to view the search results.
• Pending -- the search task is in the waiting list.
• Running -- the search task is still running. You can choose to stop the task by clicking the Stop button.
• Stopped -- the search task is stopped. You can choose to resume the task by clicking the Resume button.
Managing the system quarantine
The System Quarantine tab displays the system quarantine.
Unlike the per-recipient quarantine, the system quarantine cannot be accessed remotely by email users; they will not receive quarantine reports for email held in the system quarantine, and cannot manage the system quarantine themselves. A FortiMail administrator should therefore periodically review the contents of the system quarantine.
Alternatively, you can configure a special-purpose system quarantine administrator for this
task. For more information, see “Configuring the system quarantine administrator account
Note: To reduce the amount of hard disk space consumed by the system quarantine, regularly release or delete items from the system quarantine.
By default, the system quarantine is not used, until you configure the FortiMail unit to send per-recipient quarantine to system quarantine by selecting Quarantine to review in content
“Configuring content action profiles” on page 326
.
To be able to access this part of the web-based manager, your administrator account’s:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
69
Managing the quarantines
• Domain must be System
• access profile must have Read-Write permission to the Quarantine category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of system quarantine folders, go to Monitor > Quarantine >
System Quarantine.
Figure 23: Viewing the list of system quarantine mailboxes
Monitor
Compact
(No column heading.)
(Check box in column heading.)
In the Check column, mark the check boxes of each email user whose quarantine folder you want to compact, then click Compact.
For performance reasons, when you delete an email, it is marked for deletion but not actually removed from the hard disk at that time, and so still consumes some disk space. Compaction reclaims this hard disk space.
Note: Folder sizes are updated once an hour. The reduction in folder size will not be immediately reflected after a compact is executed.
The index number of the entry in the list.
Mailbox
Size
To select all quarantine mailboxes in the list, mark the check box in the column heading.
To select some quarantine mailboxes, in each row corresponding to a quarantine folder that you want to select, mark the check box.
The current mailbox is named Inbox. Older system quarantine mailboxes, also called rotated folders, are named according to their creation date and the rename date. For information on configuring rotation of the system quarantine mailbox, see
“Configuring the system quarantine administrator account & disk quota” on page 387 .
To view email messages quarantined in that mailbox, double-click its row. For
more information, see “Managing the system quarantine” on page 69
.
The size of the quarantine folder in kilobytes (KB).
Note: Mailbox sizes are updated once an hour.
You can view, delete, release, and forward email that has been quarantined to the system quarantine.
Note: You can also configure a system quarantine administrator account whose exclusive purpose is to manage the system quarantine. For more information, see
“Configuring the system quarantine administrator account & disk quota” on page 387 .
To view email messages quarantined to the system quarantine, go to Monitor >
Quarantine > System Quarantine, then double-click a system quarantine mailbox.
Figure 24: Viewing email in a system quarantine mailbox
70
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing the quarantines
View
Delete
Release
Back
Search
(Checkbox without column heading.)
Subject
From
To
Rcpt To
Received
Size
Mark the check box in the row corresponding to the email that you want to view, then click this button to display it.
To delete all email in the current view, mark the check box in the check box column heading, then click Delete.
To delete individual email messages, mark check boxes in the rows of the email messages you want to delete, then click Delete.
To release all email messages in the current view, mark the check box in the check box column heading, then click Release.
To release individual email messages, mark check boxes in the rows of the email messages that you want to release, then click Release.
In the popup window, you can select to release email to the original recipient and/or to other recipients. If want to release email to other recipients, enter the email addresses. You can add up to five email addresses.
Click to return to viewing the list of system quarantine folders.
Click to search the system quarantine folder that you are currently viewing.
For details, see “Searching email in the system quarantine” on page 72
.
To select all email messages in the folder, mark the checkbox located in the checkbox column heading. This automatically marks all other checkboxes.
To select individual email messages in the folder, mark checkboxes in the row of each email message.
The subject line of the email.
Click to display the email message. For details, see “To display, release, delete, or forward an email in the system quarantine” on page 71 .
The display name of the sender as it appears in the message header, such as "User 1".
The display name of the recipient as it appears in the message header, such as "User 2".
The user name portion (also known as the local-part) of the recipient email address (RCPT TO:) as it appears in the message envelope, such as user2 where the full recipient email address is [email protected].
The time that the email was quarantined.
The size of the email message in kilobytes (KB).
To display, release, delete, or forward an email in the system quarantine
1 Go to Monitor > Quarantine > System Quarantine.
2 Double-click the row of a system quarantine folder.
3 Double-click the email message.
The email message appears, including basic message headers such as the subject and date.
Figure 25: Viewing an email message in the system quarantine
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
71
Managing the quarantines Monitor
4 Select the action that you want to perform on the quarantined email.
• To view additional message headers, click the + button, then click Detailed Header.
• To release the email message to its recipient, click Release.
• To delete the email message from the quarantine, click Delete.
Searching email in the system quarantine
You can search a system quarantine folder for email messages based on their message body content and message headers.
To search the per-recipient quarantine
1 Go to Monitor > Quarantine > System Quarantine.
2 Double-click a system quarantine folder.
The search will examine only email that is within the folder that you select.
3 Click Search.
4 Configure one or more of the following search criteria.
Email messages must match all criteria that you configure in order to be included in the search results. For example, if you configure From: and Subject:, only email messages matching both From: and Subject: will be included in the search results.
Figure 26: Searching the system quarantine
72
From
To
CC
Enter either or both the display name and sender email address as it appears in the message header (From:), such as:
User 1 <[email protected]>
Enter either or both the display name and recipient email address as it appears in the message header (To:), such as:
User 2 <[email protected]>
Enter carbon copy email addresses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing the greylist statuses
Subject
Text
From
(date selector)
To
(date selector)
Enter all or part of the text contained in the subject line.
Enter all or part of the text contained in the message body.
Enter the beginning of the range of email message dates to include in the search results.
Enter the end of the range of email message dates to include in the search results.
5 Click Apply.
The FortiMail unit executes the search, and displays a list of email messages in the system quarantine that match the search criteria.
Viewing the greylist statuses
The Greylist submenu enables you to monitor automatic greylisting exemptions, and email currently experiencing temporary failure of delivery due to greylisting.
Greylisting exploits the tendency of legitimate email servers to retry email delivery after an initial temporary failure, while spammers will typically abandon further delivery attempts to maximize spam throughput. The greylist scanner replies with a temporary failure for all email messages whose combination of sender email address, recipient email address, and SMTP client IP address is unknown. If an SMTP server retries to send the email message after the required greylist delay but before expiry, the FortiMail unit accepts the email and adds the combination of sender email address, recipient email address, and
SMTP client IP address to the list of those known by the greylist scanner. Subsequent
“known” email messages are accepted. For details on the greylisting mechanism, see
“About greylisting” on page 401
.
To use greylisting, you must enable the greylist scan in the antispam profile. For more information, see
“Configuring antispam profiles” on page 297
.
Note: Enabling greylisting can improve performance by blocking most spam before it undergoes other, more resource-intensive antispam scans.
Note: Greylisting is bypassed if the SMTP client establishes an authenticated session (see
“Bypass scan on SMTP authentication” on page 324
,
“Controlling email based upon the recipient” on page 272
, and “Controlling email based upon IP addresses” on page 278 ), or if
the matching access control rule’s Action is RELAY (see “Order of execution” on page 24
).
You can configure the initial delay associated with greylisting, and manually exempt senders. For details, see
“Configuring the grey list TTL & initial delay” on page 404
and
“Manually exempting senders from greylisting” on page 405 .
Viewing the pending & individual automatic greylist entries
The Display tab enables you to view pending and individual automatic greylist entries.
• Pending greylist entries are those whose Status is not PASSTHROUGH. For email messages matching pending greylist entries, the FortiMail unit will reply to delivery attempts with a temporary failure code until the greylist delay period, indicated by Time
to passthrough, has elapsed.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
73
Viewing the greylist statuses Monitor
• Individual greylist entries are those whose Status is PASSTHROUGH. For email messages matching pending greylist entries, the greylist scanner will allow the delivery attempt, and may create a consolidated automatic greylist entry. For information on consolidated entries, see
“Viewing the consolidated automatic greylist exemptions” on page 75 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the greylist, go to Monitor > Greylist > Display.
Figure 27: Viewing the list of pending and individual greylist entries
Search
IP
Sender
The IP address of the SMTP client that delivered or attempted to deliver the email message.
If the displayed entries are currently restricted by a search filter, a filter icon appears in the column heading. To remove the search filter, click the tab to refresh the display.
The sender email address in the message envelope (MAIL FROM:), such as [email protected].
If the displayed entries are currently restricted by a search filter, a filter icon appears in the column heading. To remove the search filter, click the tab to refresh the display.
Recipient The recipient email address in the message envelope (RCPT TO:), such as [email protected].
If the displayed entries are currently restricted by a search filter, a filter icon appears in the column heading. To remove the search filter, click the tab to refresh the display.
Status The current action of the greylist scanner when the FortiMail unit receives a delivery attempt for an email message matching the entry.
• TEMPFAIL: The greylisting delay period has not yet elapsed, and the
FortiMail unit currently replies to delivery attempts with a temporary failure code. For information on configuring the greylist delay period, see
“Configuring the grey list TTL & initial delay” on page 404 .
• PASSTHROUGH: The greylisting delay period has elapsed, and the greylist scanner will allow delivery attempts.
Time to passthrough The time and date when the greylisting delay period for a pending entry is scheduled to elapse. Delivery attempts after this date and time confirm the pending greylist entry, and the greylist scanner converts it to an individual automatic greylist entry. If may also consolidate individual greylist entries.
.
N/A appears if the greylisting period has already elapsed.
Expire The time and date when the entry will expire, determined by adding the TTL value to the time the last matching message was received. For information
on configuring the TTL, see “Configuring the grey list TTL & initial delay” on page 404
.
74
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing the greylist statuses
Filtering pending and individual automatic greylist entries
You can filter the greylist entries that appear on the Display tab based upon sender email address, recipient email address, and/or the IP address of the SMTP client.
To filter entries
1 Go to Monitor > Greylist > Display.
2 Click Search.
3 Configure one or more of the following. Use an asterisk (*) to match multiple patterns, such as typing user* to match [email protected], [email protected], and so forth. Blank fields match any value. Regular expressions are not supported.
Figure 28: Filtering pending and individual automatic greylist entries
Field
Operation
Case Sensitive
Value
Select one of the following columns in the greylist entries that you want to use to filter the display.
• IP
• Sender
• Recipient
Select how the column’s contents will be matched, such as whether the row must contain the Value.
Enable for case-sensitive filtering.
Enter a pattern or exact value, based upon your selection in Field and
Operation.
• IP: Enter the IP address of the SMTP client, such as 172.16.1.10.
• Sender: Enter the complete sender email address in the message envelope (MAIL FROM:), such as [email protected].
• Recipient: Enter the complete recipient email address in the message envelope (RCPT TO:), such as [email protected].
4 Click Search.
The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.
Viewing the consolidated automatic greylist exemptions
The Auto Exempt tab displays consolidated automatic greylist entries.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
75
Viewing the sender reputation statuses Monitor
Consolidated greylist entries are created from individual automatic greylist entries that meet consolidation requirements. For more information on individual automatic greylist entries, see
“Viewing the pending & individual automatic greylist entries” on page 73
. For
more information on consolidation requirements, see “Automatic greylist entries” on page 403
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of consolidated entries, go to Monitor > Greylist > Auto Exempt.
Search
IP
Sender
Expire
Click to filter the displayed entries.
The /24 subnet of the IP address of the SMTP client that delivered or attempted to deliver the email message.
If the displayed entries are currently restricted by a search filter, a filter icon appears in the column heading. To remove the search filter, click the tab to refresh the display.
The domain name portion of the sender email address in the message envelope (MAIL FROM:), such as example.com.
If the displayed entries are currently restricted by a search filter, a filter icon appears in the column heading. To remove the search filter, click the tab to refresh the display.
The time and date when the entry will expire, determined by adding the TTL value to the time the last matching message was received. For information
on configuring the TTL, see “Configuring the grey list TTL & initial delay” on page 404
.
Viewing the sender reputation statuses
The FortiMail unit tracks SMTP client behavior, limiting deliveries of those clients sending excessive spam messages, infected email, or messages to invalid recipients. Should clients continue delivering these types of messages, their connection attempts will be temporarily or permanently rejected. Sender reputation is managed by the FortiMail unit and requires no administration.
Monitor > Sender Reputation > Display displays the sender reputation score for each
SMTP client.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
For more information on enabling sender reputation and configuring the score thresholds,
see “Configuring session profiles” on page 285 .
To view the sender reputation scores, go to Monitor > Sender Reputation > Display.
Figure 29: Viewing the sender reputation statuses
76
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing the sender reputation statuses
Search
(No column heading.)
IP
Score
State
.
The index number of the entry in the list.
The IP address of the SMTP client.
The SMTP client’s current sender reputation score.
The action that the sender reputation feature is currently performing for delivery attempts from the SMTP client.
• Score controlled: The action is determined by comparing the current Score to the thresholds in the session profile.
• Throttled: The volume of email accepted from the SMTP client will be limited to the larger of the two throttle limits configured in the session profile.
• Blacklisted: Delivery attempts will be rejected regardless of the sender reputation score. Last Modified will not be updated, and the entry is deleted
12 hours after the last successful delivery attempt prior to the selection of the option. A subsequent delivery attempt after the entry is deleted will create a new entry with default settings.
• Whitelisted: Delivery attempts will be accepted regardless of the sender reputation score. Last Modified will not be updated, and the entry will be deleted 12 hours after the last successful delivery attempt prior to the selection of this option. A subsequent delivery attempt after the entry is deleted will create a new entry with default settings.
By default, this action is Score controlled.
Last Modified The time and date the sender reputation score was most recently modified. The sender reputation score will not be updated while State is Blacklisted or
Whitelisted.
Sender reputation is a predominantly automatic antispam feature, requiring little or no maintenance. For each connecting SMTP client (sometimes called a sender), the sender reputation feature records the IP address and:
• the total number of email messages delivered
• the number of email messages detected as spam
• the number of email messages infected with viruses
• the total number of recipients
• the number of invalid recipients
The sender reputation feature calculates the sender’s current reputation score using those statistics, and performs an action based upon that score.
To determine the sender’s reputation score, FortiMail units primarily use two ratios:
• the ratio of “good” email to the number of “bad” email (such as spam or email with viruses)
• the ratio of the total number of recipients to the number of “bad” recipients
The sender reputation score is calculated using statistics up to 12 hours old, with more recent statistics influencing the score more than older statistics. The sender reputation score decreases (improves) as time passes where the sender has not sent spam. The score itself ranges from 0 to 100, with 0 representing a completely acceptable sender, and
100 being a totally unacceptable sender.
After the score is calculated, to determine which action that the FortiMail unit will perform, the sender reputation score is compared to the three score thresholds which you configure in the session profile:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
77
Viewing the sender reputation statuses Monitor
1 Throttle: For scores less than this threshold, the sender is allowed to deliver email without restrictions. For scores greater than this threshold but less than the temporary fail threshold, the sender is rate-limited in the number of email messages that they can deliver per hour, expressed as either an absolute number or as a percentage of the number sent during the previous hour. If the sender exceeds the limit and keeps sending email, the FortiMail unit will send temporary failure codes to the sender. See below descriptions for “Temporary fail”.
2 Temporarily fail: For scores greater than this threshold but less than the reject threshold, the FortiMail unit will reply to the sender with a temporary failure code, delaying delivery and requiring the sender to retry later when their score is reduced.
3 Reject: For scores greater than this threshold, the FortiMail unit will reply to the sender with a rejection code.
If the SMTP client does not attempt any email deliveries for more than 12 hours, the
SMTP client’s sender reputation entry is deleted, and a subsequent delivery attempt is regarded as a new SMTP client by the sender reputation feature.
Note: Although sender reputation entries are used for only 12 hours after last delivery attempt, the entry may still appear in list of sender reputation scores.
Filtering sender reputation score entries
You can filter sender reputation score entries that appear on the Display tab based upon the IP address of the SMTP client, the score, state, and date/time of the last score modification.
To filter entries
1 Go to Monitor > Sender Reputation > Display.
2 Click Search.
3 Configure one or more of the following.Blank fields match any value. Regular expressions and wild cards are not supported.
Figure 30: Filtering sender reputation score entries
78
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing the endpoint reputation statuses
Field
Operation
Case Sensitive
Value
Select one of the following columns in the entries that you want to use to filter the display.
• IP
• Score
• State
• Last Modified
Select how the column’s contents will be matched, such as whether the row must contain the Value.
Enable for case-sensitive filtering.
Enter a pattern or exact value, based upon your selection in Field and
Operation.
• IP: Enter the IP address of the SMTP client, such as 172.16.1.10, for the entry that you want to display.
• Score: Enter the minimum and maximum of the range of scores of entries that you want to display.
• State: Select the State of entries that you want to display.
• Last modified: Select the year, month, day, and/or hour before or after the Last Modified value of entries that you want to display.
4 Click Search.
The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.
Viewing the endpoint reputation statuses
The Auto Blacklist tab displays the current list of carrier end points (by their MSISDN, subscriber ID, or other identifier) that have been automatically blacklisted based upon their endpoint reputation score.
If a carrier end point has attempted to deliver during the automatic blacklisting window a number of spam text messages or email messages greater than the automatic endpoint blacklisting threshold, FortiMail unit adds the carrier end point to the automatic endpoint blacklist for the duration configured in the session profile. While the carrier end point is on the automatic blacklist, all text messages or email messages from it will be rejected. For
reputation scan and configuring the automatic blacklist threshold in a session profile, see
“Configuring session profiles” on page 285
.
Note: You can alternatively blacklist MSISDNs/subscriber IDs manually. For more
information, see “Manually blacklisting endpoints” on page 414 .
Note: You can exempt MSISDNs/subscriber IDs from automatic blacklisting. For more
information, see “Exempting endpoints from endpoint reputation” on page 416
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Black/White List category
For details, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
79
Viewing the endpoint reputation statuses Monitor
To view the automatic endpoint reputation blacklist, go to Monitor > Endpoint Reputation >
Auto Blacklist.
Search
Move
(Checkbox column without column label.)
Endpoint ID
Score
Expire
Click to filter the displayed entries. For more information, see
“Filtering automatic endpoint black list entries” on page 80
.
To move entries to the manual endpoint black list or white list, in the check box column, mark the check boxes of entries that you want to move, then click Move.
To select all entries, mark the checkbox in the column heading.
To select individual entries, in each row corresponding to an entry that you want to select, mark the check box.
The mobile subscriber IDSN (MSISDN), subscriber ID, login ID, or other unique identifier for the carrier end point.
The number of text messages or email messages that the FortiMail has detected as spam or infected from the MSISDN/subscriber ID during the automatic endpoint blacklist window.
The time at which the automatic endpoint blacklisting entry expires and is removed from the list.
N/A appears if the automatic endpoint blacklisting duration configured in the session profile is zero (0), and therefore the whether or not the MSISDN is blacklisted at that instant in time depends purely on the number of spam text messages or email messages sent during the current automatic blacklisting window.
Filtering automatic endpoint black list entries
You can filter automatic endpoint blacklist entries that appear on the Auto Blacklist tab based upon the MSISDN, subscriber ID, or other identifier of the sender.
To filter entries
1 Go to Monitor > Endpoint Reputation > Auto Blacklist.
2 Click Search.
3 Configure the following:
Figure 31: Filtering automatic endpoint black list entries
80
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Managing archived email
4 Click Search.
The Auto Blacklist tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the
Auto Blacklist tab to refresh its view.
Managing archived email
Once email messages are archived, you can view and search them through the webbased manager, and through IMAP or POP3 using the email archiving administrator account. You can also download them, forward them to an email address, and use them to train the Bayesian databases.
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view archived email
1 Go to Monitor > Archive > Email Archives.
2 Double-click the name of the email archive mailbox that you want to view.
A list of archived email appears.
Figure 32: Managing archived email
Send
Export
Train bayesian database
Back
In the check box column, mark the check box of each email that you want to send the selected messages to an email address as a mailbox (.mbox) file, then click this button.
In the check box column, select email that you want to download, select
Mark, then click Export to download a mailbox (.mbox) file or an archive
(.tar.gz) file containing individual email (.eml) files.
In the check box column, mark the check box of each email that you want to use the selected messages to train the Bayesian database(s), then click this button. For more information, see “To train Bayesian databases with archived mail” on page 81 .
Click to return to the list of archive mailboxes.
To train Bayesian databases with archived mail
1 Go to Monitor > Archive > Email Archives.
2 Double-click the name of the email archive mailbox that you want to use to train the
Bayesian databases.
3 In the check box column, mark the check box of each email that you want to use to train the Bayesian databases. If you are using all the messages for training, select the check box above the first message to mark the check boxes of all email on the current page.
4 Click Train Bayesian Database.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
81
Managing archived email
Figure 33: Training a Bayesian database using archived email
Monitor
82
5 Select whether to use the messages as spam or non-spam (“innocent”) email.
6 Select the database you want to train: global, per-domain (“group”), or personal.
• Global requires no further information.
• For per-domain database training, select the domain.
• For personal database training, select the domain in Group database, then select the name of the user.
7 Click Apply.
Searching the archived email
You can search the email archive for email messages based on their contents, senders, recipients, and time frames.
Note: You can search archived email in both the current mailbox and rotated mailboxes, whether email is archived on the local disk or remote host. However, you can view only the archived email in the current mailbox on the local disk.
The search action involves the following steps:
• First, create a search task, where you can specify search criteria.
• Second, view the search results.
See below for detailed instructions.
To search the email archives
1 Go to Monitor > Archive > Email Archives.
2 Click the Search... button. A new tab called Archived Email Search appears, displaying all the search tasks if there is any.
3 Click New to add a search task.
4 Configure one or more of the following search criteria.
Email messages must match all criteria that you configure in order to be included in the search results. For example, if you configure From and Subject, only email messages matching both From and Subject will be included in the search results.
From
To
Cc
Enter the email address of the sender.
Enter the email address of the recipient.
Enter the carbon copy email addresses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing log messages
Subject
Text
Time
Enter the subject line.
Enter text that appears on the message body.
Select the range of time of email messages that you want to include in the search results.
5 Click Create to execute and save the task. The task name is the time when the task is created. The Archived Email Search tab displays the search tasks and their search status as follows:
• Done -- the FortiMail unit has finished the search. You can click the View Search
Result button to view the search results.
• Pending -- the search task is in the waiting list.
• Running -- the search task is still running. You can choose to stop the task by clicking the Stop button.
• Stopped -- the search task is stopped. You can choose to resume the task by clicking the Resume button.
Viewing log messages
The Log submenu displays the lists of locally stored log files. If you have configured the
FortiMail unit to store log messages locally (that is, to the hard disk), you can view the log messages currently stored in each log file.
Note: Logs stored remotely cannot be viewed from the web-based manager of the FortiMail unit. If you require the ability to view logs from the web-based manager, also enable local
storage. For details, see “Configuring logging to the hard disk” on page 439
.
The Log submenu includes the following tabs, one for each log type:
• History: Where you can view the log of sent and undelivered SMTP email messages.
• Event: Where you can view the log of administrator activities and system events.
• AntiSpam: Where you can view the log of email detected as spam.
• AntiVirus: Where you can view the log of email detected as infected by a virus.
Each tab contains a similar display.
The lists of log files are sorted by the time range of the log messages contained in the log file, with the most recent log files appearing near the top of the list.
For example, the current log file would appear at the top of the list, above a rolled log file whose time might range from 2008-05-08 11:59:36 Thu to 2008-05-29 10:44:02
Thu.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of log files, go to Monitor > Log, then click a log type tab, such as History.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
83
Viewing log messages
Figure 34: Viewing the log file list (Antispam tab)
Monitor
84
Download
Search
In the check box column, mark the check box of one log file, click this button, then select which file format to use to download the currently selected log files, either:
• Normal Format: A log file that can be viewed with a plain text editor such as Microsoft Notepad.
• CSV Format: A comma-separated value (.csv) file that can be viewed in a spreadsheet application such as Microsoft Excel or OpenOffice Calc.
• Compressed Format: A plain text log file like Normal Format, except that it is compressed and stored within a .gz archive.
Click to search all log files of this type.
Unlike the search when viewing the contents of an individual log file, this search displays results regardless of which log file contains them. For more information, see
“Searching log messages” on page 88
.
(Check box in column heading.)
To select all log files of this type, mark the check box in the column heading.
To select individual log files of this type, mark the check box in each row corresponding to the email that you want to select.
Start Time The beginning of the log file’s time range.
End Time
Size
The end of the log file’s time range.
The size of the log file in bytes.
To view log messages
1 Go to Monitor > Log.
2 Click the tab corresponding to the type of log file that you want to view (History, Event,
AntiVirus, or AntiSpam).
For more information on log types, see “Log types” on page 437 .
3 In the row corresponding to a log file, to view its contained log messages, either:
• double-click a log file to display the file’s log messages within the web-based manager, or
Tip: To view the current page’s worth of the log messages as an HTML table, right-click and select Export to Table. The table appears in a new tab. To download the table, click and drag to select the whole table, then copy and paste it into a rich text editor such as
Microsoft Word or OpenOffice Writer.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing log messages
• click a row to select its log file, click Download, then select one of the following:
• Normal Format for a log file that can be viewed with a plain text editor such as
Microsoft Notepad
• CSV Format for a comma-separated value (.csv) file that can be viewed in a spreadsheet application such as Microsoft Excel or OpenOffice Calc
• Compressed Format for a plain text log file like Normal Format, except that it is compressed and stored within a .gz archive
Alternatively, to display a set of log messages that may be contained by multiple, separate log files:
• If the log files are of the same type (for example, all antispam logs), in the list of log
files, click Search. For details, see “Searching log messages” on page 88
.
• If the log messages are of different types but all caused by the same email session ID, you can do a cross search to find and display all the correlating log messages. For details, see
“Cross searching log messages” on page 91 .
To focus the web-based manager’s display on specific log messages and fields that
you want to view, see “Customizing the log view” on page 85
.
For descriptions of individual log messages, see the FortiMail Log Message
Reference .
Customizing the log view
Log messages can be displayed in either raw or formatted views.
• Raw view displays log messages exactly as they appear in the plain text log file.
• Formatted view displays log messages in a columnar format. Each log field in a log message appears in its own column, aligned with the same field in other log messages, for rapid visual comparison. When displaying log messages in formatted view, you can customize the log view by hiding, displaying and arranging columns and/or by filtering columns, refining your view to include only those log messages and fields that you want to see.
Log messages are always displayed in columnar format, with one log field per column.
However, when viewing this columnar display, you can also view the log message in raw format by hovering your mouse over the index number of the log message, in the “#” column, as shown in
Figure 35: Viewing log messages
Log message in raw format
Log message in columnar format
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
85
Viewing log messages
86
Monitor
Level
Search
Subtype
(event log only)
Select the severity level that a log message must equal or exceed in order to be displayed.
For more information, see “Log message severity levels” on page 438 .
Click to search the currently displayed log file. For more information, see
“Searching log messages” on page 88 .
Alternatively, if you want to search all log files of that type. For details, see
“Viewing log messages” on page 83 .
Select one of the following subtypes that a log message must match in order to be displayed:
• ALL: Display all log messages, and do not filter out any subtype.
• Configuration: Display only log messages containing subtype=config.
• Admin User: Display only log messages containing subtype=admin.
• Web Mail: Display only log messages containing subtype=webmail.
• System: Display only log messages containing subtype=system.
• HA: Display only log messages containing subtype=ha.
• update: Display only log messages containing subtype=update.
• POP3: Display only log messages containing subtype=pop3.
• IMAP: Display only log messages containing subtype=imap.
• SMTP: Display only log messages containing subtype=smtp.
• OTHERS: Display all lines that have a subtype value that is not any of the above subtypes, from Configuration to SMTP.
This option appears only when displaying the event log. Log subtypes reflect
types selected when enabling logging. For details, see “Log types” on page 437 .
When hovering your mouse cursor over a log message, that row is temporarily highlighted; however, this temporary highlight automatically follows the cursor, and will move to a different row if you move your mouse. To create a row highlight that does not move when you move your mouse, click anywhere in the row of the log message.
For information on individual log messages, see the FortiMail Log Message Reference .
Displaying and arranging log columns
When viewing logs, you can display, hide and re-order columns to display only relevant categories of information in your preferred order.
For most columns, you can also filter data within the columns to include or exclude log messages which contain your specified text in that column. For more information, see
“Searching log messages” on page 88
.
By default, each page’s worth of log messages is listed with the log message with the lowest index number towards the top.
To sort the page’s entries in ascending or descending order
1 Click the column heading by which you want to sort.
The log messages are sorted in ascending order.
2 To sort in descending order, click the column heading again.
Depending on your currently selected theme:
• the column heading may darken in color to indicate which column is being used to sort the page
• a small upwards-or downwards-pointing arrow may appear in the column heading next to its name to indicate the current sort order.
To display or hide columns
1 Go to Monitor > Log.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing log messages
2 Click a log type tab, such as History.
3 Double-click the row corresponding to time period whose log messages you want to view.
4 Position your mouse cursor over a column heading to display the down arrow on its right-hand side, move your cursor over Columns to display the list of available columns, then mark the check boxes of columns that you want to display.
Figure 36: Hiding and showing log columns
Make visible
Make invisible
5 Click Save View.
To change the order of the columns
1 Go to Monitor > Log.
2 Click a log type tab, such as History.
3 Double-click the row corresponding to time period whose log messages you want to view.
4 For each column whose order you want to change, click and drag its column heading to the left or right.
Figure 37: Re-ordering log columns
While dragging the column heading within the heading row, two arrows follow the column, jumping to the nearest border between columns, indicating where the column will be inserted if you release the mouse button at that time.
5 Click Save View.
Using the right-click popup menus
When you right-click on a log message, the following menus appear in the popup window:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
87
Viewing log messages
Figure 38: Using the right-click menus
Monitor
Right-click popup menus
View details
Select all
Clear selection
Export to table
Cross search
View quarantined message
Select this menu to view the log message in a popup window.
Select this menu to select all the log messages in the current page, so that you can export all the messages to a table.
Select this menu to deselect one or multiple log messages.
Select this menu to export the selected log messages to a table format. A new tab named Exported Table appears, displaying the exported information. The table format allows you to copy the information and paste it elsewhere.
Select this menu to search log messages by session ID. For details, see
“Cross searching log messages” on page 91
.
When viewing quarantine logs on the History tab, select this menu to view the quarantined email message. For details about quarantined email, see
“Managing the quarantines” on page 63 .
Searching log messages
You can search the log messages to quickly find specific log messages in a log file, rather than browsing the entire contents of the log file.
Search appearance, like log fields, varies by log type.
Note: Some email processing such as mail routing and subject line tagging modifies the recipient email address, the sender email address, and/or the subject line of an email message. If you are searching for log messages by these attributes, enter your search criteria using text exactly as it appears in the log messages, not in the email message. For example, you might send an email message from [email protected]; however, if you have configured mail routing on the FortiMail unit or other network devices, this address, at the time it was logged by the FortiMail unit, may have been [email protected]. In that case, you would search for [email protected] instead of [email protected].
88
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor
Figure 39: Searching the log messages (history log)
Viewing log messages
Figure 40: Searching the log messages (event log)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
89
Viewing log messages
Figure 41: Searching the log messages (antivirus log)
Monitor
Figure 42: Searching the log messages (antispam log)
90
To search log messages
1 Go to Monitor > Log.
2 Click a log type tab, such as History.
3 To search all log files of that type, click Search.
To search one of the log files, first double-click the name of a log file to display the contents of the log file, then click Search.
4 Enter your search criteria by configuring one or more of the following.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing log messages
Note:
Keyword
Message
Subject
From
To
Session ID
Log ID
Client name
Time
Enter any word or words to search for within the log messages.
For example, you might enter starting daemon to locate all log messages containing that exact phrase in any log field.
Enter all or part of the message log field.
This option does not appear for history log searches.
Enter all or part of the subject line of the email message as it appears in the log message.
This option appears only for history log searches.
Enter all or part of the sender’s email address as it appears in the log message.
This option does not appear for event log searches.
Enter all or part of the recipient’s email address as it appears in the log message.
This option does not appear for event log searches.
Enter all or part of the session ID in the log message.
Enter all or part of the log ID in the log message.
Enter all or part of the domain name or IP address of the SMTP client. For email users connecting to send email, this is usually an IP address rather than a domain name. For SMTP servers connecting to deliver mail, this may often be a domain name.
This option appears only for history log searches.
Select the time span of log messages to include in the search results.
For example, you might want to search only log messages that were recorded during the two weeks and 8 hours previous to the current date. In that case, you would specify the current date, and also specify the size of the span of time (two weeks and 8 hours) before that date.
5 Click Apply.
The FortiMail unit searches your currently selected log file for log messages that match your search criteria, and displays any matching log messages. For example, if you are currently viewing a history log file, the search locates all matching log messages located in that specific history log file.
Cross searching log messages
Since different types of log files records different events/activities, the same SMTP session may be logged in different types of log files.
For example, if the FortiMail units detects a virus in an email messages, this event will be logged in the following types of log files:
• History log -- this is because the history log records the metadata of all the sent and undelivered email messages.
• AntiVirus log -- this is because a virus is detected. The antivirus log has more descriptions of the virus than the history log does.
• Event log -- this is because the FortiMail system’s antivirus process has been started and stopped.
To find and display all the log messages triggered by the same SMTP session, you can use the cross search feature, since all the log messages share the same session ID.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
91
Viewing generated reports
Figure 43: Sample log message cross search results
Monitor
To do a cross-search of the log messages
1 Go to Monitor > Log.
2 When viewing a log message on the History, Even, AntiVirus, or AntiSpam tab, click the Session ID of the log message, or right-click the log message and select Cross
Search from the popup window.
All correlating history, event, antivirus and antispam log messages with the same session ID will appear in a new tab.
Viewing generated reports
The Report tab displays the list of reports that have been generated from the report profiles. You can delete, view, and/or download generated reports
Note: In addition to viewing full reports, you can also view summary email statistics. For
more information, see “Viewing the email statistics” on page 58
.
FortiMail units can generate reports automatically, according to the schedule that you configure in the report profile, or manually, when you select a report profile and click
Generate. For more information, see
“Configuring report profiles & generating reports” on page 442
.
Note: To reduce the amount of hard disk space consumed by reports, regularly download then delete generated reports from the FortiMail unit.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of generated reports, go to Monitor > Report > Report.
Figure 44: Viewing the list of generated reports
92
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing generated reports
(Check box with no column heading.)
Report File Name
To select all reports, mark the check box in the column heading.
To select individual reports, mark the check box in each row corresponding to a report before clicking Delete or Download.
The name of the generated report, and the date and time at which it was generated.
For example, Report 1-2008-03-31-2112 is a report named
“Report 1”, generated on March 31, 2008 at 9:12 PM.
To view an individual section of the report in HTML format, click + next to the report name to expand the list of HTML files that comprise the report, then double-click one of the file names.
The date and time when the FortiMail unit completed the generated report.
The file size of the report in HTML format, in bytes.
Last Access Time
Size
After you have generated a report from a report profile, you can view it in any of its configured file format outputs.
For HTML file format report output, each Query Selection in the report profile, such as
Spam by Recipient, becomes a separate HTML file, such as Spam_Recipient.html.
You can view the report as individual HTML files.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
93
Viewing generated reports
\
Figure 45: Viewing a generated report (HTML file format, Mail by Sender)
Monitor
94
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Monitor Viewing generated reports
To view a generated report
1 Go to Monitor > Report > Report.
2 If you want to view the report in PDF file format, in the row corresponding to the report that you want to view, mark the check box, then click Download and select Download
PDF.
Alternatively, if you want to view the report in HTML file format, you can view all sections of the report together, or you can view report sections individually.
• To view all report sections together, in the row corresponding to the report that you want to view, mark the checkbox in the row corresponding to the report, such as treportprofile-2008-06-27-1039, then click Download and select Download
HTML. Your browser downloads a file with an archive (.tgz.gz) file extension to your management computer. To view the report, first extract the report files from the archive, then open the HTML files in your web browser.
• To view one of the report sections, in the row corresponding to the report that you want to view, click + next to the report name to expand the list of sections, then double-click the file name of the section that you want to view, such as
Spam_Recipient.html. The report appears in a new browser window.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
95
Viewing generated reports Monitor
96
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Backup and restore
Maintenance
The Maintenance menu contains features you will usually use during scheduled maintenance, such as updates, backups, restoration, and centralized administration.
It also can be used to configure FortiGuard Antispam query connectivity.
Note: The Maintenance menu also enables you to install firmware using one of the possible methods. For information on this and other installation methods and preparation, see
“Installing firmware” on page 451
.
This topic includes:
•
•
Configuring centralized administration
•
Configuring FortiGuard updates & FortiGuard Antispam queries
Backup and restore
Before installing FortiMail firmware or making significant configuration changes, it is good practice to back up your FortiMail configuration. Backups enable you to revert to your previous configuration if the new configuration does not function correctly, and to compare changes in configuration.
A complete configuration backup consists of several parts:
• core configuration file (fml.cfg), including the local certificates
• Bayesian databases
• mail queues
• system, per-domain, and per-user black/white list database
• email users’ address books
• images and language files for customized appearance of the web-based manager/webmail
To be able to access those parts of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to all categories
For details, see “About administrator account permissions & domains” on page 144 .
In addition, although they are not part of the configuration, you may want to back up the following data:
• email archives
• log files
• generated report files
• mailboxes (see
“Backing up and restoring the mailboxes” on page 101
or
“Selecting the mail data storage location” on page 208 )
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
97
Backup and restore Maintenance
Tip: Alternatively, if you only want to back up your core configuration file, you can back up
.
To back up the configuration file
1 Go to Maintenance > System > Configuration.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 In the Backup Configuration area, select Local PC, enable System configuration, then click Backup.
Figure 46: Backing up the core configuration file to your management computer
98
Your management computer downloads the configuration file. Time required varies by the size of the file and the speed of your network connection. You can restore the
Note: FortiMail v4.0 configuration backing up to a FortiManager unit is supported in
FortiManager v4.2 and newer releases. See “Backing up your configuration using a
FortiManager unit” on page 100 . Also see
“Configuring centralized administration” on page 109
.
To back up the Bayesian databases
1 Go to Maintenance > AntiSpam > Database Maintenance.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Backup bayesian database.
Your management computer downloads the database file. Time required varies by the size of the file and the speed of your network connection.
To back up the mail queues
1 Go to Maintenance > System > Mail Queue.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Backup Queue.
Your management computer downloads the database file. Time required varies by the size of the file and the speed of your network connection.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Backup and restore
To back up the black/white list database
1 Go to Maintenance > AntiSpam > Black/White List Maintenance.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Backup Black/White List.
Your management computer downloads the database file. Time required varies by the size of the file and the speed of your network connection.
To back up email users’ accounts (server mode only)
1 Go to User > User > User.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Export .CSV.
Your management computer downloads the user account spreadsheet file. Time required varies by the size of the file and the speed of your network connection.
To back up the global address book (server mode only)
1 Go to Mail Settings > Address Book > Address Book.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Export .CSV.
Your management computer downloads the address book spreadsheet file. Time required varies by the size of the file and the speed of your network connection.
To back up email archives
1 Go to Maintenance > System > Mail Data.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Continue using the instructions in
“Backing up and restoring the mailboxes” on page 101 .
To back up customized appearances of the web-based manager/webmail
1 Go to Mail Settings > Settings > Appearance.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 In Administration interface, for each image file, save the image to your management computer.
Methods vary by web browser. For example, you might need to click and drag the images into a folder on your management computer in order to save them to that folder. For instructions, see your browser’s documentation.
3 Click the arrow to expand Webmail interface.
4 For each webmail language, click the name of the language to select it, then click
Download.
Your management computer downloads the language file. Time required varies by the size of the file and the speed of your network connection.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
99
Backup and restore Maintenance
Backing up your configuration using the CLI
If you only want to back up the core configuration file, you can perform this backup using the CLI.
Caution: The core configuration file does not contain all configuration data. Failure to perform a complete backup could result in data loss of items such as Bayesian databases, dictionary databases, mail queues, and other items. For details on performing a complete backup, see
“Backup and restore” on page 97 .
To back up the configuration file using the CLI, enter the following command: execute backup config tftp <filename_str> <tftp_ipv4> where:
• <filename_str> is the name of the file located in the TFTP server’s root directory
• <tftp_ipv4> is the IP address of the TFTP server
Note: For FortiMail v4.0, backing up to a FortiManager unit will be supported in
FortiManager v4.2 and later releases.
Backing up your configuration using a FortiManager unit
You can back up the core configuration file to a FortiManager unit instead of your management computer.
Note: For FortiMail v4.0, this feature is supported in FortiManager v4.2 and newer releases.
Before you can do this, you must first enable and configure centralized administration by a
FortiManager unit. For details, see “Configuring centralized administration” on page 109
.
Figure 47: Backing up the core configuration file to a FortiManager unit
100
To back up the configuration file to a FortiManager unit
Caution: The core configuration file does not contain all configuration data. Failure to perform a complete backup could result in data loss of items such as Bayesian databases, dictionary databases, mail queues, and other items. For details on performing a complete backup, see
“Backup and restore” on page 97 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Backup and restore
1 Go to Maintenance > System > Configuration.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 In the Backup Configuration area, select FortiManager.
This option is available only if you have configured the FortiMail unit to connect to a
FortiManager unit. For details, see
“Configuring centralized administration” on page 109 .
3 Enable System configuration. If you want the configuration backup to include user preferences, click Update to update the backup’s cache of user preferences, then also enable User configuration.
4 In Comments, type a description to identify the configuration backup.
Each entry in the list of configuration file revisions will display the name of the administrator who created the backup, the date and time, and the comment.
5 Click Backup.
When the back up is complete, a message appears to confirm that the operation was successful.
6 Click OK.
Restoring the configuration
In the Restore Configuration area under Maintenance > System > Configuration, you can restore the backup FortiMail configuration from your local PC or a FortiManager unit, For details, see
“Restoring the configuration” on page 457
.
Restoring the firmware
In the Restore Firmware area under Maintenance > System > Configuration, you can install a FortiMail firmware from your local PC or a FortiManager unit. For details, see
“Installing firmware” on page 453 .
Backing up and restoring the mailboxes
The Mail Data tab enables you to create backups of, and to restore, email users’ personal quarantines, preferences, and webmail mailboxes.
You can also monitor the status of any backups or restoration that is currently in progress.
To view the backup/restoration status, go to Maintenance > System > Mail Data.
If backups and restoration are enabled, the appearance of this tab varies by:
• whether the FortiMail unit is currently backing up or restoring mailboxes
• whether the FortiMail unit has previously backed up or restored any mailboxes
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
101
Backup and restore
Figure 48: Backup/restoration status (idle; no previous restoration)
Maintenance
Figure 49: Backup/restoration status (backup in progress)
102
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance
Figure 50: Backup/restoration status (restoration in progress)
Backup and restore
Automatically refresh interval Select the interval in seconds at which the web-based manager will automatically refresh its display of this tab.
Refresh Click to manually refresh the display of this tab.
Status Indicates the current activity of mailbox data backup/restoration.
If backups and restoration are currently disabled, the Status area of the Mail Data tab displays the message:
Backup/Restore is currently disabled.
To enable mailbox backups, see “Configuring mailbox backups” on page 105 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
103
Backup and restore
104
Maintenance
State
Objects Copied
(Total)
Bytes Copied
(Total)
Percentage
Complete
Status
Indicates one of the following current mailbox backup/restoration statuses:
• IDLE: No backup/restoration is currently occurring. To begin a
backup, at the bottom of the status section, click Click here to
start a backup. To begin a restoration, in the Restore options
• BACKING UP: The FortiMail unit is currently creating a backup copy of the mailboxes to the backup media configured in
“Configuring mailbox backups” on page 105
.
• RESTORING: The FortiMail unit is currently restoring a backup copy of the mailboxes from the backup media
configured in “Configuring mailbox backups” on page 105 .
• STOPPING: You have cancelled a backup/restoration that was in progress, and the FortiMail unit is halting the backup/restoration process.
• CHECKING: The FortiMail unit is currently checking the file system integrity of the backup media. This state occurs only if you have configured a block-level backup media (either a USB
disk or iSCSI server) in “Configuring mailbox backups” on page 105 .
• FORMATTING: The FortiMail unit is currently formatting the file system of the backup media. This state occurs only if you have configured a block-level backup media (either a USB
disk or iSCSI server) in “Configuring mailbox backups” on page 105 .
If after some time the progress remains at 0%, or eventually silently reverts to an IDLE state without the backup or restoration having finished, the operation has failed. Verify connectivity with the backup media (this is especially true with NFS, SSH, and iSCSI backup methods, where network connectivity issues can cause the FortiMail’s attempt to mount the backup file system to fail). Also verify that you have configured the backup media
correctly in “Configuring mailbox backups” on page 105
and configured the restoration item correctly in
“Restoring mailboxes from backups” on page 108 .
Note: If a backup or restoration has failed, you may need to reboot the FortiMail unit before you can try again.
Indicates the number of files that have been transferred to the backup media during this backup attempt so far, and the total amount that will have been transferred when the backup/restore is complete.
Indicates the number of bytes of data that have been transferred to the backup media during this backup attempt so far, and the total amount that will have been transferred when the backup/restore is complete.
Indicates the percentage of bytes of data that have been transferred to the backup media during this backup attempt.
If after some time the progress remains at 0%, or eventually silently reverts to an IDLE state without the backup or restoration having finished, the operation has failed. Verify connectivity with the backup media (this is especially true with NFS, SSH, and iSCSI backup methods, where network connectivity issues can cause the FortiMail’s attempt to mount the backup file system to fail). Also verify that you have configured the backup media
correctly in “Configuring mailbox backups” on page 105
and configured the restoration item correctly in
“Restoring mailboxes from backups” on page 108 .
Indicates the step of the backup/restore that is currently occurring, such as OK (stopping filesystems).
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Backup and restore
Last Backup
Last Restore
Total number of errors is
Click here to start a backup
Click here to stop the current backup
Indicates the number of errors that occurred during the previous backup attempt. If any errors occurred, they may also be individually listed.
For example, if the backup media is an NFS server, and the NFS share could not be mounted, such as if the FortiMail unit could not contact the NFS server or did not have permissions to access the share, an error message similar to the following would appear: failed to mount archive filesystem
[protocol=nfs,host=192.168.1.10,port=2049,direct ory=/home/fortimail] stopped, waiting for requested shutdown watch dog stopped, killing backup process
This field appears only if the previous backup attempt was not successful.
Indicates the date and time of the previous backup attempt. If a backup has not yet occurred, this field displays the message, No
backup has been run.
Indicates the date and time of the previous restoration attempt. If a restoration has not yet occurred, this field is empty.
Click to manually initiate an immediate mailbox backup to the
media configured in “Configuring mailbox backups” on page 105 .
Time required to complete a backup varies by the size of the backup and the speed of your network connection, and also by whether the backup is a full or incremental backup.
Alternatively, you can schedule the FortiMail unit to automatically
back up the mailboxes. For details, see “Configuring mailbox backups” on page 105
.
This link does not appear if a backup/restoration is currently in progress.
Click to cancel a backup that is currently in progress.
Time required to cancel the backup varies by the backup media, but may be up to 30 seconds.
This link appears only if a backup is currently in progress.
Configuring mailbox backups
The Backup Options area of the Mail Data tab configures which backup media will be used when you back up or restore email users’ mailboxes. It can also configure the schedule by which the FortiMail unit will automatically perform backups.
While a backup/restoration is occurring, you cannot change the configuration of this area, and this area will display the message:
Backup/Restore is busy, no configuration changes can be made.
However, you can view the status of the backup/restoration to determine if there are any errors. You can also manually initiate an immediate backup if the backup media was
.
Before you can manually initiate a backup, or in order to configure automatic scheduled backups, you must first enable backups and configure the backup media.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
105
Backup and restore
Figure 51: Configuring mailbox backups
Maintenance
106
Enabled
Copies to save
Schedule
Day
Mark this check box, configure all other options in this area, then click Apply to enable backups and restoration of email users’ mailboxes.
Select a number for both:
• Full: The total number of full backups to keep on the backup device.
• Incremental: The number of incremental backups to make between each full backup. Incremental backups can reduce the amount of time and disk space required for each backup, but may increase the amount of time required to restore the backup, and depend on a previous full backup, because incremental backups only contain the differences since the previous full backup.
For the initial backup, whether manually or automatically initiated, the FortiMail unit will make a full backup. For subsequent backups, the FortiMail unit will make the number of incremental backups that you selected in Incremental, then make another full backup, and repeat this until it reaches the maximum number of full backups to keep on the backup media, which you selected in
Full. At that point, it will overwrite the oldest full backup.
For example, if Full is 3 and Incremental is 4, the FortiMail unit would make a full backup, then 4 incremental backups. It would repeat this two more times for a total of 3 backup sets, and then overwrite the oldest full backup when creating the next backup.
Select either:
• None: Disable scheduled backups.
• A day of the week: Enable scheduled backups, and select which day of the week that the FortiMail unit will automatically back up email users’ mailboxes to the backup media. Also configure Hour.
To minimize performance impacts, consider scheduling backups during a time of the day and day of the week when email traffic volume is typically low, such as at night on the weekend.
Regardless of whether or not scheduled backups are enabled, you can manually initiate backups. For details, see
“Backing up and restoring the mailboxes” on page 101 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Backup and restore
Device
Hour Select which time on the day that you selected in Day that the
FortiMail unit will automatically back up email users’ mailboxes to the backup media.
To minimize performance impacts, consider scheduling backups during a time of the day and day of the week when email traffic volume is typically low, such as at night on the weekend.
If the backup media is not available when the backup is scheduled to occur, the FortiMail unit will re-attempt the backup at the next scheduled time.
This option is not available if Day is None.
Protocol
Username
Password
Hostname/IP address
Port
Directory
Share
Select one of the following types of backup media:
• NFS: A network file system (NFS) server.
• SMB/Windows Server: A Windows-style file share.
• SSH File System: A server that supports secure shell (SSH) connections.
• External USB Device: An external hard drive connected to the FortiMail unit’s USB port.
• External USB Device (auto detect): An external disk connected to the FortiMail unit’s USB port. Unlike the previous option, this option only creates a backup when you connect the USB disk, or when you manually initiate a backup using
“Backing up and restoring the mailboxes” on page 101
, rather than according to a schedule.
• ISCSI Server: An Internet SCSI (Small Computer System
Interface), also called iSCSI, server.
Other available options vary by your choice of backup media.
Enter the user name of the FortiMail unit’s account on the backup server.
This field does not appear if the backup media is a USB disk.
Enter the password of the FortiMail unit’s account on the backup server.
This field does not appear if the backup media is a USB disk.
Enter the IP address or fully qualified domain name (FQDN) of the
NFS, Windows, SSH, or iSCSI server.
This field does not appear if the backup media is a USB disk.
Enter the TCP port number on which the backup server listens for connections.
This field does not appear if the backup media is a USB disk.
Enter the path of the folder on the backup server where the
FortiMail unit will store the mailbox backups, such as:
/home/fortimail/mailboxbackups
This field appears only if the backup media is an NFS server or
SSH server.
Note: Do not use special characters such as a tilde ( ~ ). Special characters will cause the backup to fail.
Enter the path of the folder on the backup server where the
FortiMail unit will store the mailbox backups, such as:
FortiMailMailboxBackups
This field appears only if the backup media is an SMB/Windows server.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
107
Backup and restore Maintenance
Encryption key Enter the key that will be used to encrypt data stored on the backup media. Valid key lengths are between 6 and 64 singlebyte characters.
This field appears only if the backup media is a block-level storage device (either a USB disk or iSCSI server).
ISCSI ID Enter the iSCSI identifier in the format expected by the iSCSI server, such as an iSCSI Qualified Name (IQN), Extended Unique
Identifier (EUI), or T11 Network Address Authority (NAA).
This field appears only if the backup media is an iSCSI server.
Restoring mailboxes from backups
The Restore Options area of the Mail Data tab enables you to selectively restore email users’ mailboxes from previously made mailbox backups.
Before you can restore mailboxes, you must first configure the FortiMail unit with the location of the backup media. For details, see
“Configuring mailbox backups” on page 105
.
If a backup or restoration is currently in progress, this area will display the message:
Backup/Restore is busy, no restore can be started till it finishes.
To manually initiate restoration of mail data, click Restore.
If after some time the progress remains at 0%, or eventually silently reverts to an IDLE state without the restoration having finished, the operation has failed. Verify connectivity with the backup media (this is especially true with NFS, SSH, and iSCSI backup methods, where network connectivity issues can cause the FortiMail’s attempt to mount the backup file system to fail). Also verify that you have configured the backup media correctly in
“Configuring mailbox backups” on page 105 .
Figure 52: Restoring mailboxes
108
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Configuring centralized administration
Created by this device
Created by <FQDN>
For this domain
Restore
For this user
Select to restore mailboxes from backups identified by the current fully qualified domain name (FQDN) of this FortiMail unit, such as
FortiMail-400.example.com.
If you have changed the host name and/or local domain name of the FortiMail unit, the backup files are still identified by the previous fully qualified domain name (FQDN). In this case, do not
select this option. Instead, use Created by <FQDN> and enter the
FortiMail unit’s previous FQDN to use mailbox backups with that name.
Select to restore mailboxes from backups identified by another
FQDN, such as a previous FQDN or the FQDN of another
FortiMail unit.
Usually, you should enter an FQDN of this FortiMail unit, but you may enter the FQDN of another FortiMail unit if you want to import that FortiMail unit’s mailbox backup.
For example, you may be upgrading to a FortiMail-2000 from a
FortiMail-400. Previously, you have used a USB disk to store a backup of the mailboxes of the FortiMail-400, whose fully qualified domain name (FQDN) was fortimail.example.com. You have then configured the FortiMail-2000 to also use the USB disk as its backup media. You could then import the FortiMail-400’s mailbox backup to the FortiMail-2000 by entering fortimail.example.com in this field on the FortiMail-2000’s web-based manager.
Mark this check box if you want to restore only the mailboxes of a specific protected domain, then select the name of the protected domain.
If you want to restore only the mailbox of a specific email user
within this protected domain, also configure For this user.
Mark this check box if you want to restore only the mailbox of a specific email user, then enter the name of the email user account, such as user1.
This option is available only if For this domain is enabled.
Click to restore mailboxes from the most recent full or incremental backup stored on the backup media configured on
“Configuring mailbox backups” on page 105
.
Time required to complete a restoration varies by the size of the backup and the speed of your network connection, and also by whether the backup was a full or incremental backup.
Caution: Back up mailboxes before selecting this button.
Restoring mailboxes will overwrite all mailboxes that currently exist.
Configuring centralized administration
Maintenance > System > Central Management enables you to use a FortiManager unit to manage your FortiMail unit’s configuration and firmware.
Note: Latest FortiManager releases support centralized management of FortiMail v3.0
MR4 and MR5 releases. For FortiMail v4.0 releases, centralized management will be supported in FortiManager v4.2 and later releases. Refer to FortiManager release notes for details about supported FortiMail versions. For information on configuring a FortiManager unit to manage or provide services to your other Fortinet brand devices, see the
FortiManager Administration Guide .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
109
Configuring FortiGuard updates & FortiGuard Antispam queries Maintenance
For details, see “About administrator account permissions & domains” on page 144 .
To configure centralized administration, go to Maintenance > System >
Central Management.
Figure 53: Configuring centralized administration by FortiManager
110
Enable central management
IP
Allow automatic backup of configuration on logout
Allow configuration updates initiated by the management server
Enable to use a FortiManager unit to manage FortiMail configuration revisions and firmware. For details, see
“Backing up your configuration using a FortiManager unit” on page 100 and
“Restoring the firmware” on page 101 .
If the FortiManager unit is not configured to automatically register new devices, you must also add the FortiMail unit to the FortiManager unit’s device list. For details, see the FortiManager Administration Guide .
Enter the IP address of the FortiManager unit.
If enabled, and if the FortiMail unit’s configuration has changed, the
FortiMail unit will send a configuration backup to the FortiManager unit when the FortiMail administrator logs out of the web-based manager.
Alternatively or in addition to this option, configuration backups can also be
performed manually. For details, see “Backup and restore” on page 97 .
If enabled, the FortiMail unit accepts configuration connections from the
FortiManager unit.
Configuring FortiGuard updates & FortiGuard Antispam queries
The Update tab displays the most recent updates to FortiGuard Antispam and
FortiGuard Antivirus engines and definitions and enables you to configure how the
FortiMail unit will retrieve updates.
FortiGuard AntiSpam packages for FortiMail units are not the same as those provided to
FortiGate units. To support FortiMail’s more full-featured antispam scans,
FortiGuard AntiSpam packages for FortiMail contain platform-specific additional updates.
For example, FortiGuard AntiSpam packages for FortiMail contain heuristic antispam rules
used by Heuristic scan. Updates add to, remove from, and re-order the list of heuristic
rules so that the current most common methods spammers use are ranked highest in the list. As a result, even if you configure a lower percentage of heuristic rules to be used by that scan, with regular updates, the heuristic scan will automatically adjust to use whichever heuristic rules are currently most effective. This helps to achieve an effective spam catch rate while both reducing administrative overhead and improving performance by using the least necessary amount of FortiMail system resources.
FortiMail units receive updates from the FortiGuard Distribution Network (FDN). The FDN is a world-wide network of FortiGuard Distribution Servers (FDS). FortiMail units connect to the FDN by connecting to the FDS nearest to the FortiMail unit by its configured time zone.
In addition to manual update requests, FortiMail units support two kinds of automatic update mechanisms:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
• scheduled updates, by which the FortiMail unit periodically polls the FDN to determine if there are any available updates
• push updates, by which the FDN notifies FortiMail units when updates become available
For information on configuring scheduled updates, see
“Configuring scheduled updates” on page 116
. For information on configuring push updates, see “Configuring push updates” on page 117 .
Note: You may want to configure both scheduled and push updates. In this way, if the network experiences temporary problems such as connectivity issues that interfere with either method, the other method may still be able to provide your FortiMail unit with updated protection. You can alternatively manually update the FortiMail unit by uploading an update file. For more information on uploading updates, see
“License Information widget” on page 54 .
For FortiGuard Antispam and FortiGuard Antivirus update connectivity requirements and troubleshooting information, see
“FortiGuard connection issues” on page 470 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the currently installed FortiGuard Antispam and/or FortiGuard Antivirus engine or definition versions, or to use manual, scheduled, or push updates, go to System >
Update > Update.
Figure 54: Configuring FortiGuard engine and definition updates
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
111
Configuring FortiGuard updates & FortiGuard Antispam queries Maintenance
FortiGuard Distribution
Network
Push Update
Refresh
Use override server address
Update
Version
Expiry date
Last update attempt
Last Update Status
The result of the previous scheduled update (TCP 443) connection attempt to the FortiGuard Distribution Network (FDN) or, if enabled and configured, the override server.
• Available: Indicates that the FortiMail unit successfully connected to the FDN.
• Unavailable: Indicates that the FortiMail unit could not connect to the FDN. For more information, see
FortiGuard services” on page 113 .
• Unknown: Indicates that the FortiMail unit has not yet attempted to connect to the FDN.
To test the connection, click Refresh.
The result of the previous push update (UDP 9443) connection attempt from the FDN.
• Available: Indicates that the FDN successfully connected to the
FortiMail unit to send push updates. For more information, see
“Configuring push updates” on page 117
.
• Unavailable: Indicates that the FDN could not connect to the
FortiMail unit. For more information, see
“FortiGuard connection issues” on page 470
.
• Unknown: Indicates that the FortiMail unit has not yet attempted to connect to the FDN.
To test the connection, click Refresh.
Click to test the scheduled (TCP 443) and push (UDP 9443) update connection of the FortiMail unit to the FDN or, if enabled, the IP address configured in Use override server address.
When the test is complete, the tab refreshes itself and results are displayed in FortiGuard Distribution Network. Time required varies by the speed of the FortiMail unit’s network connection, and the number of timeouts that occur before the connection attempt is successful or the
FortiMail unit determines that it cannot connect.
Note: This does not test the connection for FortiGuard Antispam rating queries, which occurs over a different connection and must be tested separately. For details, see
“Configuring FortiGuard updates &
FortiGuard Antispam queries” on page 110 .
Enable to override the default FortiGuard Distribution Server (FDS) to which the FortiMail unit connects for updates, then enter the IP address of the override public or private FDS.
For more information, see
“Verifying connectivity with FortiGuard services” on page 113
.
The name of the updatable item, such as Anti Virus Definition.
The version number of the item currently installed on the FortiMail unit.
The expiry date of the license for the item.
The date and time when the FortiMail unit last attempted to download an update.
The result of the last update attempt.
• No updates: Indicates the last update attempt was successful but no new updates are available.
• Installed updates: Indicates the last update attempt was successful and new updates were installed.
• Other messages, such as Network Error, indicate that the
FortiMail unit was not able to connect to the FDN, or other error
conditions. For more information, see “FortiGuard connection issues” on page 470
.
112
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Allow Push Update
Use override push IP Enable to override the IP address and default port number to which the
FDN sends push notifications.
• Enabled: The FortiMail unit notifies the FDN to send push updates to the IP address and port number that you enter (for example, a virtual IP/port forward on a NAT device that will forward push notifications to the FortiMail unit).
• Disabled: The FortiMail unit notifies the FDN to send push updates to the FortiMail unit’s IP address, using the default port number
(UDP 9443). This is useful only if the FortiMail unit has a public network IP address.
For more information, see
“Configuring push updates” on page 117 .
This option is available only if Allow Push Update is enabled.
Scheduled Update
Enable to allow the FortiMail unit to accept push notifications
(UDP 9443). If the FortiMail unit is behind a NAT device, you may also need to enable and configure Use override push IP. For details, see
“Configuring push updates” on page 117 .
Push notifications only notify the FortiMail unit that an update is available. They do not transmit the update itself. After receiving a push notification, the FortiMail unit then initiates a separate TCP 443 connection, similar to scheduled updates, in order to the FDN to download the update.
Apply
Enable to perform updates according to a schedule, then select one of the following as the frequency of update requests. When the FortiMail unit requests an update at the scheduled time, results appear in Last
Update Status.
• Every: Select to request to update once every 1 to 23 hours, then select the number of hours between each update request.
• Daily: Select to request to update once a day, then select the hour of the day to check for updates.
• Weekly: Select to request to update once a week, then select the day of the week, the hour, and the minute of the day to check for updates.
If you select 00 minutes, the update request occurs at a randomly determined time within the selected hour.
Click to save configuration changes on this tab and, if you have enabled
Allow Push Update, notify the FDN of the destination IP address and port number for push notifications to this FortiMail unit.
Update Now Click to manually initiate a FortiGuard Antivirus and FortiGuard
Antispam engine and definition update request. Results will appear in
Last Update Status. Time required varies by the availability of updates, size of the updates, and speed of the FortiMail unit’s network connection.
Verifying connectivity with FortiGuard services
If you have subscribed to FortiGuard Antivirus and/or FortiGuard Antispam, your FortiMail unit must be able to connect to the FortiGuard Distribution Network (FDN) in order to verify its license and use the services.
Your FortiMail unit may be able to connect using the default settings. However, you should confirm this by verifying connectivity.
Note: FortiMail units use multiple connection types with the FDN. To completely verify connectivity, you should test each connection type by performing both of the following procedures.
Note: You must first register the FortiMail unit with the Fortinet Technical Support web site, https://support.fortinet.com/, to receive service from the FDN. The FortiMail unit must also have a valid Fortinet Technical Support contract which includes service subscriptions, and be able to connect to the FDN or the FDS that you will configure to override the default FDS addresses. For port numbers required for license validation and update connections, see
“Appendix C: Port Numbers” on page 491
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
113
Configuring FortiGuard updates & FortiGuard Antispam queries Maintenance
To verify scheduled update connectivity
Before performing this procedure, if your FortiMail unit connects to the Internet using a proxy, use the CLI command config system fortiguard antivirus to enable the FortiMail unit to connect to the FDN through the proxy. For more information, see the FortiMail CLI Reference .
1 Go to Maintenance > FortiGuard > Update.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 If you want your FortiMail unit to connect to a specific FDS other than the default for its time zone, enable Use override server address, enter the fully qualified domain name
(FQDN) or IP address of the FDS.
3 Click Apply.
4 Click Refresh.
A dialog appears, notifying you that the process could take a few minutes.
5 Click OK.
The FortiMail unit tests the connection to the FDN and, if any, the override server. Time required varies by the speed of the FortiMail unit’s network connection, and the number of timeouts that occur before the connection attempt is successful or the
FortiMail unit determines that it cannot connect. When the connection test completes, the page refreshes. Test results are displayed in the FortiGuard Distribution Network field.
• Available: The FortiMail unit successfully connected to the FDN or override server.
• Unavailable: The FortiMail unit could not connect to the FDN or override server, and will not be able to download updates from it. For CLI commands that may be able to assist you in troubleshooting, see
“To verify antispam rating query connectivity” on page 114
.
When successful connectivity has been verified, continue by configuring the FortiMail unit to receive engine and definition updates from the FDN or override server using one or more of the following methods:
• scheduled updates (see “Configuring scheduled updates” on page 116
)
• push updates (see “Configuring push updates” on page 117 )
• manually initiated updates (see
“Manually requesting updates” on page 119 )
To verify antispam rating query connectivity
1 Go to Maintenance > FortiGuard > AntiSpam in the advanced management mode of the web-based manager.
2 Verify that the Enable service check box is marked. If it is not, mark it, then click Apply.
3 Under FortiGuard Query, enter a valid IP or URI (you can also use the hash value of a spam email that you can find in the log messages).
4 Click Query.
If the query is successful, the Query Result will display if the IP/URI is spam or unknown (not spam).
If the query is unsuccessful, the Query Result will display No response. In this case, you can use the following tips to troubleshoot the issue.
114
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 55: Verifying the FortiGuard Antispam license and rating query connectivity
If the FortiMail unit can reach the DNS server, but cannot successfully resolve the domain name of the FDS, a message appears notifying you that a DNS error has occurred.
Figure 56: DNS error when resolving the FortiGuard Antispam domain name
Verify that the DNS servers contain A records to resolve antispam.fortigate.com and other FDN servers. You may be able to obtain additional insight into the cause of the query failure by manually performing a DNS query from the FortiMail unit using the following CLI command: execute nslookup host antispam.fortigate.com
If the FortiMail unit cannot successfully connect, or if your FortiGuard Antispam license does not exist or is expired, a message appears notifying you that a connection error has occurred.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
115
Configuring FortiGuard updates & FortiGuard Antispam queries
Figure 57: Connection error when verifying FortiGuard Antispam rating query connectivity
Maintenance
116
Verify that:
• your FortiGuard Antispam license is valid and currently active
• the default route (located in System > Network > Routing) is correctly configured
• the FortiMail unit can connect to the DNS servers you configured during the Quick
Start Wizard (located in System > Network > DNS), and to the FDN servers
• firewalls between the FortiMail unit and the Internet or override server allow
FortiGuard Antispam rating query traffic. The default port number for FortiGuard antispam query is UDP port 53 in v4.0. Prior to v4.0, the port number was 8889.
You may be able to obtain additional insight into the point of the connection failure by tracing the connection using the following CLI command: execute traceroute <address_ipv4> where <address_ipv4> is the IP address of the DNS server or FDN server.
When query connectivity is successful, antispam profiles can use the FortiGuard scan
option.
You can use the antispam log to monitor for subsequent query connectivity interruptions. When sending email through the FortiMail unit that matches a policy and
profile where the FortiGuard scan option is enabled, if the FortiMail cannot connect to
the FDN and/or its license is not valid, and if Information-level logging is enabled, the
FortiMail unit records a log message in the antispam log (located in Monitor > Log >
AntiSpam) whose Log Id field is 0300023472 and whose Message field is:
FortiGuard-Antispam: No Answer from server.
Figure 58: Antispam log when FortiGuard Antispam query fails
Verify that the FortiGuard Antispam license is still valid, and that network connectivity has not been disrupted for UDP port 53 traffic from the FortiMail unit to the Internet.
Configuring scheduled updates
You can configure the FortiMail unit to periodically request FortiGuard Antivirus and
FortiGuard Antispam engine and definition updates from the FDN or override server.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
You can use push updates or manually initiate updates as alternatives or in conjunction with scheduled updates. If protection from the latest viral threats is a high priority, you could configure both scheduled updates and push updates, using scheduled updates as a failover method to increase the likelihood that the FortiMail unit will still periodically retrieve updates if connectivity is interrupted during a push notification. While using only scheduled updates could potentially leave your network vulnerable to a new virus, it minimizes short disruptions to antivirus scans that can occur if the FortiMail unit applies push updates during peak volume times. For additional/alternative update methods, see
“Configuring push updates” on page 117
and “Manually requesting updates” on page 119
.
For example, you might schedule updates every night at 2 AM or weekly on Sunday, when email traffic volume is light.
Before configuring scheduled updates, first verify that the FortiMail unit can connect to the
To configure scheduled updates
1 Go to Maintenance > FortiGuard > Update.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Enable Scheduled Update.
3 Select from one of the following:
Every
Daily
Weekly
Select to request updates once per interval, then configure the number of hours and minutes between each request.
Select to request updates once a day, then configure the time of day.
Select to request updates once a week, then configure the day of the week and the time of day.
Note: Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.
4 Click Apply.
The FortiMail unit starts the next scheduled update according to the configured update schedule. If you have enabled logging, when the FortiMail unit requests a scheduled
update, the event is recorded in the event log. For details, see “Log & Report” on page 437 .
Configuring push updates
You can configure the FortiMail unit to receive push updates from the FDN or override server.
When push updates are configured, the FortiMail unit first notifies the FDN of its IP address, or the IP address and port number override. (If your FortiMail unit’s IP address changes, including if it is configured with DHCP, the FortiMail unit automatically notifies the FDN of the new IP address.) As soon as new FortiGuard Antivirus and FortiGuard
Antispam packages become available, the FDN sends an update availability notification to that IP address and port number. Within 60 seconds, the FortiMail unit then requests the package update as if it were a scheduled or manually initiated update.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
117
Configuring FortiGuard updates & FortiGuard Antispam queries Maintenance
You can use scheduled updates or manually initiate updates as alternatives or in conjunction with push updates. If protection from the latest viral threats is a high priority, you could configure both scheduled updates and push updates, using scheduled updates as a failover method to increase the likelihood that the FortiMail unit will still periodically retrieve updates if connectivity is interrupted during a push notification. Using push updates, however, can potentially cause short disruptions to antivirus scans that can occur if the FortiMail unit applies push updates during peak volume times. For additional/alternative update methods, see
“Configuring scheduled updates” on page 116
and “Manually requesting updates” on page 119 .
Before configuring push updates, first verify that the FortiMail unit can connect to the FDN
or override server. For details, see “Verifying connectivity with FortiGuard services” on page 113
.
To configure push updates
1 Go to Maintenance > FortiGuard > Update.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Enable Allow Push Update.
3 If the FortiMail unit is behind a firewall or router performing NAT, enable Use override
push IP and enter the external IP address and port number of the NAT device.
You must also configure the NAT device with port forwarding or a virtual IP to forward push notifications (UDP port 9443) to the FortiMail unit. For example, if the FortiMail unit is behind a FortiGate unit, configure the FortiGate unit with a virtual IP that forwards push notifications from its external network interface to the private network IP address of the FortiMail unit. Then, on the FortiMail unit, configure Use override push
IP with the IP address and port number of that virtual IP. For details on configuring virtual IPs and/or port forwarding, see the documentation for the NAT device.
Note: Push updates require that the external IP address of the NAT device is not dynamic
(such as an IP address automatically configured using DHCP). If dynamic, when the IP address changes, the override push IP will become out-of-date, causing subsequent push updates to fail.
If you do not enable Use override push IP, the FDN will send push notifications to the
IP address of the FortiMail unit, which must be a public network IP address routable from the Internet.
4 Click Apply.
The FortiMail unit notifies the FDN of its IP address or, if configured, the override push
IP. When an update is available, the FDN will send push notifications to this IP address and port number.
5 Click Refresh.
A dialog appears, notifying you that the process could take a few minutes.
118
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Maintenance Downloading a trace file
6 Click OK.
The FDN tests the connection to the FortiMail unit. Time required varies by the speed of the FortiMail unit’s network connection, and the number of timeouts that occur before the connection attempt is successful or the FortiMail unit determines that it cannot connect. When the connection test completes, the page refreshes. Test results are displayed in the Push Update field.
• Available : The FDN successfully connected to the FortiMail unit.
• Unavailable : The FDN could not connect to the FortiMail unit, and will not be able to send push notifications to it. Verify that intermediary firewalls and routers do not block push notification traffic (UDP port 9443). If the FortiMail unit is behind a NAT device, verify that you have enabled and configured Use override push IP, and that the NAT device is configured to forward push notifications to the FortiMail unit.
Manually requesting updates
You can manually trigger the FortiMail unit to connect to the FDN or override server to request available updates for its FortiGuard Antivirus and FortiGuard Antispam packages.
You can manually initiate updates as an alternative or in addition to other update methods.
For details, see “Configuring push updates” on page 117 and
“Configuring scheduled updates” on page 116 .
To manually request updates
Before manually initiating an update, first verify that the FortiMail unit can connect to the
1 Go to Maintenance > FortiGuard > Update.
If this menu option does not appear, first select Advanced >> to switch to the advanced mode of the web-based manager.
2 Click Update Now.
Note: Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.
3 After a few minutes, click the Update tab to refresh the page, or go to Monitor >
System Status > Status.
If an update was available, new version numbers appear for the packages that were updated. If you have enabled logging, messages are recorded to the event log
indicating whether the update was successful or not. For details, see “Log & Report” on page 437 .
Downloading a trace file
If Fortinet Technical Support requests a trace log for system analysis purposes, you can download one using the web-based manager.
Trace logs are compressed into an archive (.gz), and contain information that is supplementary to debug-level log files.
To download a trace file
1 Go to Maintenance > System > Configuration.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
119
Downloading a trace file
2 At the bottom of the tab, click Download trace log.
Your web browser downloads trace.log.gz.
Maintenance
120
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
System
The System menu enables you to configure network settings, administrator accounts, the time, the web-based manager, SNMP, RAID, high availability (HA), and certificates.
This topic includes:
•
•
Configuring the time, GUI, & SNMP
•
Configuring administrator accounts & access profiles
•
•
•
Configuring network settings
The Network submenu provides options to configure network connectivity and administrative access to the web-based manager or CLI of the FortiMail unit through each network interface.
This topic includes:
•
Configuring the network interfaces
•
•
•
Configuring the network interfaces
The Interface tab displays a list of the FortiMail unit’s network interfaces.
You must configure at least one of the FortiMail unit’s network interfaces to enable it to connect to your network. Depending on your network topology and other considerations, you may choose to connect the FortiMail unit to your network using two or more of the
FortiMail unit’s network interfaces. You can configure each network interface separately.
For more information, see
“Editing network interfaces” on page 123 .
Caution: If your FortiMail unit is not properly deployed and configured for the topology of your network, including network interface connections, email may be able to bypass the
FortiMail unit. For information on correctly deploying your FortiMail unit, see the FortiMail
Install Guide .
The web-based manager, FortiMail webmail, and the per-recipient quarantines can be accessed remotely using the network interfaces’ IP addresses. For details, see
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
121
Configuring network settings
To view the list of network interfaces, go to System > Network > Interface.
Figure 59: Viewing the list of network interfaces
System
122
Name The name of the network interface, such as port1.
If the FortiMail unit is operating in transparent mode, this column also indicates that the
IP/Netmask The IP address and netmask of the network interface.
If the FortiMail unit is in transparent mode, IP/Netmask may alternatively display
bridging. This means that
“Do not associate with management IP” on page 126
has been disabled, and the network interface is acting as a Layer 2 bridge. If high availability (HA) is also enabled, IP and Netmask may alternatively display
bridged (isolated) while the effective operating mode is slave and therefore the network interface is currently disconnected from the network, or bridging (waiting for
recovery) while the effective operating mode is failed and the network interface is currently disconnected from the network but a failover may soon occur, beginning connectivity. For more information, see
“Effective Operating Mode” on page 165
and
“Virtual IP Address” on page 174 .
Access
Status
The administrative access and webmail access services that are enabled on the network interface, such as HTTPS for the web-based manager.
Indicates the “up” (available) or “down” (unavailable) administrative status for the network interface.
• Green up arrow: The network interface is up and can accept or receive traffic.
• Red down arrow: The network interface is down and cannot or receive accept traffic.
To change the administrative status (that is, bring up or down a network interface), see
“Editing network interfaces” on page 123 .
About the management IP
When a FortiMail unit is operating in transparent mode, one or more of its network interfaces may be configured to act as a Layer 2 bridge, without IP addresses of their own.
However, for administrators to be able to configure the FortiMail unit through a network connection rather than a local console, the FortiMail unit must have an IP address. The management IP address enables administrators to connect to the FortiMail unit through
port1 or other network ports, even when they are currently bridging.
By default, the management IP address is indirectly bound to port1, through the bridge. If other network interfaces are also included in the bridge with port1, the FortiMail unit can be configured to respond to connections to the management IP address that arrive on those other network interfaces. For more information, see
“Do not associate with management IP” on page 126
.
Unless you have configured an override server IP address, FortiMail units will use this IP address for connections with the FortiGuard Distribution Network (FDN). Depending on your network topology, the management IP may be a private network address, and therefore not routable from the FDN, making it unsuitable for use as the destination IP address of push update connections from the FDN. In this case, for push updates to function correctly, you must configure an override server. For more information, see
“Configuring push updates” on page 117
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
The web-based manager, FortiMail webmail, and the per-recipient quarantines can be
accessed remotely using the management IP address. For details, see “URL for access” on page 35 .
Editing network interfaces
You can edit a network interface to change its IP address, netmask, administrative access protocols, and other settings.
Caution: Enable administrative access only on network interfaces connected to trusted private networks or directly to your management computer. If possible, enable only secure administrative access protocols such as HTTPS or SSH. Failure to restrict administrative access could compromise the security of your FortiMail unit.
If your FortiMail unit is operating in transparent mode, depending on your network topology, you may or may not need to configure the network interfaces of the FortiMail unit.
• If all email servers protected by the FortiMail unit are located on the same subnet, no network interface configuration is necessary. Bridging is the default configuration for network interfaces when the FortiMail unit is operating in transparent mode, and the
FortiMail unit will bridge all connections occurring through it from the network to the protected email servers.
• If email servers protected by the FortiMail unit are located on different subnets, you must connect those email servers through separate physical ports on the FortiMail unit, and configure the network interfaces associated with those ports, assigning IP addresses and removing them from the bridge.
It is possible to configure a mixture of bridging and non-bridging network interfaces. For example, if some email servers belong to the same subnet, network interfaces for those email servers may remain in the bridge group; email servers belonging to other subnets may be attached to network interfaces that are not associated with the bridge.
Note: You can restrict which IP addresses are permitted to log in as a FortiMail administrator through network interfaces. For details, see
“Configuring administrator accounts” on page 147
.
To edit a network interface
1 Go to System > Network > Interface.
2 Double-click the row corresponding to the network interface that you want to modify, or click to select the interface and then click Edit.
The Edit Interface page appears. Appearance varies by:
• the operational mode of the FortiMail unit (gateway, transparent, or server)
• if the FortiMail unit is operating in transparent mode, by whether the network interface is port1, which is required to be configured as a Layer 2 bridge and associated with the management IP, and therefore cannot be configured with its own IP and Netmask
3 For gateway mode or server mode, configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
123
Configuring network settings
Figure 60: Editing a network interface (gateway mode and server mode)
System
Interface Name The name (such as port2) and media access control (MAC) address for this network interface.
Addressing mode
Manual
IP/Netmask
Select to enter a static IP address, then enter the IP address and
netmask for the network interface in IP/Netmask.
Enter the IP address and netmask for the network interface.
If the FortiMail unit is operating in gateway mode or server mode,
this option is available only if Manual is selected.
DHCP Select to retrieve a dynamic IP address using DHCP.
This option appears only if the FortiMail unit is operating in gateway mode or server mode.
Retrieve default gateway and DNS from server
Enable to retrieve both the default gateway and DNS addresses from the DHCP server, replacing any manually configured values.
Connect to server Enable for the FortiMail unit to attempt to obtain DNS addressing information from the DHCP server.
Disable this option if you are configuring the network interface offline, and do not want the unit to attempt to obtain addressing information at this time.
124
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Access Enable protocols that this network interface should accept for connections to the FortiMail unit itself. (These options do not affect connections that will travel through the FortiMail unit.)
• HTTPS: Enable to allow secure HTTPS connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
• HTTP: Enable to allow HTTP connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
For information on redirecting HTTP requests for webmail and
Caution: HTTP connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit. For information on further restricting access of administrative connections, see
“Configuring administrator accounts” on page 147 .
• PING: Enable to allow ICMP ECHO (ping) responses from this network interface.
For information on configuring the network interface from which the FortiMail unit itself will send pings, see the FortiMail CLI
Reference .
• SSH: Enable to allow SSH connections to the CLI through this network interface.
• SNMP: Enable to allow SNMP connections (queries) to this network interface.
For information on further restricting access, or on configuring the network interface that will be the source of traps, see
“Configuring SNMP queries & traps” on page 135
.
• TELNET: Enable to allow Telnet connections to the CLI through this network interface.
Caution: Telnet connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit.
MTU
Override default MTU value (1500).
Enable to change the maximum transmission unit (MTU) value, then enter the maximum packet or Ethernet frame size in bytes.
If network devices between the FortiMail unit and its traffic destinations require smaller or larger units of traffic, packets may require additional processing at each node in the network to fragment or defragment the units, resulting in reduced network performance. Adjusting the MTU to match your network can improve network performance.
The default value is 1500 bytes. The MTU size must be between
576 and 1500 bytes.
Administrative status Select either:
• Up: Enable (that is, bring up) the network interface so that it can send and receive traffic.
• Down: Disable (that is, bring down) the network interface so that it cannot send or receive traffic.
If the FortiMail unit is operating in transparent mode, configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
125
Configuring network settings
Figure 61: Editing a network interface (transparent mode, non-bridging)
System
Figure 62: Editing a network interface (transparent mode, port1)
Interface Name
Addressing mode
Do not associate with management IP
Enable to configure an IP address and netmask for this network interface, separate from the management IP, then configure
This option appears only if the network interface is not port1, which is required to be a member of the bridge.
IP/Netmask
The name (such as port2) and media access control (MAC) address for this network interface.
Enter the IP address and netmask for the network interface.
If the FortiMail unit is operating in transparent mode, this option is
available only if Do not associate with management IP is enabled.
126
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Access Enable protocols that this network interface should accept for connections to the FortiMail unit itself. (These options do not affect connections that will travel through the FortiMail unit.)
• HTTPS: Enable to allow secure HTTPS connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
• HTTP: Enable to allow HTTP connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
For information on redirecting HTTP requests for webmail and
Caution: HTTP connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit. For information on further restricting access of administrative connections, see
“Configuring administrator accounts” on page 147 .
• PING: Enable to allow ICMP ECHO (ping) responses from this network interface.
For information on configuring the network interface from which the FortiMail unit itself will send pings, see the FortiMail CLI
Reference .
• SSH: Enable to allow SSH connections to the CLI through this network interface.
• SNMP: Enable to allow SNMP connections (queries) to this network interface.
For information on further restricting access, or on configuring the network interface that will be the source of traps, see
“Configuring SNMP queries & traps” on page 135
.
• TELNET: Enable to allow Telnet connections to the CLI through this network interface.
Caution: Telnet connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit.
MTU
Override default MTU value (1500).
Enable to change the maximum transmission unit (MTU) value, then enter the maximum packet or Ethernet frame size in bytes.
If network devices between the FortiMail unit and its traffic destinations require smaller or larger units of traffic, packets may require additional processing at each node in the network to fragment or defragment the units, resulting in reduced network performance. Adjusting the MTU to match your network can improve network performance.
The default value is 1500 bytes. The MTU size must be between
576 and 1500 bytes.
Administrative status Select either:
• Up: Enable (that is, bring up) the network interface so that it can send and receive traffic.
• Down: Disable (that is, bring down) the network interface so that it cannot send or receive traffic.
4 Click OK.
To configure a non-bridging network interface
1 Go to System > Network > Interface.
2 Double-click the row corresponding to the network interface that you want to remove from the bridge, or click to select the interface and then click Edit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
127
Configuring network settings
Note: port1 is required to be a member of the bridge, and cannot be removed from it.
Figure 63: Editing a network interface (transparent mode, non-bridging)
System
128
3 Enable Do not associate with management IP.
This option appears only if the FortiMail unit is operating in transparent mode and if the network interface is not port1, which is required to be a member of the bridge.
4 In IP/Netmask, enter the IP address and netmask of the network interface.
5 Click OK.
Repeat this procedure for each network interface that is connected to an email server on a distinct subnet. When complete, configure static routes for those email servers.
For details, see
“Configuring static routes” on page 128 .
Configuring static routes
The Routing tab displays a list of routes and enables you to configure static routes and gateways used by the FortiMail unit.
Static routes direct traffic exiting the FortiMail unit — you can specify through which network interface a packet will leave, and the IP address of a next-hop router that is reachable from that network interface. The router is aware of which IP addresses are reachable through various network pathways, and can forward those packets along pathways capable of reaching the packets’ ultimate destinations.
A default route is a special type of static route. A default route matches all packets, and defines a gateway router that can receive and route packets if no other, more specific static route is defined for the packet’s destination IP address.
You should configure at least one static route, a default route, that points to your gateway.
However, you may configure multiple static routes if you have multiple gateway routers, each of which should receive packets destined for a different subset of IP addresses.
For example, if an SMTP server is directly attached to one of the network interfaces, but all other destinations, such as connecting clients, are located on distant networks such as the Internet, you might need to add only one route: a default route for the gateway router through which the FortiMail unit connects to the Internet.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
To determine which route a packet will be subject to, the FortiMail unit examines the packet’s destination IP address and compares it to those of the static routes. If more than one route matches the packet, the FortiMail unit will apply the route with the smallest index number. For this reason, you should give more specific routes a smaller index number than the default route.
When you add a static route through the web-based manager, the FortiMail unit evaluates the route to determine if it represents a different route compared to any other route already present in the list of static routes. If no route having the same destination exists in the list of static routes, the FortiMail unit adds the static route, using the next unassigned route index number.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of static routes, go to System > Network > Routing.
Figure 64: Viewing the list of static routes
Destination IP/Netmask The destination IP address and subnet of packets subject to the static route.
0.0.0.0/0.0.0 indicates that the route matches all destination IP addresses.
Gateway The IP address of the next-hop router to which packets subject to the static route will be forwarded.
To configure a static route
1 Go to System > Network > Routing.
2 Either click New to add a route, or double-click to select a route that you want to modify.
3 Configure the following:
Figure 65: Configuring a static route
Destination
IP/netmask
Gateway
Enter the destination IP address and netmask of packets that will be subject to this static route.
To create a default route that will match all packets, enter 0.0.0.0/0.0.0.0.
Type the IP address of the next-hop router to which the FortiMail unit will forward packets subject to this static route. This router must know how to route packets to the destination IP addresses that you have specified in Destination
IP/netmask. For an Internet connection, the next hop routing gateway routes traffic to the Internet.
4 Click Create or OK.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
129
Configuring network settings System
Configuring DNS
The DNS tab enables you to configure the DNS servers that the FortiMail unit will query to resolve domain names into IP addresses.
FortiMail units require DNS servers for features such as reverse DNS lookups, FortiGuard connectivity, and other aspects of email processing. Your ISP may supply IP addresses of
DNS servers, or you may want to use the IP addresses of your own DNS servers.
Caution: If the FortiMail unit is operating in gateway mode, you must configure the MX record of the DNS server for each protected domain to direct all email to this FortiMail unit instead of the protected SMTP servers. Failure to update the records of your DNS server may enable email to circumvent the FortiMail unit.
Note: For improved FortiMail unit performance, use DNS servers on your local network.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the primary and secondary DNS servers, go to Settings > Network > DNS.
Figure 66: Configuring DNS
130
Primary DNS server Enter the IP address of the primary DNS server.
Secondary DNS server Enter the IP address of the secondary DNS server.
Configuring dynamic DNS
The DDNS tab enables you to configure the FortiMail unit to use a dynamic DNS (DDNS) service.
If the FortiMail unit has a static domain name but a dynamic public IP address, you can use DDNS to update DNS servers on the Internet when the public IP address for its fully qualified domain name (FQDN) changes.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of dynamic DNS accounts, go to System > Network > DDNS.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Figure 67: Viewing the list of dynamic DNS accounts
Server
Username
Host/Domain Name
Update Time
The name of your DDNS service provider.
Your user name for the DDNS service provider.
A public host name or fully qualified domain name (FQDN) that should resolve to the public IP address of the FortiMail unit.
Its public DNS records are updated by the DDNS service provider when the FortiMail unit sends its current public IP address. As such, it might not be the same as the host name and local domain name that you have
configured in “Host name” on page 202 and “Local domain name” on page 202
, which could be valid only for your internal network.
The interval in hours between each time that the FortiMail unit contacts the DDNS service provider.
To configure DDNS
1 Go to System > Network > DDNS.
2 If you have not yet configured the dynamic DNS account that the FortiMail unit will use when it connects to the DDNS service provider, click New, configure the following for your dynamic DNS account, then click Create:
Figure 68: Adding a dynamic DNS account
Server
User name
Password
Update time
Select a DDNS service provider to which the FortiMail unit will send DDNS updates.
Enter the user name of your account with the DDNS service provider. The FortiMail unit will provide this to authenticate itself with the service when sending updates.
Enter the password for the DDNS user name.
Enter the interval in hours between each time that the FortiMail unit will query the DDNS service provider’s IP detection page if
is Auto detect.
Caution: Do not exceed the recommended frequency published by your DDNS service provider. Some DDNS service providers consider excessive connections to be abusive, and may ignore further queries from the FortiMail unit.
The tab returns to the list of dynamic DNS accounts, which should now include your new account.
3 Double-click the row corresponding to the DDNS account.
The Host/Domain Name Setting area is now visible.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
131
Configuring network settings
Figure 69: Editing a dynamic DNS account
System
4 In the Host/Domain Name Setting area, click Create New, or, to modify an existing host/domain name, click its row to select it, then click Edit.
5 Configure the following:
Figure 70: Configuring a dynamic DNS domain name
Server
Status
The dynamic DNS service provider of this account.
Enable to update the DDNS service provider when the FortiMail unit’s public
IP address changes.
Disable to notify the DDNS service provider that this FQDN should use its offline redirect, if you have configured any. If the FortiMail unit’s public IP address changes, it will not notify the DDNS service provider.
132
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Host name
IP mode
Enter the fully qualified domain name (FQDN) whose records the DDNS provider should update.
Select which of the following ways the FortiMail unit should use to determine its current publicly routable IP address.
• Auto detect: Periodically query the DDNS service provider’s IP address detection web page to see if the FortiMail unit’s public IP address has changed. The IP detection web page returns the apparent source IP address of the query. If this IP address has changed, the FortiMail unit then sends an update request to the DDNS service provider, causing it to
update DNS records for the FQDN in “Host name” on page 133 .
This option is the most common choice. To configure the interval of DDNS
IP detection queries, see “Update time” on page 131 .
Note: If this query occurs through a NAT device such as a router or firewall, its apparent source IP address will not be the private network IP address of any of the FortiMail unit’s network interfaces. Instead, it will be be the IP address of the NAT device’s externally facing network interface.
For example, a public virtual IP (VIP) on a FortiGate unit in NAT mode might be used to route email from the Internet to a FortiMail unit. DDNS updates are also routed out from the VIP to the DDNS service provider on the Internet. From the DDNS service provider’s perspective, the DDNS update connection appears to come from the VIP, and therefore it updates the DNS records with the IP address of the VIP. The DDNS service provider does not know the private network address of the FortiMail unit.
• Bind interface: Use the current IP address of one of the FortiMail unit’s network interfaces. Choose this option only if the network interface has an
IP address that is routable from the Internet — that is, it is not an
RFC 1918 private network address.
• Static IP: Use an IP address that you configure. You must manually update the accompanying field if the FortiMail unit’s public IP address changes.
6 Click Create.
7 Click OK.
To verify your DDNS configuration and connectivity, do not query DNS servers — depending on DNS caching, record propagation, and other effects, DNS queries may not be able to determine whether the update actually reached your DDNS service provider.
Instead, log in to your DDNS service provider account and verify whether its host records have been updated. You can also view the FortiMail event log. Log messages such as this indicate DDNS update failure:
DDNS daemon failed on update members.dyndns.org , domain fortimail.example.com, next try at 1251752285\n
Configuring the time, GUI, & SNMP
The Configuration submenu enables you to configure an assortment of system-wide settings such as the system time, administrator accounts, the idle timeout of the webbased manager, and SNMP access.
This topic includes:
•
•
Configuring the idle timeout & LCD panel options
•
Configuring SNMP queries & traps
•
Configuring the time & date
The Time tab enables you to configure the system time and date of the FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
133
Configuring the time, GUI, & SNMP System
You can either manually set the FortiMail system time or configure the FortiMail unit to automatically keep its system time correct by synchronizing with Network Time Protocol
(NTP) servers.
Note: For many features to work, including scheduling, logging, and certificate-dependent features, the FortiMail system time must be accurate.
Note: FortiMail units support daylight savings time (DST), including recent changes in the
USA, Canada and Western Australia.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the system time, go to System > Configuration > Time.
Figure 71: Configuring the date and time
134
System Time
Refresh
The date and time according to the FortiMail unit’s clock at the time that this tab was loaded, or when you last selected the
Refresh button.
Select to update the System Time field with the current time according to the FortiMail unit’s clock.
Time Zone Select the time zone in which the FortiMail unit is located.
Automatically adjust clock for daylight saving changes
Enable to adjust the FortiMail system clock automatically when your time zone changes to daylight savings time (DST) and back to standard time.
Set date Select this option to manually set the date and time of the
FortiMail unit’s clock, then select the Hour, Minute, Second, Year,
Month and Day fields before you click Apply.
Alternatively, configure Synchronize with NTP server.
Synchronize with NTP Server Select to use a network time protocol (NTP) server to automatically set the system date and time, then configure Server and Syn Interval.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Server
Syn Interval
Enter the IP address or domain name of an NTP server.
You can add a maximum of 10 NTP servers. The FortiMail unit uses the first NTP server based on the selection mechanism of the NTP protocol.
Click the plus sign to add more servers.
Click the minus sign to remove servers. Note that you cannot remove the last server.
To find the NTP servers that you can use, see http://www.ntp.org
.
Enter how often in minutes the FortiMail unit should synchronize its time with the NTP server. For example, entering 1440 causes the FortiMail unit to synchronize its time once a day.
Configuring the idle timeout & LCD panel options
The Options tab enables you to set the idle timeout of the web-based manager, and to restrict access to the control buttons and LCD by requiring a PIN (personal identification number).
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the web-based manager and LCD panel options, go to System > Configuration >
Options.
Figure 72: Configuring global options for the web-based manager and LCD panel
Idle Timeout Enter the amount of time that an administrator may be inactive before the FortiMail unit automatically logs out the administrator.
Note: For better security, use a low idle timeout value.
LCD Panel
PIN Protection Enable to require administrators to first enter the PIN before using the LCD display panel and control buttons on the FortiMail unit, then enter the 6-digit PIN number.
This option appears only on FortiMail models whose hardware includes an LCD panel.
Caution: For better security, always configure an LCD PIN. Failure to configure a PIN allows anyone with physical access to reconfigure the FortiMail unit.
Configuring SNMP queries & traps
The SNMP v1/v2c tab enables you to configure SNMP to monitor FortiMail system events and thresholds, or a high availability (HA) cluster for failover messages.
You can also use SNMP to monitor some FortiMail-2000A and FortiMail-4000 models which have monitored power supplies and RAID controllers. When a monitored power supply or a RAID controller is removed or added, the FortiMail unit will send configured notification for those events by log messages, alert email messages, and/or SNMP traps.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
135
Configuring the time, GUI, & SNMP System
Before you can use its SNMP queries, you must enable SNMP access on the network interfaces that SNMP managers will use to access the FortiMail unit. For more information, see
“Editing network interfaces” on page 123 .
For information on HA-specific MIB and trap MIB fields, see
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the SNMP agent of the FortiMail unit, go to System > Configuration >
SNMP v1/v2c.
Note: You can download the SNMP MIB file from the Fortinet Technical Support web site, https://support.fortinet.com/ .
Figure 73: Enabling the SNMP agent
136
SNMP agent enable Enable to activate the FortiMail SNMP agent. This must be enabled to accept queries or send traps from the FortiMail unit.
Description
Location
Enter a descriptive name for the FortiMail unit.
Enter the location of the FortiMail unit.
Enter administrator contact information.
Contact
SNMP Threshold
Trap Type
Trigger
The type of trap, such as CPU Usage.
Either the percent of the resource in use or the number of times the trigger level must be reached before it is triggered.
For example, using the default value, if the mailbox disk is 90% or more full, it will trigger.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Threshold The number of triggers that will result in an SNMP trap.
For example if the CPU level exceeds the set trigger percentage once before returning to a lower level, and the threshold is set to more than one an SNMP trap will not be generated until that minimum number of triggers occurs during the sample period.
Sample Period(s) The time period in seconds during which the FortiMail unit SNMP Agent counts the number of triggers that occurred.
The default period is 600 seconds (ten minutes).
This value should not be less than the Sample Freq(s).
Sample Freq(s) The interval in seconds between measurements of the trap condition. You will not receive traps faster than this rate, depending on the selected sample period.
The default sample frequency is 30 seconds.
This value should be less than the Sample Period(s).
Communities The list of SNMP communities added to the FortiMail configuration.
Name
Status
Queries
Traps
The name of the SNMP community. The SNMP Manager client must be configured with this name.
A green check mark icon indicates that the community is enabled.
A green check mark icon indicates that queries are enabled.
A green check mark icon indicates that traps are enabled.
Configuring an SNMP community
An SNMP community is a grouping of equipment for SNMP-based network administration purposes. You can add up to three SNMP communities so that SNMP managers can connect to the FortiMail unit to view system information and receive SNMP traps. You can configure each community differently for SNMP traps and to monitor different events. You can add the IP addresses of up to eight SNMP managers to each community.
To configure an SNMP community
1 Go to System > Configuration > SNMP v1/v2c.
2 Click New to add a community, or click to select a community that you want to modify, then click Edit.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
137
Configuring the time, GUI, & SNMP
Figure 74: Configuring an SNMP Community
System
138
Name
Status
Hosts
IP Address
Interface
Delete
Create
Enter a name to identify the SNMP community. If you are editing an existing community, you cannot change the name.
Enable to, if they are enabled, send traps to and allow queries from the community’s SNMP managers.
The list of SNMP managers that can use the settings in this SNMP community to monitor the FortiMail unit. Click Create to create a new entry.
Enter the IP address of an SNMP manager. By default, the IP address is
0.0.0.0, so that any SNMP manager can use this SNMP community.
Select the name of the network interface that connects to the network where this SNMP manager is located. You need to do this if the SNMP manager is on the Internet or behind a router.
Click to remove this SNMP manager.
Click to add a new default entry to the Hosts list that you can edit as needed.
You can have up to eight SNMP manager entries for a single community.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Queries
Traps
SNMP Event
Enter the Port number (161 by default) that the SNMP managers in this community use for SNMP v1 and SNMP v2c queries to receive configuration information from the FortiMail unit. Mark the Enable check box to activate queries for each SNMP version.
Enter the Local Port and Remote Port numbers (162 local, 162 remote by default) that the FortiMail unit uses to send SNMP v1 and SNMP v2c traps to the SNMP managers in this community. Enable traps for each SNMP version that the SNMP managers use.
Enable each SNMP event for which the FortiMail unit should send traps to the
SNMP managers in this community.
FortiMail MIBs
The FortiMail SNMP agent supports Fortinet proprietary MIBs as well as standard RFC
1213 and RFC 2665 MIBs. RFC support includes support for the parts of RFC 2665
(Ethernet-like MIB) and the parts of RFC 1213 (MIB II) that apply to FortiMail unit configuration.
The FortiGate MIBs are listed in Table 8 . You can obtain these MIB files from Fortinet technical support. To be able to communicate with the SNMP agent, you must compile all of these MIBs into your SNMP manager.
Your SNMP manager may already include standard and private MIBs in a compiled database that is ready to use. You must add the Fortinet proprietary MIB to this database.
If the standard MIBs used by the Fortinet SNMP agent are already compiled into your
SNMP manager you do not have to compile them again.
Table 8: FortMail MIBs
MIB file name fortimail.mib
fortimail.trap.mib
Description
The proprietary Fortinet MIB includes detailed FortiMail system configuration information. Your SNMP manager requires this information to monitor FortiMail configuration settings. For more information, see
.
The proprietary Fortinet trap MIB includes FortiMail trap information.
Your SNMP manager requires this information to receive traps from the
FortiMail SNMP agent. For more information, see
.
FortiMail traps
The FortiMail unit’s SNMP agent can send traps to SNMP managers that you have added to SNMP communities. To receive traps, you must load and compile the FortMail trap MIB into the SNMP manager.
All traps sent include the trap message as well as the FortiMail unit serial number and host name.
Table 9: FortiMail traps
Trap fmlTrapCpuHighThreshold fmlTrapMemLowThreshold fmlTrapLogDiskHighThreshold
Description
Trap sent if CPU usage becomes too high.
Trap sent if memory usage becomes too high.
Trap sent if Log disk usage becomes too high.
fmlTrapMailDiskHighThreshold fmlTrapAvThresholdEvent
Trap sent if Mailbox disk usage becomes too high.
fmlTrapMailDeferredQueueHighThreshold Trap sent if the number of deferred email messages becomes too great.
Trap sent when the number of detected viruses reaches the threshold.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
139
Configuring the time, GUI, & SNMP
140
System
Table 9: FortiMail traps
Trap fmlTrapSpamThresholdEvent fmlTrapSystemEvent fmlTrapRAIDEvent fmlTrapHAEvent fmlTrapArchiveEvent fmlTrapIpChange
Description
Trap sent when the number of spam email messages reaches the threshold.
Trap sent when system shuts down, reboots, upgrades, etc.
Trap sent for RAID operations.
Trap sent when an HA event occurs.
Trap sent when remote archive event occurs.
Trap sent when the IP address of the specified interface has been changed.
MIB fields
The Fortinet MIB contains fields reporting current FortiMail unit status information. The tables below list the names of the MIB fields and describe the status information available for each one. You can view more details about the information available from all Fortinet
MIB fields by compiling the MIB file into your SNMP manager and browsing the MIB fields.
Table 10: System MIB fields
MIB field fmlSysModel fmlSysSerial fmlSysVersion
Description
FortiMail model number, such as 400 for the FortiMail-400.
FortiMail unit serial number.
The firmware version currently running on the FortiMail unit.
fmlSysVersionAv fmlSysOpMode
The antivirus definition version installed on the FortiMail unit.
The operation mode (gateway, transparent, or server) of the FortiMail unit.
The current CPU usage (%).
fmlSysCpuUsage fmlSysMemUsage The current memory utilization (%).
fmlSysLogDiskUsage The log disk usage (%).
fmlSysMailDiskUsage The mail disk usage (%).
fmlSysSesCount The current IP session count.
fmlSysEventCode fmlRAIDCode
System component events.
RAID system events.
fmlRAIDDevName fmlHAEventId fmlHAUnitIp fmlHAEventReason fmlArchiveServerIp fmlArchiveFilename
RAID device name.
HA event type ID.
Unit IP address where the event occurs.
The reason for the HA event.
IP address of the remote Archive Server.
Archive mail file name.
Table 11: System options MIB fields
MIB field Description fmlSysOptIdleTimeout Idle period after which the administrator is automatically logged out off the system.
fmlSysOptAuthTimeout Authentication idle timeout value.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Table 11: System options MIB fields
MIB field fmlSysOptsLan fmlSysOptsLcdProt
Description
Web administration language.
Whether LCD control buttons protection is enabled or disabled.
Table 12: System session MIB fields
MIB field fmlIpSessTable fmlIpSessEntry fmlIpSessIndex fmlIpSessProto fmlIpSessFromAddr fmlIpSessFromPort fmlIpSessToAddr fmlIpSessToPort fmlIpSessExp
Description
FortiMail IP sessions table.
Particular IP session information.
An index value that uniquely identifies an IP session.
The protocol of the connection.
The session source IP address,
The session source port number.
The session destination IP address.
The session destination port number.
Time (in seconds) until the session expires.
Table 13: Mail options MIB fields
MIB field fmlMailOptionsDeferQ ueue
Description
The current number of deferred email messages.
Customizing the appearance
The Appearance tab enables you to customize the default appearance of the web-based manager, per-recipient quarantine, and webmail pages with your own product name, product logo, and corporate logo.
The webmail’s languages can be customized. If your preferred language is not currently installed, you can add it. You can also adjust the terms in existing language files. This can be useful for localizing terms within a language. For example, you could adjust the English language file to use spellings and terms specific to the locale of the United Kingdom,
Australia, or the United States of America if your email users are most familiar with terminologies popular in those areas.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To customize the appearance of the web-based manager and webmail pages, go to
System > Configuration > Appearance.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
141
Configuring the time, GUI, & SNMP System
Figure 75: Customizing the appearance of the FortiMail web-based manager and webmail
142
Administration Interface
Product name
Top logo
Default language
Enter the name of the product. This name will precede
Administrator Login in the title on the login page of the webbased manager.
Select change to upload a graphic that will appear at the top of all pages in the web-based manager. The image’s dimensions must be 460 pixels wide by 36 pixels tall.
For best results, use an image with a transparent background. Non-transparent backgrounds will not blend with the underlying theme graphic, resulting in a visible rectangle around your logo graphic.
Note: Uploading a graphic overwrites the current graphic.
The FortiMail unit does not retain previous or default graphics. If you want to be able to revert to the current graphic, use your web browser to save a backup copy of the image to your management computer, enabling you to upload it again at a later time.
Select the default language for the display of the web-based manager.
You can configure a separate language preference for each administrator account. For details, see
“Configuring administrator accounts” on page 147
.
Webmail interface
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Webmail language
Webmail language customization
Web mail top logo
Select the language in which webmail pages will be displayed. By default, the FortiMail unit will use the same language as the web-based manager. For web-based
manager language settings, see “Configuring the idle timeout & LCD panel options” on page 135
.
The list of languages installed on the FortiMail unit in
English and in their own language.
• Create: Click to add a new language to the list. See “To add a custom webmail language” on page 143 .
• Download Webmail Language: Select a language in the list, then click this button to download the language’s resource file for that language. You can then edit the resource files using an XML editor that supports UTF-8.
See “To add a custom webmail language” on page 143 .
• Upload: Select a language in the list, then click this button to update the language’s resource file for this language from your management computer to the
FortiMail unit. In addition to uploading new language resource files, you can also use this button to update existing languages.
• Delete: Select a language in the list, then click this button to remove the language. This option is available only for non-default languages.
Click Change to upload a graphic that will appear at the top of all webmail pages. The image’s dimensions must be 314 pixels wide by 36 pixels tall.
Note: Uploading a graphic overwrites the current graphic.
The FortiMail unit does not retain previous or default graphics. If you want to be able to revert to the current graphic, use your web browser to save a backup copy of the image to your management computer, enabling you to upload it again at a later time.
To add a custom webmail language
1 Go to System > Configuration > Appearance.
2 Click the arrow to expand Webmail interface.
3 Underneath the list of language customizations, in Language name in English, enter the name for the language using English and US-ASCII encoding, such as Welsh.
4 In Language name, enter the name for the language using its own characters and
UTF-8 encoding.
5 Click Create.
The new language appears at the bottom of the webmail languages list.
6 Click the new language’s row to select it.
7 Click Download and select Download login page resource file.
8 Click Download again and select Download webmail resource file.
Your web browser downloads both files.
9 Open both files in an XML editor or plain text editor that supports UTF-8 encoding.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
143
Configuring administrator accounts & access profiles System
10 For each value in the resource files, translate the word or phrase that is surrounded by double quotes ( " ). It will appear in the location indicated by the key’s name.
For example:
<resource key="report_spam" value="Report Spam"/> indicates by key="report_spam" that the text is a label for the button that corrects the Bayesian scanner when it has not recognized an email that is spam. You could replace the contents of value (that is, Report Spam) with any text in your language that indicates the button’s function.
11 Save both files. Return to the web-based manager.
12 Click the new language’s row to select it.
13 Click Upload and select Upload login page resource file. Choose the login page resource file that you translated, then click OK.
14 Click Upload again and select Upload webmail resource file. Choose the login page resource file that you translated, then click OK.
15 Click Apply.
To verify your language, log in to FortiMail webmail and review the text that appears on each button, field, and menu item. If the characters appear garbled, verify that your web browser is interpreting the web page using the correct encoding.
Configuring administrator accounts & access profiles
The Administrator menu configures administrator accounts and access profiles.
This topic includes:
•
About administrator account permissions & domains
•
Configuring administrator accounts
•
About administrator account permissions & domains
Depending on the account that you use to log in to the FortiMail unit, you may not have complete access to all CLI commands or areas of the web-based manager.
Access profiles and domain assignments together control which commands and areas an administrator account can access. Permissions result from an interaction of the two.
The domain to which an administrator is assigned can be either:
• System: Can access areas regardless of whether an item pertains to the FortiMail unit itself or to a protected domain. The administrator’s permissions are restricted only by his or her access profile.
• a protected domain: Can only access areas that are specifically assigned to that protected domain. The administrator cannot access system-wide settings, files or statistics, nor most settings that can affect other protected domains, regardless of whether access to those items would otherwise be allowed by his or her access profile.
The administrator cannot access the CLI, nor the basic mode of the web-based
.)
144
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Note: IP-based policies, the global black list, and the global white list, the blacklist action, and the global Bayesian database are exceptions to this rule. Domain administrators can configure them, regardless of the fact that they could affect other domains. If you do not want to allow this, do not provide Read-Write permission to those categories in domain administrators’ access profiles.
Table 14: Areas of the GUI (advanced mode) that cannot be accessed by domain administrators
Maintenance
Monitor except for the Personal quarantine tab
System except for the Administrator tab
Mail Settings except for the domain, its subdomains, and associated domains
User > User > PKI User
Policy > Access Control > Receive
Policy > Access Control > Delivery
Profile > Authentication
AntiSpam except for AntiSpam > Bayesian > User and AntiSpam > Black/White List
Email Archiving
Log and Report
Access profiles assign either read, write, or no access to each area of the FortiMail software. To view configurations, you must have read access. To make changes, you must have write access. For more information on configuring an access profile that administrator accounts can use, see
“Configuring access profiles” on page 149
.
Table 15: Areas of control in access profiles
Access control area name
In the web-based manager
In the CLI
Grants access to
(For each config command, there is an equivalent get/show command, unless otherwise noted.
config access requires write permission. get/show access requires read permission.)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
145
Configuring administrator accounts & access profiles
146
System
Table 15: Areas of control in access profiles
Policy
Black/White List
Quarantine
Others policy Monitor > Mail Queue ...
Monitor > Greylist ...
Monitor > Sender Reputation > Display
Mail Settings > Domains > Domains
Mail Settings > Proxies > Proxies
User > User ...
Policy ...
Profile ...
AntiSpam > Greylist ...
AntiSpam > Bounce Verification > Settings
AntiSpam > Endpoint Reputation ...
AntiSpam > Bayesian ... blackwhite-list config antispam greylist exempt config antispam bounce-verification key config antispam settings config domain config mailsetting proxy-smtp config policy ...
config profile ...
config user ...
Monitor > Endpoint Reputation > Auto Blacklist
Maintenance > AntiSpam >
Black/White List Maintenance
AntiSpam > Black/White List ...
N/A quarantine Monitor > Quarantine ...
AntiSpam > Quarantine > Quarantine Report
AntiSpam > Quarantine > System Quarantine Setting
AntiSpam > Quarantine > Control Account others config antispam quarantine-report config mailsetting systemquarantine
Monitor > System Status ...
Monitor > Archive > Email Archives
Monitor > Log ...
Monitor > Report ...
Maintenance ... except the
Black/White List Maintenance tab
System ...
Mail Settings > Settings ...
Mail Settings > Address Book > Address Book
User > User Alias > User Alias
User > Address Map > Address Map
Email Archiving ...
Log and Report ... config archive ...
config log ...
config mailsetting relayserver config mailsetting storage config report config system ...
config user alias config user map diagnose ...
execute ...
get system status
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Unlike other administrator accounts whose Access profile is super_admin_prof and
Domain is System, the admin administrator account exists by default and cannot be deleted. The admin administrator account is similar to a root administrator account. This administrator account always has full permission to view and change all FortiMail configuration options, including viewing and changing all other administrator accounts. It is the only administrator account that can reset another administrator’s password without being required to enter the existing password. As such, it is the only account that can reset another administrator’s password if that administrator forgets his or her password. Its name, permissions, and assignment to the System domain cannot be changed.
Caution: Set a strong password for the admin administrator account, and change the password regularly. By default, this administrator account has no password. Failure to maintain the password of the admin administrator account could compromise the security of your FortiMail unit.
Configuring administrator accounts
The Administrator tab displays a list of the FortiMail unit’s administrator accounts, and displays the IP addresses from which administrator logins can be attempted (trusted hosts).
By default, FortiMail units have a single administrator account, admin. For more granular control over administrative access, you can create additional administrator accounts that are restricted to being able to configure a specific protected domain and/or with restricted permissions. For more information, see
“About administrator account permissions & domains” on page 144 .
Depending on the permission and assigned domain of your account, this list may not display all other administrator accounts. For more information, see
“About administrator account permissions & domains” on page 144 .
Note: If you have configured a system quarantine administrator account, this account does
not appear in the list of standard FortiMail administrator accounts. For more information on the system quarantine administrator account, see
“Configuring the system quarantine administrator account & disk quota” on page 387 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Others category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of administrator accounts, go to System > Administrator > Administrator.
Figure 76: Viewing the list of administrator accounts
Name
Domain
The name of the administrator account.
The entire FortiMail unit (if blank) or name of a protected domain to which an administrator account is assigned.
For more information on protected domain assignments, see
“About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
147
Configuring administrator accounts & access profiles System
Auth Type The local or remote type of authentication that the administrator can use:
• Local
• RADIUS
• RADIUS + Local
• PKI
For details on each authentications type, see
“Configuring authentication profiles” on page 330
and “Configuring PKI authentication” on page 248 .
Trusted Hosts The IP address and netmask from which the administrator can log in.
Access Profile The access profile that determines the permissions of the administrator account.
For details, see “Configuring access profiles” on page 149 .
To configure an administrator account
1 Go to System > Administrator > Administrator.
2 Either click New to add an account, or click to select an account that you want to modify, then click Edit.
3 Configure the following:
Figure 77: Configuring an administrator account
148
Administrator Enter the name for this administrator account.
Domain Select the entire FortiMail unit (System) or name of a protected domain such as example.com to which this administrator account will be assigned.
For more information on protected domain assignments, see
“About administrator account permissions & domains” on page 144 .
Note: If Domain is a protected domain, the administrator will not be able to use the CLI, nor the basic mode of the web-based manager.
Password
Confirm password
Enter this account’s password.
The password can contain any character except spaces.
This field does not appears if Auth type is not Local or RADIUS+Local.
Caution: Do not enter a FortiMail administrator password less than six characters long. For better security, enter a longer password with a complex combination of characters and numbers, and change the password regularly.
Failure to provide a strong password could compromise the security of your
FortiMail unit.
Enter this account’s password again to confirm it.
This field does not appears if Auth type is not Local or RADIUS+Local.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Trusted Host #1 Enter an IP address or subnet from which this administrator can log in.
If you want the administrator to be able to access the FortiMail unit from any IP address, type 0.0.0.0/0.0.0.0.
Enter the IP address and netmask in dotted decimal format. For example, you might permit the administrator to log in to the FortiMail unit from your private network by typing 192.168.1.0/255.255.255.0.
Note: For additional security, restrict all trusted host entries to administrative hosts on your trusted private network. For example, if your FortiMail administrators log in only from the 10.10.10.10/26 subnet, to prevent possibly fraudulent login attempts from unauthorized locations, you could configure that subnet in the Trusted Host #1, Trusted Host #2, and Trusted Host #3 fields.
Note: For information on restricting administrative access protocols that can
be used by these hosts, see “Editing network interfaces” on page 123 .
Trusted Host #2 Enter an IP address or subnet from which this administrator can log in.
Trusted Host #3 Enter an IP address or subnet from which this administrator can log in.
Permission Select the permissions of this administrator account:
• all (also known as Administrator)
• Read & Write
• Read Only
Access profile Select the name of an access profile that determines which functional areas
Management mode
Select which display mode of the web-based manager, Basic or Advanced, will initially appear when this administrator logs in.
This is only which display mode will appear when the administrator logs in.
They may switch the theme at any time during their session by clicking
Basic Mode >> or Advanced Mode >>.
For details, see “Basic mode vs. advanced mode” on page 36
.
Auth type Select the local or remote type of authentication that the administrator will be able to use:
• Local
• RADIUS
• RADIUS+Local
• PKI
Note: RADIUS and PKI authentication require that you first configure a
RADIUS authentication profile or PKI user in the advanced mode of the web-
based manager. For more information, see “Configuring authentication profiles” on page 330
and “Configuring PKI authentication” on page 248 .
Select language
Select this administrator account’s preference for the display language of the web-based manager.
Select theme Select this administrator account’s preference for the display theme.
This is only which theme will appear when the administrator logs in. They may switch the theme at any time during their session by clicking Next Theme.
4 Click Create.
Configuring access profiles
The Access Profile tab displays a list of access profiles.
Access profiles, in conjunction with the domain to which an administrator account is assigned, govern which areas of the web-based manager and CLI that an administrator can access, and whether or not they have the permissions necessary to change the configuration or otherwise modify items in each area.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
149
Configuring administrator accounts & access profiles System
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of administrator accounts, go to System > Administrator > Access Profile.
Figure 78: Viewing the list of administrator access profiles
Name
(Green dot in column heading.)
The name of the administrator access profile.
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
Note: The access profile named super_admin_prof is always used by the admin administrator account, and cannot be deleted. In this case, a grey dot indicates only that the profile is not being used by any other administrator account.
To configure an access profile
1 Go to System > Administrator > Access Profile.
2 Either click New to add an account, or double-click to select an access profile that you want to modify.
3 Configure the following:
Figure 79: Configuring an access profile
150
Profile Name
Access Control
Enter the name for this access profile.
For each area of the configuration, select the permissions that will be granted to administrator accounts associated with this access profile, either:
• None
• Read Only
• Read/Write
4 Click Create.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Configuring RAID
The RAID submenu enables you to configure a redundant array of independent disks
(RAID) for the FortiMail hard disks that are used to store logs and email.
Most FortiMail models can be configured to use RAID with their hard disks. The default
RAID level should give good results, but you can modify the configuration to suit your individual requirements for enhanced performance and/or reliability. For more information,
see “Configuring RAID for FortiMail-400 models” on page 152
or
FortiMail-2000A/B or FortiMail-4000A models” on page 154
.
You can configure the RAID levels for the local disk partitions used for storing email files or log files (in the case of FortiMail-400), depending on your requirements for performance, resiliency, and cost.
RAID events can be logged and can be reported with alert email. These events include
disk full, or disk failure notices. For more information, see “About FortiMail logging” on page 437
, and
“Configuring alert email” on page 447
.
Note: If your FortiMail model does not support RAID, the tab in the RAID menu displays the message, RAID is not available on this system.
About RAID levels
Supported RAID levels vary by FortiMail model.
FortiMail-400 models use software RAID controllers which supports RAID levels 0 or 1.
You can configure the log disk with a RAID level that is different from the email disk.
FortiMail-2000A and FortiMail-4000A models use hardware RAID controllers that require that the log disk and mail disk use the same RAID level.
The following tables describe RAID levels supported by each FortiMail model.
Table 16: RAID levels supported for FortiMail-400
RAID 0 Has striping but no redundancy of data. It offers the fastest performance but has no faulttolerance — if any hard disk fails, the whole RAID fails. So adding more disks to a RAID
0 array increases the risk of failure.
Also known as a striped array.
RAID 1 Consists of at least two drives that duplicate the storage of data. There is no striping.
Read performance is improved since either disk can be read at the same time. Write performance is the same as for single disk storage. This technique provides the best performance and the best fault-tolerance in a multi-user system. In a RAID 1 with two hard disks, one hard disk can fail and the RAID will continue to function.
You should replace any failed drive as soon as possible. Until that failed drive is replaced, the RAID is essentially running as a RAID 0.
Also known as a mirrored array.
Table 17: RAID levels supported for FortiMail-2000A and FortiMail-4000A
RAID 10
RAID 10 + hot spare(s)
(4000A model)
A combination of RAID 1 and RAID 0 (see
Table 16 ), also called RAID 1+0. Striped
and mirrored arrays are good for fault tolerance and high performance, such as for high-load databases. RAID 10 requires a minimum of four drives. Adding two additional drives to the array will add another RAID 1.
Any RAID 1 in the array can have a hard disk failure and continue to function, but if both hard disks in a RAID 1 fail then the whole RAID fails.
A RAID 10 configuration that has a backup hard disk installed that takes the place of a failed RAID hard disk. The RAID 10 + hot spares must use at least five drives, one spare in addition to the RAID 10 drives. To add another RAID 1, you would need seven drives total because at least one hot spare drive is required.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
151
Configuring RAID System
Table 17: RAID levels supported for FortiMail-2000A and FortiMail-4000A
RAID 50
RAID 50 + hot spare(s)
(4000A model)
A combination of RAID 5 with RAID 0 (see
Table 16 ). RAID 5 provides data striping
at the byte level and also stripe error correction information. This results in excellent performance and good fault tolerance.
The RAID 50 array type provides fault tolerance and high performance. It requires a minimum of six drives. To add another RAID 5 requires an additional three hard disks.
A RAID 50 configuration that has a backup hard disk installed that takes the place of a failed RAID hard disk. The RAID 50 + hot spares must use at least seven drives, one spare in addition to the RAID 50 drives.
Hot spares
FortiMail models with a hardware RAID controller, such as the FortiMail-4000A and
FortiMail-2000A, have a hot spare RAID option. This feature consists of one or more disks that are pre-installed with the other disks in the unit. The hot spare disk is idle until an active hard disk in the RAID fails. Then the RAID immediately puts the hot spare disk into service and starts to rebuild the data from the failed disk onto it. This rebuilding may take up to several hours depending on system load and amount of data stored on the RAID, but the RAID continues without interruption during the process.
The hot spare feature has one or more extra hard disks installed with the RAID. A RAID 10 configuration requires two disks per RAID 1, and can have only one hot spare disk. A
RAID 50 configuration requires three disks per RAID 5, and can have up to two hot spare disks.
Configuring RAID for FortiMail-400 models
To configure RAID, go to System > RAID > RAID System.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
Figure 80: Configuring RAID (FortiMail-400)
152
Device
Unit
The name of the RAID unit, which indicates whether it is used for log message data or for mailboxes, mail queues, and other email-related data. This is hard-coded and not configurable.
The internal mount point of the RAID unit. This is hard-coded and not configurable.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Level The RAID level that indicates whether it is configured for optimal speed, failure tolerance, or both. For more information on RAID
levels, see “About RAID levels” on page 151
.
Click to change the RAID level, either:
• RAID 0
• RAID 1
Resync Action The status of the RAID device.
• idle: The RAID is idle, with no data being written to or read from the RAID disks.
• dirty: Data is currently buffered, waiting to be written to disk.
• clean: No data is currently buffered, waiting to be written to the
RAID unit.
• errors: Errors were detected on the RAID unit.
• no-errors: No errors were detected on the RAID unit.
• dirty no-errors: Data is currently buffered, waiting to be written to the RAID unit, and there are currently no detected RAID errors.
For a FortiMail unit in active use, this is the expected setting.
• clean no-errors: No data is currently buffered, waiting to be written to the RAID unit, and there are currently no RAID errors.
For a FortiMail unit with an unmounted array that is not in active use, this is the expected setting.
Resync Status If the RAID unit is not synchronized and you have clicked Click here
to check array to cause it to rebuild itself, such as after a hard disk is replaced in the RAID unit, a progress bar indicates rebuild progress.
The progress bar appears only when Click here to check array has been clicked and the status of the RAID is not clean no-errors.
Speed Displays the average speed in kilobytes (KB) per second of the data transfer for the resynchronization. This is affected by the disk being in use during the resynchronization.
Refresh Click to manually initiate the tab’s display to refresh itself with current information.
Array Details
Percentage
Done
Enables you to remove or recover disks for the array.
Displays the percentage of resynchronization that remains to be completed.
Displays the amount of the resynchronization that has been completed, including as a percentages and as the number of kilobytes completed and the size of the disk.
Finished in
Speed
Display the estimated time in hours, minutes, seconds until the current resynchronization is complete, assuming that the current speed is maintained.
Displays the average speed in kilobytes (KB) per second of the resynchronization.
If a disk is in use during resynchronization, resynchronization may be slower.
Click here to check array Click to rebuild the RAID unit and start a diagnostic check on this
RAID. The progress is displayed in the Resync Status section.
Note: This link has no effect and a rebuild cannot be performed if the status of the RAID is clean no-errors.
To change RAID levels
Caution: Back up data on the disk before beginning this procedure. Changing the device’s
RAID level temporarily suspends all mail processing and erases all data on the hard disk.
For more information on creating a backup, see
“Backup and restore” on page 97
.
1 Go to System > RAID > RAID System.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
153
Configuring RAID System
2 In the Level column, click the row corresponding to the RAID device whose RAID level you want to change.
The Level field changes to a drop-down menu.
3 Select RAID level 0 or 1.
4 Click Apply.
A warning message appears.
5 Click Yes to confirm the change.
Configuring RAID on FortiMail-2000A/B or FortiMail-4000A models
To configure RAID, go to System > RAID > RAID System.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
Figure 81: Configuring RAID (FortiMail-2000A/B and FortiMail-4000A)
154
Model
Driver
Firmware
The model of the hardware RAID controller.
The version of the RAID controller’s driver software.
The version of the RAID controller’s firmware.
Set RAID level Select the RAID level, then click Change.
RAID 10 and RAID 50 are available on the FortiMail-2000A/B and
FortiMail-4000/A. Hot spares are available only on the FortiMail-4000A.
For more information, see “About RAID levels” on page 151
.
Change
Re-scan
From Set RAID level, select the RAID style, then click this button to apply
the RAID level.
Click to rebuild the RAID unit with disks that are currently a member of it, or detect newly added hard disks, and start a diagnostic check.
List of RAID units in the array
Unit Indicates the identifier of the RAID unit, such as u0.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Type
Status
Size
Ignore ECC
Indicates the RAID level currently in use. Depending on the FortiMail model, valid types include:
• RAID 10
• RAID 10 + hot spare(s)
• RAID 50
• RAID 50 + hot spare(s)
For more information, see “About RAID levels” on page 151
. To change
the RAID level, use Set RAID level.
Indicates the status of the RAID unit.
• OK: The RAID unit is operating normally.
• Warning: The RAID controller is currently performing a background task (rebuilding, migrating, or initializing the RAID unit).
Caution: Do not remove hard disks while this status is displayed.
Removing hard disks that are in active use could cause hardware damage.
• Error: The RAID unit is degraded or inoperable. Causes vary, such as when too many hard disks in the unit fail and the RAID unit no longer has the minimum number of disks required to operate in your selected
RAID level. To correct such a situation, you must replace the failed hard disks.
• No Units: No RAID units are available.
Note: If both Error and Warning conditions exist, the status will appear as
Error.
Indicates the total disk space, in gigabytes (GB), available for the RAID unit.
Available space varies by your RAID level selection. Due to some space being consumed to store data required by RAID, available storage space will not equal the sum of the capacities of hard disks in the unit.
Click turn on to ignore the Error Correcting Code (ECC). This option is off by default.
Ignoring the ECC can speed up building the RAID, but the RAID will not be as fault-tolerant.
This option is not available on FortiMail-2000B models.
List of hard disks in the array
ID/Port Indicates the identifier of each hard disk visible to the RAID controller.
Part of Unit
Status
Indicates the RAID unit to which the hard disk belongs, if any.
To be usable by the FortiMail unit, you must add the hard disk to a RAID unit.
Indicates the hardware viability of the hard disk.
• OK: The hard disk is operating normally.
• UNKNOWN: The viability of the hard disk is not known. Causes vary, such as the hard disk not being a member of a RAID unit. In such a case, the RAID controller does not monitor its current status.
Size
Delete
Indicates the capacity of the hard disk, in gigabytes (GB).
Click to unmount a hard disk before swapping it.
After replacing the disk, add it to a RAID unit, then click Re-scan.
To change RAID levels
Caution: Back up data on the disk before beginning this procedure. Changing the device’s
RAID level temporarily suspends all mail processing and erases all data on the hard disk.
For more information on creating a backup, see
“Backup and restore” on page 97
.
1 Go to System > RAID > RAID System.
2 From Set RAID level to, select a RAID level.
3 Click Change.
The FortiMail unit changes the RAID level and reboots.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
155
Using high availability (HA) System
To replace a disk in the array
When replacing a disk in the RAID array, the new disk must have the same or greater storage capacity than the existing disks in the array. If the new disk has a larger capacity than the other disks in the array, only the amount equal to the smallest hard disk will be used. For example, if the RAID has 400 GB disks, and you replace one with a 500 GB disk, to be consistent with the other disks, only 400 GB of the new disk will be used.
FortiMail units support hot swap; shutting down the FortiMail unit during hard disk replacement is not required.
1 Go to System > RAID > RAID System.
2 In the row corresponding to the hard disk that you want to replace (for example, p4), click to select the hard disk, then click Delete.
The RAID controller removes the hard disk from the list.
3 Protect the FortiMail unit from static electricity by using measures such as applying an anti-static wrist strap.
4 Physically remove the hard disk that corresponds to the one you removed in the webbased manager from its drive bay on the FortiMail unit.
On a FortiMail-2000A or FortiMail-4000A, press in the tab, then pull the drive handle to remove the dive. On a FortiMail-2000B, press the button to eject the drive.
To locate the correct hard disk to remove on a FortiMail-2000A, refer to the following diagram.
Drive 1 (p0)
Drive 2 (p1)
Drive 3 (p2)
Drive 4 (p3)
Drive 5 (p4)
Drive 6 (p5)
To locate the correct hard disk to remove on a FortiMail-2000B, refer to the following diagram.
Drive 1 (p0)
Drive 2 (p1)
Drive 3 (p2)
Drive 4 (p3)
Drive 5 (p4)
Drive 6 (p5)
To locate the correct hard disk to remove on a FortiMail-4000A, look for the failed disk.
(Disk drive locations vary by the RAID controller model.)
5 Replace the hard disk with a new hard disk, inserting it into its drive bay on the
FortiMail unit.
6 Click Re-scan.
The RAID controller will scan for available hard disks and should locate the new hard disk. Depending on the RAID level, the FortiMail unit may either automatically add the new hard disk to the RAID unit or allocate it as a spare that will be automatically added to the array if one of the hard disks in the array fails.
The FortiMail unit rebuilds the RAID array with the new hard disk. Time required varies by the size of the array.
Using high availability (HA)
The High Availability submenu enables you to configure the FortiMail unit to act as a member of a high availability (HA) cluster in order to increase processing capacity or availability. It also enables you to monitor the HA cluster.
156
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
For the general procedure of how to enable and configure HA, see “How to use HA” on page 162
.
This topic includes:
•
•
About the heartbeat & synchronization
•
About logging, alert email, & SNMP in HA
•
•
•
Configuring the HA mode & group
•
Configuring service-based failover
•
•
Example: Active-passive HA group in gateway mode
About high availability
FortiMail units can operate in one of two HA modes:
Table 18: Comparison of HA modes
Active-passive HA
2 FortiMail units in the HA group
Config-only HA
2-25 FortiMail units in the HA group
Typically deployed behind a switch Typically deployed behind a load balancer
Both configuration* and data synchronized Only configuration* synchronized
Only primary unit processes email
No data loss when hardware fails
Failover protection, but no increased processing capacity
All units process email
Data loss when hardware fails
Increased processing capacity, but no failover protection
.
Figure 82: Active-passive HA group operating in gateway mode
Mail Server
Internal network
Internet
Switch
Switch
Active-passive
HA Group
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
157
Using high availability (HA)
Figure 83: Config-only HA group operating in gateway mode
Mail Server
Internal network
158
System
Internet
Load balancer
Config only mode HA Group
Note: If the config-only HA group is installed behind a load balancer, the load balancer stops sending email to failed FortiMail units. All sessions being processed by the failed
FortiMail unit must be restarted and will be re-directed by the load balancer to other
FortiMail units in the config-only HA group.
You can mix different FortiMail models in the same HA group. However, all units in the HA group must have the same firmware version.
Note: When mixing FortiMail models, the HA group is limited by the capacity and configuration limits of the least powerful model. For details on configuration maximums, see
“Appendix B: Maximum Values Matrix” on page 487 .
Communications between HA cluster members occur through the heartbeat and synchronization connection. For details, see
“About the heartbeat & synchronization” on page 159
.
To configure FortiMail units that are operating in HA mode, you will usually connect only to the primary unit (master). The primary unit’s configuration is almost entirely synchronized to backup unit(s) (slave), so that changes made to the primary unit are propagated to the backup unit(s).
Exceptions to this rule include connecting to a backup unit in order to view log messages recorded about the backup unit itself on its own hard disk, and connecting to a backup unit
Note: If the HA cluster will use FortiGuard Antivirus or FortiGuard Antispam, license all
FortiMail units in the cluster. If you license only the primary unit in an active-passive HA group, after a failover, the backup unit will not be able to connect to the FortiGuard
Antispam service; for FortiMail units in a config-only HA group, only the licensed unit will be able to use the subscription services.
For the general procedure of how to enable and configure HA, see “How to use HA” on page 162
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
About the heartbeat & synchronization
Heartbeat and synchronization traffic consists of TCP packets that are transmitted between the FortiMail units in the HA group through the primary and secondary heartbeat interfaces.
Note: Service monitoring traffic can also, for short periods, be used as a heartbeat. For details, see “Remote services as heartbeat” on page 173 .
Heartbeat and synchronization traffic has three primary functions:
• to monitor the responsiveness of the HA group members
• to synchronize configuration changes* from the primary unit to the backup unit(s)
• to synchronize mail data from the primary unit to the backup unit (active-passive only)
.
Mail data consists of the FortiMail system mail directory, user home directories, and MTA spool directories.
Note: FortiGuard Antispam packages and FortiGuard Antivirus engines and definitions are not synchronized between primary and backup units.
When the primary unit’s configuration changes, it immediately synchronizes the change to the backup unit (or, in a config-only HA group, the peer units) through the primary heartbeat interface. If this fails, or if you have inadvertently de-synchronized the backup
unit’s configuration, you can manually initiate synchronization. For details, see “click
HERE to start a configuration/data sync” on page 166
.
During normal operation, the backup unit expects to constantly receive heartbeat traffic from the primary unit. Loss of the heartbeat signal interrupts the HA group, and, if it is active-passive in style, generally triggers a failover. Exceptions include restarts and the execute reload CLI command. Normally, this would be enough time to determine that the primary unit has failed. However, to prevent this type of false failover, before rebooting or reloading the configuration, the primary unit signals to the backup unit to wait for the primary unit to complete the restart or reload.
Behavior when the heartbeat fails varies by your HA mode:
• Active-passive HA: A new primary unit is elected: the backup unit becomes the new primary unit and assumes the duty of processing of email. During the failover, no mail data or configuration changes are lost, but some in-progress email deliveries may be interrupted. These interrupted deliveries may need to be restarted, but most email clients and servers can gracefully handle this. Additional failover behaviors may be
configured. For details, see “On failure” on page 171 .
Note: Maintain the heartbeat connection. If the heartbeat is accidentally interrupted for an active-passive HA group, such as when a network cable is temporarily disconnected, the backup unit will assume that the primary unit has failed, and become the new primary unit.
If no failure has actually occurred, both FortiMail units will be operating as primary units simultaneously. For details on correcting this, see
“click HERE to restore configured operating mode” on page 166 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
159
Using high availability (HA) System
• Config-only HA: Each backup unit continues to operate normally. However, with no primary unit, changes to the configuration are no longer synchronized. You must manually configure one of the backup units to operate as the primary unit, synchronizing its changes to the remaining backup units.
For failover examples and steps required to restore normal operation of the HA group in each case, see
“Example: Failover scenarios” on page 177 .
Configuration settings that are not synchronized
All configuration settings on the primary unit are synchronized to the backup unit, except for the following:
Operation mode
Host name
Interface configuration
(gateway and server mode only)
You must set the operation mode (gateway, transparent, or server) of each
HA group member before configuring HA. For details, see “Operation mode” on page 54 .
The host name distinguishes members of the cluster. For details, see “Host name” on page 202
.
Each of the FortiMail units in the HA group must be configured with different network interface settings for connectivity purposes. For details, see
“Configuring the network interfaces” on page 121 .
Exceptions include some active-passive HA settings which affect the interface configuration for failover purposes. These settings are
synchronized. For details, see “Virtual IP Address” on page 174
.
Each of the FortiMail units in the HA group should be configured with different management IP addresses for connectivity purposes. For details,
see “About the management IP” on page 122
.
Management IP address
(transparent mode only)
SNMP system information
Each of the FortiMail units in the HA group will have its own SNMP system information, including the Description, Location, and Contact. For details,
see “Configuring SNMP queries & traps” on page 135 .
RAID configuration RAID settings are hardware-dependent and determined at boot time by looking at the drives (for software RAID) or the controller (hardware RAID), and are not stored in the system configuration. Therefore, they are not synchronized.
Main HA configuration
HA Daemon configuration
The main HA configuration, which includes the HA mode of operation (such as master or slave) is not synchronized, because this configuration must be different on the primary and backup units. For details, see
HA mode & group” on page 168 .
The following HA daemon settings are not synchronized:
• Shared password
• Backup mail data directories
• Backup MTA queue directories
You must add the shared HA password to each unit in the HA group. All units in the HA group must use the same shared password to identify the group.
Synchronized HA daemon options that are active-passive HA settings affect how often the backup unit tests the primary unit and how the backup unit synchronizes configuration and mail data. Because HA daemon settings on the backup unit control how the HA daemon operates, in a functioning HA group you would change the HA daemon configuration on the backup unit to change how the HA daemon operates. The HA daemon settings on the primary unit do not affect the operation of the HA daemon.
Note: In some active-passive HA groups, you may want to have different
HA daemon configurations on the primary and backup units. For example, after a failover, if the failed primary unit restarts and becomes a backup unit, you might not want the new backup unit to synchronize with the new primary unit in the same way as when the HA group is functioning normally.
160
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
HA service monitoring configuration
In active-passive HA, the HA service monitoring configuration is not synchronized. The remote service monitoring configuration on the backup unit controls how the backup unit checks the operation of the primary unit.
The local services configuration on the primary unit controls how the primary unit tests the operation of the primary unit. For details, see
“Configuring service-based failover” on page 175 .
Note: You might want to have a different service monitoring configuration on the primary and backup units. For example, after a failover you may not want service monitoring to operate until you have fixed the problems that caused the failover and have restarted normal operation of the HA group.
Config-only HA network settings and names
In config-only HA:
•
static routes (see “Configuring static routes” on page 128 )
•
the local domain name (see “Local domain name” on page 202 )
• the quarantine report host name (see
“Web release host name/IP” on page 382
)
Synchronization of the MTA spool directory after a failover
During normal operation, email messages are in one of two states:
• being received or sent by the primary unit
• stored on the primary unit the system mail directory, the user home directories, or the
MTA spool directories (which includes the outgoing mail directory)
When normal operation of an active-passive HA group is interrupted and a failover occurs, sending and receiving is interrupted. The delivery attempt fails, and the sender usually retries to send the email message. However, stored messages remain in the primary unit’s
MTA mail directory.
You usually should configure HA to synchronize the system mail directory and the user home directory to prevent loss of stored email messages, but you usually will not want to regularly synchronize MTA spool directories.
This is because, to prevent loss of email messages in the failed primary unit, FortiMail units in active-passive HA use the following failover mechanism:
Note: If the failed primary unit effective operating mode is failed, a sequence similar to the following occurs automatically when the problem that caused the failure is corrected.
1 The backup unit detects the failure of the primary unit, and becomes the new primary unit.
2 The former primary unit restarts, detects the new primary unit, and becomes a backup unit.
Note: You may have to manually restart the failed primary unit.
3 The former primary unit synchronizes its MTA spool directories with the new primary unit.
This synchronization occurs through the heartbeat link between the primary and backup units, and prevents duplicate email messages from forming in the primary unit’s MTA spool directories.
4 The new primary unit delivers email in its MTA spool directories, including email messages synchronized from the new backup unit.
As a result, as long as the failed primary unit can restart, no email is lost from the MTA spool directories.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
161
Using high availability (HA)
162
System
Even if you choose to synchronize MTA spool directories, because their contents change very rapidly and synchronization is periodic, there is a chance that some of the email in these directories will not have been synchronized at the exact moment a failover occurs.
About logging, alert email, & SNMP in HA
To configure logging and alert email, configure the primary unit and enable HA events.
When the configuration changes are synchronized to the backup unit(s), all of the
FortiMail units in the HA group record their own separate log messages and send separate alert email messages. Log data is not synchronized. For details on configuring logging and viewing log messages, see
Note: To distinguish alert email from each member of the HA cluster, configure a different
host name for each member. For details, see “Host name” on page 202 .
To configure SNMP, configure each cluster member separately and enable HA events for the community. If you enable SNMP for all of these units, they can all send SNMP traps.
Additionally, you can use an SNMP server to monitor the primary and backup units for HA settings such as the HA configured and effective operating modes. For details on configuring SNMP, see
“Configuring SNMP queries & traps” on page 135 .
Note: To aid in quick discovery and diagnosis of network problems, consider configuring
SNMP, Syslog, and/or alert email to monitor the HA cluster for failover messages.
Getting HA information using SNMP
You can use an SNMP manager to get information about how FortiMail HA is operating.
The FortiMail MIB (fortimail.mib) and the FortiMail trap MIB (fortimail.trap.mib) include the
HA fields listed in Table 19 .
Table 19: New HA FortiMail MIB and FortiMail trap MIB fields
MIB Field fortimail.mib
fmlHAEventId fmlHAUnitIp
Description
The ID of the most recent HA event.
The IP address of the port1 interface of the FortiMail unit on which an HA event occurred.
fmlHAEventReason A description of the reason for the HA event. fmlHAMode The HA configured operating mode. The HA operating mode that you have configured the FortiMail unit to operate in. Configured operating mode can be master (primary unit) or slave (backup unit).
fmlHAEffectiveMode The effective HA operating mode (applies to active-passive HA only), either as the primary unit or as the backup unit. The effective operating mode matches the configured operating mode unless a failure has occurred.
fortimail.trap.mib
fmlTrapHAEvent The FortiMail HA trap that is sent when an HA event occurs. This trap includes the contents of the fmlSysSerial, fmlHAEventId, fmlHAUnitIp, and fmlHAEventReason MIB fields.
How to use HA
In general, to enable and configure HA, you should perform the following:
1 If the HA cluster will use FortiGuard Antivirus and/or FortiGuard Antispam services, license all of the FortiMail units in the HA group for the FortiGuard Antispam and
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
FortiGuard Antivirus services, and register them with the Fortinet Technical Support web site, https://support.fortinet.com/ .
2 Physically connect the FortiMail units that will be members of the HA cluster.
You must connect at least one of their network interfaces, which will be used for heartbeat and synchronization traffic between members of the cluster. For reliability reasons, Fortinet recommends that you connect both a primary and a secondary heartbeat interface, and that they be connected directly or through a dedicated switch that is not connected to your overall network.
3 For config-only clusters, configure each member of the cluster to store mail data on a
NAS server that supports NFS connections. (Active-passive groups may also use a
NAS server, but do not require it.) For details, see
“Selecting the mail data storage location” on page 208 .
4 On each member of the cluster:
• Enable the HA mode that you want to use (either active-passive or config-only) and select whether the individual member will act as a primary unit (master) or secondary unit (slave) within the cluster. For information about the differences
between the HA modes, see “About high availability” on page 157
.
• Configure the local IP addresses of the primary and secondary heartbeat and synchronization network interfaces.
• For active-passive clusters, configure the behavior upon failover, and how the network interfaces should be configured for whichever FortiMail unit is currently acting as the primary unit. Additionally, if the FortiMail units store mail data on a
NAS, disable mail data synchronization between members.
• For config-only clusters, if the FortiMail unit is a primary unit, configure the IP addresses of its secondary (also called peer) units; if the FortiMail unit is a secondary unit, configure the IP address of its primary (master) unit.
For details, see
“Configuring the HA mode & group” on page 168
.
5 If the HA cluster is active-passive in style, and you want to trigger failover when hardware or a service fails even if the heartbeat connection is still functioning, configure service monitoring. For details, see
“Configuring service-based failover” on page 175 .
6 Monitor the status of each cluster member. For details, see “Monitoring the HA status” on page 163
. To monitor HA events through log messages and/or alert email, you must
first enable logging of HA activity events. For details, see “Log & Report” on page 437 .
Monitoring the HA status
The Status tab in the High Availability submenu enables you to view the configured operating mode of a FortiMail unit in an HA group, and to manually initiate synchronization. It also enables you to reset the operating mode of a FortiMail unit whose effective operating mode has become different than its configured operating mode, such as after a failover when a configured primary unit is currently acting as a backup unit.
For FortiMail units operating as backup units, the Status tab also enables you to view the status and schedule of the HA synchronization daemon.
Appearance of the Status tab varies by:
• whether the HA group is active-passive or config-only
• whether the FortiMail unit is configured as a primary unit or backup unit
• whether a failover has occurred (active-passive only)
If HA is disabled, this tab displays:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
163
Using high availability (HA) System
HA mode is currently disabled
Before you can use the Status tab, you must first enable and configure HA. For details,
see “Configuring the HA mode & group” on page 168 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the HA operating mode status, go System > High Availability > Status.
Figure 84: Active-passive HA status (primary unit)
Figure 85: Config-only HA status (primary unit)
Figure 86: Active-passive HA status (primary unit after failover)
164
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Mode Status
Configured
Operating Mode
The HA operating mode that you have configured, either:
• master: Configured to be the primary unit of an activepassive group.
• slave: Configured to be the backup unit of an active-passive group.
• config master: Configured to be the primary unit of a config-only group.
• config slave: Configured to be a backup unit of a configonly group.
For information on configuring the operating mode, see
“Mode of operation” on page 171
.
After a failure, the FortiMail unit may not be acting in its configured operating mode. For details, see
For explanations of combinations of configured and effective
.
Effective
Operating Mode
The mode that the unit is currently operating in, either:
• master: Acting as primary unit.
• slave: Acting as backup unit.
• off: For primary units, this indicates that service/interface monitoring has detected a failure and has taken the primary unit offline, triggering failover. For backup units, this indicates that synchronization has failed once; a subsequent failure will trigger failover. For details, see
and “click HERE to restart the HA system” on page 166
.
• failed: Service/network interface monitoring has detected a failure and the diagnostic connection is currently determining whether the problem has been corrected or failover is required. For details, see
.
The configured operating mode matches the effective operating mode unless a failure has occurred.
For example, after a failover, a FortiMail unit configured to operate as a backup unit could be acting as the new primary unit.
For explanations of combinations of configured and effective
.
For information on restoring the FortiMail unit to an effective operating mode that matches the configured operating mode,
see “click HERE to restore configured operating mode” on page 166
.
This option appears only if the FortiMail unit is a member of an active-passive HA group.
Daemon Status
Monitor The time at which the backup unit’s HA daemon will check to make sure that the primary unit is operating correctly, and, if monitoring has detected a failure, the number of times that a failure has occurred.
Monitoring occurs through the heartbeat link between the primary and backup units. If the heartbeat link becomes disconnected, the next time the backup unit checks for the primary unit, the primary unit will not respond. If the maximum number of consecutive failures is reached, and no secondary heartbeat or remote service monitoring heartbeat is available, the backup unit will change its effective operating mode to become the new primary unit.
For details, see “HA base port” on page 173 .
This option appears only for backup units in active-passive HA groups.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
165
Using high availability (HA) System
Configuration The time at which the backup unit’s HA daemon will synchronize the FortiMail configuration from the primary unit to the backup unit.
The message slave unit is currently synchronizing appears when the HA daemon is synchronizing the configuration.
For information on items that are not synchronized, see
“Configuration settings that are not synchronized” on page 160
.
This option appears only for backup units in active-passive HA groups.
Data The time at which the backup unit HA daemon will synchronize mail data from the primary unit to the backup unit.
The message slave unit is currently synchronizing appears when the HA daemon is synchronizing data.
For details, see
“Backup mail data directories” on page 173
and
“Backup MTA queue directories” on page 173 .
This option appears only for backup units in active-passive HA groups.
click HERE to start a configuration/data sync
Click to manually initiate synchronization of the configuration and, for active-passive groups, mail data. For information on
items that are not synchronized, see “Configuration settings that are not synchronized” on page 160
.
click HERE to restore configured operating mode
Click to reset the FortiMail unit to an effective operating mode that matches the FortiMail unit’s configured operating mode.
For example, for a configured primary unit whose effective operating mode is now slave, after correcting the cause of the failover, you might click this option on the primary unit to restore the configured primary unit to active duty, and restore the backup unit to its backup role.
This option appears only if the FortiMail unit is a member of an active-passive HA group.
Note: Before selecting this option, if the effective operating mode changed due to failover, you should resolve any issues that caused the failover.
click HERE to switch to slave mode click HERE to restart the HA system
Click to manually switch the effective operating mode of the primary unit so that it becomes a backup unit.
This option appears only if the FortiMail unit is currently operating as a primary unit.
Click to restart HA processes after they have been halted due to detection of a failure by service monitoring. For details, see
“Configuring service-based failover” on page 175 , and
“Restarting the HA processes on a stopped primary unit” on page 167
.
This option appears only if the FortiMail unit is configured to operate as the primary unit (master), but its effective operating mode is off.
Table 20: Combinations of configured and effective operating modes
Configured
Operating mode
Effective
Operating
Mode master slave master master slave off
Description
Normal for the primary unit of an active-passive HA group.
Normal for the backup unit of an active-passive HA group.
The primary unit has experienced a failure, or the FortiMail unit is in the process of switching to operating in HA mode.
HA processes and email processing are stopped.
166
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Table 20: Combinations of configured and effective operating modes
Configured
Operating mode
Effective
Operating
Mode slave off
Description master master slave failed slave master
The backup unit has detected a failure, or the FortiMail unit is in the process of switching to operating in HA mode.
After the backup unit starts up and connects with the primary unit to form an HA group, the first configuration synchronization may fail in special circumstances. To prevent both the backup and primary units from simultaneously acting as primary units, the effective operating mode becomes off.
If subsequent synchronization fails, the backup unit’s effective operating mode becomes master.
The remote service monitoring or local network interface monitoring on the primary unit has detected a failure, and will attempt to connect to the other FortiMail unit. If the problem that caused the failure has been corrected, the effective operating mode switches from failed to slave, or to match the configured operating mode, depending on the On failure setting.
Additionally, f the HA group is operating in transparent mode, and if the effective operating mode changes to failed, the network interface
IP/netmask on the backup unit displays bridging (waiting for recovery).
For details, see “Configuring the network interfaces” on page 121
.
The primary unit has experienced a failure but then returned to operation. When the failure occurred, the unit configured to be the backup unit became the primary unit. When the unit configured to be the primary unit restarted, it detected the new primary unit and so switched to operating as the backup unit.
The backup unit has detected that the FortiMail unit configured to be the primary unit failed. When the failure occurred, the unit configured to be the backup unit became the primary unit.
Normal for the primary unit of a config-only HA group.
config master
N/A config slave N/A Normal for the backup unit of a config-only HA group.
This topic includes:
•
Restarting the HA processes on a stopped primary unit
Restarting the HA processes on a stopped primary unit
) and either the primary unit or the backup unit detects a service failure on the primary unit, the primary unit changes its effective operating mode to
off, stops processing email, and halts all of its HA processes.
After resolving the problem that caused the failure, you can use the following steps to restart the HA processes on the primary unit.
In this example, resolving this problem could be as simple as reconnecting the cable to the port2 network interface. Once the problem is resolved, use the following steps to restart the stopped primary unit.
To restart a stopped primary unit
1 Log in to the web-based manager of the primary unit.
2 Go to System > High Availability > Status.
3 Select click HERE to restart the HA system.
The primary unit restarts and rejoins the HA group.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
167
Using high availability (HA) System
4 If a failover has occurred due to processes being stopped on the primary unit, and the backup unit is currently acting as the primary unit, you can restore the primary and
.
Configuring the HA mode & group
The Configuration tab in the High Availability submenu enables you to configure most high availability (HA) options, including main aspects such as:
• enabling HA
• selecting whether the HA group is active-passive or config-only in style (for information on the differences, see Table 18 on page 157 )
• whether this individual FortiMail unit will act as a primary unit or a backup unit in the cluster
• network interface(s) that will be used for heartbeat and synchronization
HA settings, with the exception of Virtual IP Address settings, are not synchronized and must be configured separately on each primary and backup unit.
You must maintain the physical link between the heartbeat and synchronization network interfaces. These connections enable cluster members to detect the responsiveness of other members, and to synchronize data. If they are interrupted, normal operation will be interrupted and, for active-passive HA groups, a failover will occur. For more information
on heartbeat and synchronization, see “About the heartbeat & synchronization” on page 159
.
For an active-passive HA group, or a config-only HA group consisting of only two FortiMail units, directly connect the heartbeat network interfaces using a crossover Ethernet cable.
For a config-only HA group consisting of more than two FortiMail units, connect the heartbeat network interfaces through a switch, and do not connect this switch to your overall network.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure most HA options, go to System > High Availability > Configuration.
168
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 87: Active-passive HA (primary unit)
Using high availability (HA)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
169
Using high availability (HA)
Figure 88: Active-passive HA (backup unit)
System
Figure 89: Config-only HA (primary unit with three backup units)
170
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 90: Config-only HA (backup unit)
Using high availability (HA)
Main Configuration
Mode of operation
On failure
Enables or disables HA, selects active-passive or config-only HA, and selects the initial configured role this FortiMail unit in the HA group.
• off: The FortiMail unit is not operating in HA mode.
• master: The FortiMail unit is the primary unit in an active-passive HA group.
• slave: The FortiMail unit is the backup unit in an active-passive HA group.
• config master: The FortiMail unit is the primary unit in a config-only
HA group.
• config slave: The FortiMail unit is a backup unit in a config-only HA group.
Caution: For config-only HA, if the FortiMail unit is operating in server mode, you must store mail data externally, on a NAS server. Failure to store mail data externally could result in mailboxes and other data scattered over multiple FortiMail units. For details on configuring NAS,
see “Storing mail data on a NAS server” on page 174
and “Selecting the mail data storage location” on page 208
Select one of the following behaviors of the primary unit when it detects a failure, such as upon reboot or from service/interface monitoring.
• switch off: Do not process email or join the HA group until you manually select the effective operating mode (see
• wait for recovery then restore original role: On recovery, the failed primary unit‘s effective operating mode resumes its configured operating mode. This behavior may be useful if the cause of failure is temporary and rare, but may cause problems if the cause of failure is permanent or persistent.
• wait for recovery then restore slave role: On recovery, the failed primary unit’s effective operating mode becomes slave (backup), and it then synchronizes the content of its MTA spool directories with the current primary unit. The new primary unit can then deliver email that existed in the former primary unit’s MTA spool at the time of the failover. For information on manually restoring the FortiMail unit to acting in its configured operation mode, see
“click HERE to restore configured operating mode” on page 166 .
In most cases, you should select the wait for recovery then restore slave
role option.
For details on the effects of this option on the Effective Operating Mode,
see Table 20 on page 166 . For information on configuring
service/interface monitoring, see “Configuring service-based failover” on page 175
.
This option appears only if Mode of operation is master.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
171
Using high availability (HA)
172
System
Shared password
Interface
Enter an HA password for the HA group. You must configure the same
Shared Password value on both the primary and backup unit(s).
The name of the network interface.
IP/Netmask
Port monitor
Primary heartbeat
Click to configure the IP address and netmask of the network interface.
This IP address must be different from, but on the same subnet as, the
IP addresses of the other heartbeat network interfaces of other members in the HA group.
Note: When configuring other FortiMail units in the HA group, use this value as the:
• Remote peer IP (for active-passive groups)
• Master configuration (for backup units in config-only groups)
• Peer systems (for the primary unit on config-only groups)
Enable to monitor a network interface for failure. If the port fails, the primary unit will trigger a failover.
This option applies only if local network interface monitoring is enabled.
For details, see
“Configuring service-based failover” on page 175
.
Select the primary network interface for heartbeat and synchronization
traffic. For more information, see “About the heartbeat & synchronization” on page 159 .
This network interface must be connected directly or through a switch to the Primary heartbeat network interface of other members in the HA group.
Caution: Using the same network interface for both HA synchronization/heartbeat traffic and other network traffic could result in issues with heartbeat and synchronization during times of high traffic load, and is not recommended.
Note: In general, you should isolate the network interfaces that are used for heartbeat traffic from your overall network. Heartbeat and synchronization packets contain sensitive configuration information, are latency-sensitive, and can consume considerable network bandwidth.
Secondary heartbeat
Select the secondary network interface for heartbeat and synchronization traffic, or select one of the following other behaviors.
For more information, see “About the heartbeat & synchronization” on page 159
.
• disabled: Do not use the secondary heartbeat.
• any port: Use any network interface whose Virtual IP Address is
do nothing.
The secondary heartbeat interface is the backup heartbeat link between the units in the HA group. If the primary heartbeat link is functioning, the secondary heartbeat link is used for the HA heartbeat. If the primary heartbeat link fails, the secondary link is used for the HA heartbeat and for HA synchronization.
This network interface must be connected directly or through a switch to the Secondary heartbeat network interfaces of other members in the HA group.
This option appears only for active-passive groups.
Caution: Using the same network interface for both HA synchronization/heartbeat traffic and other network traffic could result in issues with heartbeat and synchronization during times of high traffic load, and is not recommended.
Note: In general, you should isolate the network interfaces that are used for heartbeat traffic from your overall network. Heartbeat and synchronization packets contain sensitive configuration information, are latency-sensitive, and can consume considerable network bandwidth.
Remote peer IP Enter the IP address of the matching heartbeat network interface of the other member of the HA group.
For example, if you are configuring the primary unit’s primary heartbeat network interface, enter the IP address of the backup unit’s primary heartbeat network interface.
Similarly, for the secondary heartbeat network interface, enter the IP address of the other unit’s secondary heartbeat network interface.
This option appears only for active-passive HA.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Backup options
Backup mail data directories
For information about configuration synchronization and what is not
synchronized, see “About the heartbeat & synchronization” on page 159
.
Synchronize system quarantine, email archives, email users’ mailboxes
(server mode only), preferences, and per-recipient quarantines.
Unless the HA cluster stores its mail data on a NAS server, you should configure the HA cluster to synchronize mail directories.
If mail data changes frequently, you can manually initiate a data synchronization when significant changes are complete. For details, see
“click HERE to start a configuration/data sync” on page 166
.
This option appears only for active-passive groups.
Backup MTA queue directories
Synchronize the mail queue of the FortiMail unit. For more information
on the mail queue, see “Managing the deferred mail queue” on page 60
.
This option appears only for active-passive groups.
Caution: If the primary unit experiences a hardware failure and you
cannot restart it, if Backup MTA queue directories is disabled, MTA spool
directory data could be lost.
Note: Enabling Backup MTA queue directories is not recommended.
Periodic synchronization can be processor and bandwidth-intensive.
Additionally, because the content of the MTA spool directories is very dynamic, periodically synchronizing MTA spool directories between
FortiMail units may not guarantee against loss of all email in those directories. Even if MTA spool directory synchronization is disabled, after a failover, a separate synchronization mechanism may successfully prevent loss of MTA spool data. For details, see
MTA spool directory after a failover” on page 161 .
Advanced options
HA base port Enter the first of four total TCP port numbers that will be used for:
• the heartbeat signal
• synchronization control
• data synchronization
• configuration synchronization
Note: For active-passive groups, in addition to configuring the heartbeat, you can configure service monitoring. For details, see
“Configuring service-based failover” on page 175
.
Note: In addition to automatic immediate and periodic configuration synchronization, you can also manually initiate synchronization. For details, see
“click HERE to start a configuration/data sync” on page 166 .
Heartbeat lost threshold
Enter the total span of time, in seconds, for which the primary unit can be unresponsive before it triggers a failover and the backup unit assumes the role of the primary unit.
The heartbeat will continue to check for availability once per second. To prevent premature failover when the primary unit is simply experiencing very heavy load, configure a total threshold of three (3) seconds or more to allow the backup unit enough time to confirm unresponsiveness by sending additional heartbeat signals.
This option appears only for active-passive groups.
Note: If the failure detection time is too short, the backup unit may falsely detect a failure when during periods of high load.
Caution: If the failure detection time is too long the primary unit could fail and a delay in detecting the failure could mean that email is delayed or lost. Decrease the failure detection time if email is delayed or lost because of an HA failover.
Remote services as heartbeat
Enable to use remote service monitoring as a secondary HA heartbeat.
If enabled and both the primary and secondary heartbeat links fail or become disconnected, if remote service monitoring still detects that the primary unit is available, a failover will not occur.
This option appears only for active-passive groups.
Note: Using remote services as heartbeat provides HA heartbeat only, not synchronization. To avoid synchronization problems, you should not use remote service monitoring as a heartbeat for extended periods. This feature is intended only as a temporary heartbeat solution that operates until you reestablish a normal primary or secondary heartbeat link.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
173
Using high availability (HA) System
Virtual IP Address
Master configuration
Select whether and how to configure the IP addresses and netmasks of the FortiMail unit whose effective operating mode is currently master.
For example, a primary unit might be configured to receive email traffic through port1 and receive heartbeat and synchronization traffic through
port5 and port6. In that case, you would configure the primary unit to set the IP addresses or add virtual IP addresses for port1 of the backup unit upon failover in order to mimic that of the primary unit.
• do nothing: Do not change the network interface configuration upon failover, and do not monitor. For details on service monitoring for network interfaces, see
“Configuring the network interfaces” on page 121
.
• add virtual IP/netmask: Add the specified virtual IP address and netmask to the network interface upon failover. Normally, you will configure your network (MX records, firewall policies, routing and so on) so that clients and mail services use the virtual IP address. Both originating and reply traffic uses the virtual IP address. This option results in the network interface having two IP Addresses: the actual
and the virtual. For examples, see
“Example: Active-passive HA group in gateway mode” on page 182 .
• add to bridge: Include the network interface in the Layer 2 bridge.
While the effective operating mode is slave, the interface is deactivated and cannot process traffic, preventing Layer 2 loops.
Then, when the effective operating mode becomes master, the interface is activated again and can process traffic. This option appears only if the FortiMail unit is operating in transparent mode, and for FortiMail interfaces that are already members of the bridge.
For information on configuring bridging network interfaces, see
“Editing network interfaces” on page 123
.
Network interface(s) configured as the heartbeat network interface are required to maintain their IP addresses for heartbeat and synchronization purposes, and cannot be configured with the type add
to bridge.
This option appears only for active-passive groups.
Note: Settings in this section are synchronizable. Configure the primary unit, then synchronize it to the backup unit. For details, see
“click HERE to start a configuration/data sync” on page 166
.
Enter the IP address of the primary heartbeat network interface of the primary unit.
The backup unit synchronizes only with this primary unit’s IP address.
This option appears only for backup units in config-only groups.
Peer systems
IP address
Create
Delete
Double-click in order to modify, then enter the IP address of the primary network interface on that backup unit.
This field appears only for the primary unit config-only groups.
Click to add a backup unit to the list of Peer systems, then double-click its IP address.
The primary unit synchronizes only with backup units in the list of Peer
systems.
This option appears only for the primary unit in config-only groups.
Click the row corresponding to a peer IP address, then click this button to remove that backup unit from the HA group.
This option appears only for the primary unit config-only groups.
Storing mail data on a NAS server
For FortiMail units operating in server mode as a config-only HA group, you must store mail data on a NAS server instead of locally. If mail data is stored locally, email users’ messages and other mail data could be scattered across multiple FortiMail units.
174
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Even if your FortiMail units are not operating in server mode with config-only HA, however, storing mail data on a NAS server may have a number of benefits for your organization.
For example, backing up your NAS server regularly can help prevent loss of mail data.
Also, if your FortiMail unit experiences a temporary failure, you can still access the mail data on the NAS server. When the FortiMail unit restarts, it can usually continue to access and use the mail data stored on the NAS server.
For config-only HA groups using a network attached storage (NAS) server, only the primary unit sends quarantine reports to email users. The primary unit also acts as a proxy between email users and the NAS server when email users use FortiMail webmail to access quarantined email and to configure their own Bayesian filters.
For a active-passive HA groups, the primary unit reads and writes all mail data to and from the NAS server in the same way as a standalone unit. If a failover occurs, the new primary unit uses the same NAS server for mail data. The new primary unit can access all of the mail data that the original primary unit stored on the NAS server. So if you are using a NAS server to store mail data, after a failover, the new primary unit continues operating with no loss of mail data.
Note: If the FortiMail unit is a member of an active-passive HA group, and the HA group stores mail data on a remote NAS server, disable mail data synchronization to prevent
duplicate mail data traffic. For details, see “Backup mail data directories” on page 173 .
For instructions on storing mail data on a NAS server, see
“Selecting the mail data storage location” on page 208
.
Configuring service-based failover
The Services tab in the High Availability submenu enables you to configure remote service monitoring, local network interface monitoring, and local hard drive monitoring.
Note: Service monitoring is not available for config-only HA groups.
HA service monitoring settings are not synchronized and must be configured separately on each primary and backup unit.
With remote service monitoring, the backup unit confirms that it can connect to the primary unit over the network using SMTP service, POP service (POP3), and Web service (HTTP) connections.
With local network interface monitoring and local hard drive monitoring, the primary unit monitors its own network interfaces and hard drives.
If service monitoring detects a failure, the effective operating mode of the primary unit switches to off or failed (depending on the On failure setting) and, if configured, the
FortiMail units send HA event alert email, record HA event log messages, and send HA event SNMP traps. A failover then occurs, and the effective operating mode of the backup
. For information on the effective operating mode, see
“Monitoring the HA status” on page 163
.
Remote service monitoring can be effective to configure in addition to, or sometimes as a backup alternative to, the heartbeat. While the heartbeat tests for the general responsiveness of the primary unit, it does not test for the failure of individual services which email users may be using such as POP3 or webmail. The heartbeat also does not monitor for the failure of network interfaces through which non-heartbeat traffic occurs. In
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
175
Using high availability (HA) System this way, configuring remote service monitoring provides more specific failover monitoring.
Additionally, if the heartbeat link is briefly disconnected, enabling HA services monitoring can prevent a false failover by acting as a temporary secondary heartbeat. For information on treating service monitoring as a secondary heartbeat, see “Remote services as heartbeat” on page 173 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure service monitoring, go to System > High Availability > Services.
Figure 91: Configuring services monitoring
176
Remote services
SMTP service To enable connection responsiveness tests for SMTP, enter the IP address and port number of the SMTP service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for email traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
POP service To enable connection responsiveness tests for POP3, enter the IP address and port number of the POP3 service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for email traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Web service To enable connection responsiveness tests for webmail and the perrecipient quarantines, enter the IP address and port number of the HTTP service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for webmail traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
Local services
Network interfaces
Hard drives
To enable responsiveness tests for network interfaces, enter the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed nonfunctional and a failover occurs.
Network interface monitoring tests all active network interfaces whose:
•
Virtual IP Address setting is not do nothing
•
Port monitor setting is enabled
For details, see
“Port monitor” on page 172 and
“Virtual IP Address” on page 174
.
To disable monitoring of the network interfaces, enter 0 as the failover threshold.
To enable responsiveness tests for hard drives, enter the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed nonfunctional and a failover occurs.
To disable monitoring of the hard drives, enter 0 as the failover threshold.
Example: Failover scenarios
This section describes some basic FortiMail active-passive HA failover scenarios. For each scenario, refer to the HA group shown in Figure 92 . To simplify the descriptions of these scenarios, the following abbreviations are used:
• P1 is the configured primary unit (also called the master)
• B2 is the configured backup unit (also called the slave)
Figure 92: Example active-passive HA group
Active-passive HA group port1
172.16.5.10
(HA virtual IP: 172.16.5.2)
Primary unit (P1)
Switch port6
Heartbeat link
Backup unit (B2) port1
172.16.5.11
This topic includes:
•
Failover scenario: Temporary failure of the primary unit
•
Failover scenario: Primary heartbeat link fails
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
177
Using high availability (HA)
178
System
•
Failover scenario: Temporary failure of the primary unit
In this scenario, the primary unit (P1) fails because of a software failure or a recoverable hardware failure (in this example, the P1 power cable is unplugged). HA logging and alert email are configured for HA group.
When the backup unit (B2) detects that P1 has failed, B2 becomes the new primary unit and continues processing email.
1 The FortiMail HA group is operating normally.
2 The power is accidentally disconnected from P1.
3 B2’s primary heartbeat test detects that P1 has failed.
How soon this happens depends on the HA daemon configuration of B2.
4 The effective operating mode of B2 changes to master.
5 B2 sends an alert email, indicating that B2 has determined that P1 has failed and that
B2 is switching its effective operating mode to master.
6 B2 records event log messages (among others) indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
Recovering from temporary failure of the primary unit
Because the hardware failure of P1 is not permanent, you may want to return both
FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the P1 power cable is unplugged
1 Turn off the P1 power switch, reconnect the power cable and then turn the power switch back on.
P1 starts up and finds B2 operating as a primary unit. P1 switches its effective operating mode to slave.
P1 records event log messages (among others) as this happens.
The configured operating mode of P1 is master and the effective operating mode of P1 is slave.
The configured operating mode of B2 is slave and the effective operating mode of B2 is
master.
P1 synchronizes the content of its MTA spool directories to B2. Email in these directories can now be delivered by B2.
2 Connect to the web-based manager of P1, go to System > High Availability > Status.
3 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
4 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
5 Connect to the web-based manager of P1, go to System > High Availability > Status and select click HERE to restore configured operating mode.
P1 should return to operating as the primary unit and B2 should return to operating as
the backup unit. You may have to repeat steps 4 and 5
a few times.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
6 P1 and B2 synchronize their MTA spool directories again. All of the email in these directories can now be delivered by P1.
Failover scenario: Primary heartbeat link fails
If the primary heartbeat link fails, such as when the cable becomes accidentally disconnected, if you have not configured a secondary heartbeat link, the FortiMail units in the HA group cannot verify that each other are operating, and assume that the other has failed. As a result, the backup unit (B2) changes to operating as a primary unit, and both
FortiMail units are acting as primary units.
Two primary units connected to the same network may cause address conflicts on your network because matching interfaces will have the same IP addresses. Additionally, because the heartbeat link is interrupted, the FortiMail units in the HA group cannot synchronize configuration changes or mail data changes.
Even after reconnecting the heartbeat link, both units will continue operating as primary units. To return the HA group to normal operation, you must connect to the web-based manager of B2 to restore its effective operating mode to slave (backup unit).
1 The FortiMail HA group is operating normally.
2 The heartbeat link Ethernet cable is accidently disconnected.
3 B2’s HA heartbeat test detects that the primary unit has failed.
How soon this happens depends on the HA daemon configuration of B2.
4 The effective operating mode of B2 changes to master.
5 B2 sends an alert email, indicating that B2 has determined that P1 has failed and that
B2 is switching its effective operating mode to master.
6 B2 records event log messages (among others) indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
Recovering from a heartbeat link failure
Because the hardware failure is not permanent (that is, the failure of the heartbeat link was caused by a disconnected cable, not a failed port on one of the FortiMail units), you may want to return both FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the heartbeat link fails
1 Reconnect the primary heartbeat interface by reconnecting the heartbeat link Ethernet cable.
Even though the effective operating mode of B2 is master, B2 is continues to attempt to find the other primary unit. When the heartbeat link is reconnected, B2 finds P1 and determines that P1 is also operating as a primary unit. So B2 sends a heartbeat signal to notify P1 to stop operating as a primary unit. The effective operating mode of P1 changes to off.
2 P1 sends an alert email, indicating that P1 has stopped operating as the primary unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
179
Using high availability (HA) System
3 P1 records event log messages (among others) indicating that P1 is switching to off mode.
The configured operating mode of P1 is master and the effective operating mode of P1 is off.
The configured operating mode of B2 is slave and the effective operating mode of B2 is
master.
P1 synchronizes the content of its MTA spool directories to B2. Email in these directories can now be delivered by B2.
4 Connect to the web-based manager of P1, go to System > High Availability > Status.
5 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
6 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
The HA group should return to normal operation. P1 records the event log message
(among others) indicating that B2 asked P1 to return to operating as the primary unit.
7 P1 and B2 synchronize their MTA spool directories. All of the email in these directories can now be delivered by P1.
Failover scenario: Network connection between primary and backup units fails (remote service monitoring detects a failure)
Depending on your network configuration, the network connection between the primary and backup units can fail for a number of reasons. In the network configuration shown in
Figure 92 on page 177 , the connection between port1 of primary unit (P1) and port1 of the backup unit (B2) can fail if a network cable is disconnected or if the switch between P1 and B2 fails.
A more complex network configuration could include a number of network devices between the primary and backup unit’s non-heartbeat network interfaces. In any configuration, remote service monitoring can only detect a communication failure. Remote service monitoring cannot determine where the failure occurred or the reason for the failure.
In this scenario, remote service monitoring has been configured to make sure that B2 can connect to P1. The On failure setting located in the HA main configuration section is wait
for recovery then restore slave role. For information on the On failure setting, see
“On failure” on page 171 . For information about remote service monitoring, see
“Configuring service-based failover” on page 175
.
The failure occurs when power to the switch that connects the P1 and B2 port1 interfaces is disconnected. Remote service monitoring detects the failure of the network connection between the primary and backup units. Because of the On failure setting, P1 changes its effective operating mode to failed.
When the failure is corrected, P1 detects the correction because while operating in failed mode P1 has been attempting to connect to B2 using the port1 interface. When P1 can connect to B2, the effective operating mode of P1 changes to slave and the mail data on
P1 will be synchronized to B2. B2 can now deliver this mail. The HA group continues to operate in this manner until an administrator resets the effective operating modes of the
FortiMail units.
1 The FortiMail HA group is operating normally.
2 The power cable for the switch between P1 and B2 is accidently disconnected.
180
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
3 B2’s remote service monitoring cannot connect to the primary unit.
How soon this happens depends on the remote service monitoring configuration of B2.
4 Through the HA heartbeat link, B2 signals P1 to stop operating as the primary unit.
5 The effective operating mode of P1 changes to failed.
6 The effective operating mode of B2 changes to master.
7 B2 sends an alert email similar to the following, indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
8 B2 records the following event log messages (among others) indicating that B2 has determined that P1 has failed and that B2 is switching its effective operating mode to
master.
9 P1 sends an alert email similar to the following, indicating that P1 has stopped operating in HA mode.
10 P1 records the following log messages (among others) indicating that P1 is switching to off mode.
Recovering from a network connection failure
Because the network connection failure was not caused by failure of either FortiMail unit, you may want to return both FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the heartbeat link fails
1 Reconnect power to the switch.
Because the effective operating mode of P1 is failed, P1 is using remote service monitoring to attempt to connect to B2 through the switch.
2 When the switch resumes operating, P1 successfully connects to B2.
P1 has determined the B2 can connect to the network and process email.
3 The effective operating mode of P1 switches to slave.
P1 records the following log messages (among others) as this happens.
4 P1 synchronizes the content of its MTA spool directories to B2. B2 can now deliver all of the email in these directories.
The HA group can continue to operate with B2 as the primary unit and P1 as the backup unit. However, you can use the following steps to restore each unit to its configured operating mode.
5 Connect to the web-based manager of P1 and go to System > High Availability >
Status.
6 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
7 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
8 Connect to the web-based manager of P1, go to System > High Availability > Status and select click HERE to restore configured operating mode.
P1 should return to operating as the primary unit and B2 should return to operating as
the backup unit. You may have to repeat steps 4 and 5
a few times.
9 P1 and B2 synchronize their MTA spool directories again. P1 can now deliver all of the email in these directories.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
181
Using high availability (HA) System
Example: Active-passive HA group in gateway mode
In this example, two FortiMail-400 units are configured to operate in gateway mode as an active-passive HA group.
The procedures in this example describe HA configuration necessary to achieve this scenario. Before beginning, verify that both of the FortiMail units are already:
• currently physically connected according to
• operating in gateway mode (for details, see “Operation mode” on page 54 )
• each configured with the IP addresses for their port3 and port1 network interfaces
according to Figure on page 185
, with the exception of the HA virtual IP address that
will be configured in this example (for details, see “Editing network interfaces” on page 123 )
• allowing HTTPS administrative access through their port1 network interfaces
according to Figure on page 185
Figure 93: Virtual IP address for HA failover
Local Em ail U sers
Em ail D om ain:
@ exam ple.com
Internal Em ail Server
172.16.1.10
Rem ote Em ail U sers
External
Em ail Server
Sw itch internal
172.16.1.1
w an1
10.10.10.1
Internet
182 port3
172.16.1.5
(H A virtual IP: 172.16.1.2)
Prim ary unit port1
192.168.1.5
virtual IP transfers upon failover
Sw itch
H eartbeat link port6
10.0.0.2
port6
10.0.0.4
Sw itch
D N S Server exam ple.com IN M X 10 fortim ail.exam ple.com
fortim ail.exam ple.com IN A 10.10.10.1
Adm inistrator port3
172.16.1.6
Backup unit port1
192.168.1.6
Active-passive H A group
G atew ay m ode
Protected D om ain:
@ exam ple.com
The active-passive HA group is located on a private network with email users and the protected email server. All are behind a FortiGate unit which separates the private network from the Internet. The DNS server, remote email users, and external SMTP servers are located on the Internet.
For both FortiMail units:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA) port1 port3 port6
• connected to a switch which is connected only to the computer that the FortiMail administrator uses to manage the HA group
• administrative access occurs through this port
• connected to a switch which is connected to the private network and, indirectly, the Internet
• email connections occur through this port
• connected directly to each other using a crossover cable
• heartbeat and synchronization occurs through this port
The backup unit will become the new primary unit when a failover occurs. In order for it to be able to receive the connections formerly destined for the failed primary unit, the new primary unit must adopt the failed primary unit’s IP address. You will configure an HA virtual IP address on port3 for this purpose.
While the configured primary unit is functional, the HA virtual IP address is associated with its port3 network interface, which receives email connections. After a failover, the HA virtual IP address becomes associated with the new primary unit’s port3. As a result, after a failover, the new primary unit (originally the backup unit) will then receive and be able to process the email connections.
This example contains the following:
•
About standalone vs. HA deployment
•
Configuring the DNS and firewall settings
•
Configuring the primary unit for HA operation
•
Configuring the backup unit for HA operation
•
About standalone vs. HA deployment
If you will be converting a standalone FortiMail unit to a member of an HA group, you may find it useful to first understand the changes you need to make for HA deployment shown in Figure 93 on page 182 in the context of its similarities and differences with a standalone deployment.
First, examine the network interface configuration of a standalone FortiMail-400 unit in
Table 21 .
Table 21: Example standalone network interface configuration
Network interface port1 port2, port4 port3 port5 port6
IP address
192.168.1.5
Default
172.16.1.2
Default
Default
Description
Administrative connections to the FortiMail unit.
Not connected.
Email connections to the FortiMail unit; the target of your email
DNS A records. (No administrative access.)
Not connected.
Not connected.
Similarly, for the HA group, DNS A records should target the IP address of the port3 interface of the primary FortiMail-400 unit. Additionally, administrators should be able to administer each FortiMail unit in the HA group by connecting to the IP address of each
FortiMail unit’s port1.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
183
Using high availability (HA) System
If a failover occurs, the network must be able to direct traffic to port3 of the backup unit
without reconfiguring the DNS A record target. The backup unit must be able to cleanly, automatically substitute for the primary unit, as if they were a single, standalone unit.
Unlike the configuration of the standalone unit, for the HA group to accomplish that substitution, all email connections must use an IP address that transfers between the primary unit and the backup unit according to which one’s effective operating mode is currently master. This transferable IP address can be accomplished by configuring the HA group to either:
• set the IP address of the current primary unit’s network interface
• add a virtual IP address to the current primary unit’s network interface
In this example, the HA group uses the method of adding a virtual IP address. Email connections will not use the actual IP address of port3. Instead, all email connections will use only the virtual IP address 172.16.1.2, which is used by port3 of whichever FortiMail unit’s effective operating mode is currently master. During normal HA group operation, this
IP address resides on the primary unit. Conversely, after a failover occurs, this IP address resides on the former backup unit (now the current primary unit).
Also unlike the configuration of the standalone unit, both port5 and port6 are configured for each member of the HA group. The primary unit’s port5 is directly connected using a crossover cable to the backup unit’s port5; the primary unit’s port6 is directly connected to the backup unit’s port6. These links are used solely for heartbeat and synchronization traffic between members of the HA group.
For comparison with the standalone unit, examine the network configuration of the primary unit in Table 22 .
Table 22: Example primary unit HA network interface configuration
Interface IP/Netmask Virtual IP Address Description
Setting IP address port1 192.168.1.5 do nothing
Default do nothing
Administrative connections to this FortiMail unit. (Because the IP address does not follow the FortiMail unit whose effective mode is currently master, connections to this IP address are specific to this physical unit.
Administrators can still connect to this
FortiMail unit after failover, which may be useful for diagnostic purposes.)
Not connected.
port2, port4 port3 172.16.1.5
add virtual
IP/netmask port5 port6
10.0.1.2
10.0.0.2
do nothing do nothing
172.16.1.2
Email connections to the FortiMail unit; the target of your email DNS MX and A records.
Connections should not be destined for the actual IP address, but instead the virtual IP address (172.16.1.2) which follows the
FortiMail unit whose effective operating mode is master. No administrative access.
Secondary heartbeat and synchronization interface.
Primary heartbeat and synchronization interface.
Because the Virtual IP Address settings are synchronized between the primary and
backup units, you do not need to configure them separately on the backup unit. However, you must configure the backup unit with other settings listed in Table 23 .
184
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Table 23: Example backup unit HA network interface configuration
Interface IP/Netmask Virtual IP Address Description
Setting IP address port1 port2, port4 port3
192.168.1.6 (synchronized from primary unit)
Default (synchronized from primary unit)
172.16.1.6
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
Administrative connections to this
FortiMail unit. (Because the IP address does not follow the FortiMail unit whose effective mode is currently master, connections to this IP address are specific to this physical unit.
Administrators can connect to this
FortiMail unit even when it is currently the backup unit, which may be useful for
HA configuration and log viewing.)
Not connected.
port5 port6
10.0.1.4
10.0.0.4
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
Connections should not be destined for the actual IP address, but instead the virtual IP address (172.16.1.2) which follows the FortiMail unit whose effective operating mode is master. As a result, no connections should be destined for this network interface until a failover occurs, causing the backup unit to become the new primary unit. No administrative access.
Secondary heartbeat and synchronization interface.
Primary heartbeat and synchronization interface.
Configuring the DNS and firewall settings
In the example shown in Figure 93 on page 182 , SMTP clients will connect to the virtual IP address of the primary unit. For SMTP clients on the Internet, this connection occurs through the public network virtual IP on the FortiGate unit, whose policies allow the connections and route them to the virtual IP on the current primary unit.
Because the FortiMail HA group is installed behind a firewall performing NAT, the DNS server hosting records for the domain example.com must be configured to reflect the public IP address of the FortiGate unit, rather than the private network IP address of the
HA group.
The DNS server has been configured with:
• an MX record to indicate that the FortiMail unit is the email gateway for example.com
• an A record to resolve fortimail.example.com into the FortiGate unit’s public IP address
• a reverse DNS record to enable external email servers to resolve the public IP address of the FortiGate unit into the domain name of the FortiMail unit
For more information on configuring the DNS records and firewalls, see the FortiMail
Install Guide .
Configuring the primary unit for HA operation
The following procedure describes how to prepare a FortiMail unit for HA operation as the primary unit according to Figure 93 on page 182 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
185
Using high availability (HA) System
Before beginning this procedure, verify that you have completed the required preparations described in
“Example: Active-passive HA group in gateway mode” on page 182
.
To configure the primary unit for HA operation
1 Connect to the web-based manager of the primary unit at https://192.168.1.5/admin.
2 Go to System > High Availability > Configuration.
3 Configure the following:
master wait for recovery then assume slave role change_me port6
10.0.0.2/255.255.255.0
enabled
10.0.0.4
port5
10.0.1.2/255.255.255.0
enabled
10.0.1.4
enabled disabled
HA base port 2000
15 seconds
Remote services as heartbeat disabled
port1 port2 port3 port4 port5 port6 do nothing do nothing add virtual IP/netmask
172.16.1.2/255.255.255.0
do nothing do nothing do nothing
4 Click Apply.
The FortiMail unit switches to active-passive HA mode, and, after determining that there is no other primary unit, sets its effective operating mode to master. The virtual IP
172.16.1.2 is added to port3; if not already complete, configure DNS records and firewalls to route email traffic to this virtual IP address, not the actual IP address of the
port3 network interface.
186
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
5 To confirm that the FortiMail unit is acting as the primary unit, go to System >
High Availability > Status and compare the Configured Operating Mode and Effective
Operating Mode. Both should be master.
If the effective operating mode is not master, the FortiMail unit is not acting as the primary unit. Determine the cause of the failover, then restore the effective operating mode to that matching its configured operation mode.
Figure 94: Primary unit status
Configuring the backup unit for HA operation
The following procedure describes how to prepare a FortiMail unit for HA operation as the backup unit according to Figure 93 on page 182 .
Before beginning this procedure, verify that you have completed the required preparations described in
“Example: Active-passive HA group in gateway mode” on page 182
. Also verify that you have configured the primary unit as described in
“Configuring the primary unit for HA operation” on page 185 .
To configure the backup unit for HA operation
1 Connect to the web-based manager of the backup unit at https://192.168.1.6/admin.
2 Go to System > High Availability > Configuration.
3 Configure the following:
slave wait for recovery then restore slave role change_me port6
10.0.0.4/255.255.255.0
enabled
10.0.0.2
port5
10.0.1.4/255.255.255.0
enabled
10.0.1.2
enabled
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
187
Using high availability (HA) System
port2 port3 port4 port5 port6 disabled
HA base port 2000
15 seconds disabled Remote services as heartbeat
port1
(Configuration of the settings below will be synchronized from the primary unit, and are therefore not required to be configured on the backup unit.) do nothing do nothing add virtual IP/netmask
172.16.1.2/255.255.255.0
do nothing do nothing do nothing
4 Click Apply.
The FortiMail unit switches to active-passive HA mode, and, after determining that the primary unit is available, sets its effective operating mode to slave.
5 Go to System > High Availability > Status.
6 Select click HERE to start a configuration/data sync.
The backup unit synchronizes its configuration with the primary unit, including Virtual
IP Address settings that configure the HA virtual IP that the backup unit will adopt upon
failover.
7 To confirm that the FortiMail unit is acting as the backup unit, go to System >
High Availability > Status and compare the Configured Operating Mode and Effective
Operating Mode. Both should be slave.
If the effective operating mode is not slave, the FortiMail unit is not acting as the backup unit. Determine the cause of the failover, then restore the effective operating mode to that matching its configured operation mode.
Note: If the heartbeat interfaces are not connected, the backup unit cannot connect to the primary unit, and so the backup unit will operate as though the primary unit has failed and will switch its effective operating mode to master.
188
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Figure 95: Backup unit status page (backup unit not operating as a backup unit)
When both primary unit and the backup unit are operating in their configured mode, configuration of the active-passive HA group is complete. For information on managing
both members of the HA group, see “Administering an HA group” on page 189 .
Administering an HA group
In most cases, you will manage an HA group by connecting to the primary unit, as if it were a standalone unit.
Table 24: Management tasks performed on each HA group member
Connect to...
Primary unit
(192.168.1.5)
Backup unit
(192.168.1.6)
For...
• synchronized configuration items, such as antispam settings
• primary unit HA management tasks, such as viewing its effective operating
mode and configuring its Mode of operation and Shared password
• viewing the log messages of the primary unit
• backup unit HA management tasks, such as viewing its effective operating
mode and configuring its Mode of operation and Shared password
• viewing the log messages of the backup unit
If the initial configuration synchronization fails, such as if it is disrupted or the network cable is loose, you should manually trigger synchronization after changing the configuration of the primary unit. For information on manually triggering configuration synchronization, see
“click HERE to start a configuration/data sync” on page 166 .
Note: Some parts of the configuration are not synchronized, and must be configured separately on each member of the HA group. For details, see
“Configuration settings that are not synchronized” on page 160
.
Managing certificates
The Certificate submenu enables you to generate, import, revoke, and manage other aspects of certificates used by or with the FortiMail unit.
Note: In addition to managing various server certificates, you can also manage personal
This topic includes:
•
•
Managing certificate authority certificates
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
189
Managing certificates System
•
Managing the certificate revocation list
•
Managing OCSP server certificates
Managing local certificates
The Local Certificate tab displays certificate requests and installed local certificates. It also enables you to generate certificate requests, and to import signed certificates in order to install them for local use by the FortiMail unit.
FortiMail units require a local server certificate that it can present when clients request secure connections, including:
• the web-based manager (HTTPS connections only)
• webmail (HTTPS connections only)
• secure email, such as SMTPS, IMAPS, and POP3S
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of certificates and certificate requests, go to System > Certificate >
Local Certificate.
Figure 96: Managing local certificates
View
Generate
Download
Set status
Import
Name
Click the row of a certificate in order to select it, then click this button to display its issuer, subject, and range of dates within which the certificate is valid.
.
Click the row of a certificate file or certificate request file in order to select it, then click this button and select either:
• Download: Download a certificate (.cer) or certificate request (.csr) file. You can send the request to your certificate authority (CA) to obtain a signed certificate
• Download PKCS12 File: Download a PKCS #12 (.p12) file. For details, see
“Downloading a PKCS #12 certificate” on page 195
.
Click the row of a certificate in order to select it, then click this button to use it as the
“default” (that is, currently chosen for use) certificate. The Status column changes to indicate that the certificate is the current (Default) certificate.
This button is not available if the selected certificate is already the “default.”
The name of the certificate file or certificate request file.
190
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Subject
Status
The Distinguished Name (DN) located in the Subject field of the certificate.
If the certificate has not yet been signed, this field is empty.
The status of the local certificate.
• Default: Indicates that the certificate was successfully imported, and is currently selected for use by the FortiMail unit.
• OK: Indicates that the certificate was successfully imported, but is not selected as the certificate currently in use. To use the certificate, click the row of the certificate in order to select it, then click Set status.
• Pending: Indicates that the certificate request has been generated, but must be downloaded, signed, and imported before it can be used as a local certificate.
Generating a certificate signing request
You can generate a certificate request file, based on the information you enter to identify the FortiMail unit. Certificate request files can then be submitted for verification and signing by a certificate authority (CA).
To generate a certificate request
1 Go to System > Certificate > Local Certificate.
2 Click Generate.
3 Configure the following:
Figure 97: Generating a certificate signing request
Certification name
Subject Information
Enter a unique name for the certificate request, such as fmlocal.
Information that the certificate is required to contain in order to uniquely identify the FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
191
Managing certificates
192
System
ID type Select which type of identifier will be used in the certificate to identify the FortiMail unit:
• Host IP
• Domain Name
Which type you should select varies by whether or not your
FortiMail unit has a static IP address, a fully-qualified domain name (FQDN), and by the primary intended use of the certificate.
For example, if your FortiMail unit has both a static IP address and a domain name, but you will primarily use the local certificate for HTTPS connections to the web-based manager by the domain name of the FortiMail unit, you might prefer to generate a certificate based upon the domain name of the FortiMail unit, rather than its IP address.
• Host IP requires that the FortiMail unit have a static, public IP address. It may be preferable if clients will be accessing the
FortiMail unit primarily by its IP address.
• Domain Name requires that the FortiMail unit have a fullyqualified domain name (FQDN). It may be preferable if clients will be accessing the FortiMail unit primarily by its domain name.
• E-Mail does not require either a static IP address or a domain name. It may be preferable if the FortiMail unit does not have a domain name or public IP address.
IP Enter the static IP address of the FortiMail unit.
This option appears only if ID Type is Host IP.
Domain Name Type the fully-qualified domain name (FQDN) of the FortiMail unit.
The domain name may resolve to either a static or, if the FortiMail unit is configured to use a dynamic DNS service, a dynamic IP address. For more information, see
“Configuring the network interfaces” on page 121 and
“Configuring dynamic DNS” on page 130
.
If a domain name is not available and the FortiMail unit subscribes to a dynamic DNS service, an unable to verify certificate message may be displayed in the user’s browser whenever the public IP address of the FortiMail unit changes.
This option appears only if ID Type is Domain Name.
Optional Information
Type the email address of the owner of the FortiMail unit.
This option appears only if ID Type is E-Mail.
Information that you may include in the certificate, but which is not required.
Key Type
Key Size
Organization
Unit
Type the name of your organizational unit, such as the name of your department. (Optional.)
To enter more than one organizational unit name, click the + icon, and enter each organizational unit separately in each field.
Organization Type the legal name of your organization. (Optional.)
Locality(City) Type the name of the city or town where the FortiMail unit is located. (Optional.)
State/Province Type the name of the state or province where the FortiMail unit is located. (Optional.)
Country Select the name of the country where the FortiMail unit is located.
(Optional.)
E-mail Type an email address that may be used for contact purposes.
(Optional.)
The type of algorithm used to generate the key.
This option cannot be changed, but appears in order to indicate that only RSA is currently supported.
Select a security key size of 1024 Bit, 1536 Bit or 2048 Bit. Larger keys are slower to generate, but provide better security.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
4 Click OK.
The certificate is generated, and can be downloaded to your management computer for submission to a certificate authority (CA) for signing. For more information, see
“Downloading a certificate signing request” on page 193
.
Downloading a certificate signing request
After you have generated a certificate request, you can download the request file to your management computer in order to submit the request file to a certificate authority (CA) for signing.
To download and submit a certificate request
1 Go to System > Certificate > Local Certificate.
2 Click the row that corresponds to the certificate request in order to select it.
3 Click Download, then select Download.
Your web browser downloads the certificate request (.csr) file.
4 Submit the certificate request to your CA.
• Using the web browser on the management computer, browse to the web site for your CA.
• Follow your CA’s instructions to place a Base64-encoded PKCS #10 certificate request, uploading your certificate request.
• Follow your CA’s instructions to download their root certificate and Certificate
Revocation List (CRL), and then install the root certificate and CRL on each remote client. For details, see the documentation for each client.
5 When you receive the signed certificate from the CA, install the certificate on the
FortiMail unit. For more information, see
“Importing a certificate” on page 193
.
Importing a certificate
You can upload Base64-encoded certificates in either privacy-enhanced email (PEM) or public key cryptography standard #12 (PKCS #12) format from your management computer to the FortiMail unit.
Importing a certificate may be useful when:
• restoring a certificate backup
• installing a certificate that has been generated on another system
• installing a certificate, after the certificate request has been generated on the FortiMail unit and signed by a certificate authority (CA)
If you generated the certificate request using the FortiMail unit, after you submit the certificate request to CA, the CA will verify the information and register the contact information in a digital certificate that contains a serial number, an expiration date, and the public key of the CA. The CA will then sign the certificate and return it to you for installation on the FortiMail unit. To install the certificate, you must import it. For more information on
generating certificate requests, see “Generating a certificate signing request” on page 191
.
If the FortiMail unit’s local certificate is signed by an intermediate CA rather than a root
CA, before clients will trust the FortiMail unit’s local certificate, you must demonstrate a link with trusted root CAs, thereby proving that the FortiMail unit’s certificate is genuine.
You can demonstrate this chain of trust either by:
• installing each intermediate CA’s certificate in the client’s list of trusted CAs
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
193
Managing certificates System
• including a signing chain in the FortiMail unit’s local certificate
To include a signing chain, before importing the local certificate to the FortiMail unit, first open the FortiMail unit’s local certificate file in a plain text editor, append the certificate of each intermediate CA in order from the intermediate CA who signed the FortiMail unit’s certificate to the intermediate CA whose certificate was signed directly by a trusted root
CA, then save the certificate. For example, a local certificate which includes a signing chain might use the following structure:
-----BEGIN CERTIFICATE-----
<FortiMail unit’s local server certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 1, who signed the FortiMail certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 2, who signed the certificate of intermediate CA 1 and whose certificate was signed by a trusted root CA>
-----END CERTIFICATE-----
To import a local certificate
1 Go to System > Certificate > Local Certificate.
2 Click Import.
3 From Type, select the type of the import file or files:
• Local Certificate: The certificate is stored in a file (.pem) that does not require a password.
• PKCS12 Certificate: The certificate and private key are stored in a PKCS #12 (.p12) password-encrypted file.
• Certificate: The certificate file (.cert) and key file (.key) are stored separately. The private key is password-encrypted.
The remaining fields vary by your selection in Type.
4 Configure the following:
Figure 98: Uploading a local certificate (Local certificate)
Figure 99: Uploading a local certificate (PKCS12 certificate)
194
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 100: Uploading a local certificate (Certificate)
Managing certificates
Certificate file
Key file
Password
Enter the location of the previously .cert or .pem exported certificate (or, for PKCS #12 certificates, the .p12 certificate-and-key file), or click
Browse to locate the file.
Enter the location of the previously exported key file, or click Browse to locate the file.
This option appears only when Type is Certificate.
Enter the password that was used to encrypt the file, enabling the
FortiMail unit to decrypt and install the certificate.
This option appears only when Type is PKCS12 certificate or Certificate.
5 Click OK.
Downloading a PKCS #12 certificate
You can export certificates from the FortiMail unit to a PKCS #12 file for secure download and import to another platform, or for backup purposes.
To download a PKCS #12 file
1 Go to System > Certificate > Local Certificate.
2 Click the row that corresponds to the certificate in order to select it.
3 Click Download, then select Download PKCS12 File.
4 In Password and Confirm password, enter the password that will be used to encrypt to exported certificate file. The password must be at least 4 characters long.
5 Click Download.
6 If your browser prompts you for a location to save the file, select a location.
Your web browser downloads the PKCS #12 (.p12) file. For information on importing a
PKCS #12 file, see
“Importing a certificate” on page 193
.
Managing certificate authority certificates
The CA Certificate tab enables you to view and import certificates for certificate authorities
(CA).
Certificate authorities validate and sign other certificates in order to indicate to third parties that those other certificates may be trusted to be authentic.
CA certificates are required by connections that use transport layer security (TLS), and by
S/MIME encryption. For more information, see
“Configuring TLS profiles” on page 370
and
“Configuring certificate bindings” on page 373
. Depending on the configuration of each
PKI user, CA certificates may also be required to authenticate PKI users. For more information, see
“Configuring PKI authentication” on page 248 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
195
Managing certificates
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of CA certificates, go to System > Certificate > CA Certificate.
Figure 101: Managing CA certificates
System
196
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the CA certificate (.cer).
Click to import a CA certificate.
The name of the CA certificate.
The Distinguished Name (DN) located in the Subject field of the certificate.
Managing the certificate revocation list
The Certificate Revocation List tab enables you to view and import certificate revocation lists.
To ensure that your FortiMail unit validates only certificates that have not been revoked, you should periodically upload a current certificate revocation list, which may be provided by certificate authorities (CA). Alternatively, you can use online certificate status protocol
(OCSP) to query for certificate statuses. For more information, see
“Managing OCSP server certificates” on page 197 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of remote certificates, go to System > Certificate > Certificate Revocation
List.
Figure 102: Managing certificate revocation lists
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the certificate revocation list (.cer).
Click to import a certificate revocation list.
The name of the certificate revocation list.
The Distinguished Name (DN) located in the Subject field of the certificate revocation list.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Managing OCSP server certificates
The Remote tab enables you to view and import the certificates of the online certificate status protocol (OCSP) servers of your certificate authority (CA).
OCSP enables you to revoke or validate certificates by query, rather than by importing
.
Remote certificates are required if you enable OCSP for PKI users. For more information,
see “Configuring PKI authentication” on page 248
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of remote certificates, go to System > Certificate > Remote.
Figure 103: Managing OCSP server certificates
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the OCSP server certificate (.cer).
Click to import an OCSP server certificate.
The name of the OCSP server certificate.
The Distinguished Name (DN) located in the Subject field of the certificate.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
197
Managing certificates System
198
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
Mail Settings
The Mail Settings menu enables you configure the basic email settings of the FortiMail unit, such as the port number of the FortiMail SMTP relay/proxy/server and how it handles connections, and enables you to manage the mail queues.
This topic includes:
•
Configuring the built-in MTA & mail server
•
•
Managing the global address book
•
Configuring the proxies & implicit relay
Configuring the built-in MTA & mail server
The Settings submenu enables you to configure assorted settings that apply to the SMTP server and webmail server that are built into the FortiMail unit itself.
This topic includes:
•
Configuring the host name, port numbers, relay, mail queue, & DSN
•
Configuring global disclaimers
•
Customizing replacement messages & quarantine report contents
•
Selecting the mail data storage location
Configuring the host name, port numbers, relay, mail queue, & DSN
The Mail Server Settings tab enables you to configure SMTP server/relay settings of the
system domain, which is located on the local host (that is, your FortiMail unit).
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure local SMTP server settings, go to Mail Settings > Settings > Local Host.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
199
Configuring the built-in MTA & mail server
Figure 104: Configuring the host name, port numbers, relay, mail queue, and DSN
(transparent mode and gateway mode)
Mail Settings
200
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
Figure 105: Configuring the host name, port numbers, relay, mail queue, and DSN (server mode)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
201
Configuring the built-in MTA & mail server
202
Mail Settings
Local Host
Host name Enter the host name of the FortiMail unit.
The FortiMail unit’s fully qualified domain name (FQDN) is in the format:
<host-name>.<local-domain-name> such as fortimail-400.example.com, where
fortimail-400 is the Host name and example.com is the
Note: The FQDN of the FortiMail unit should be different from that of protected SMTP servers. If the FortiMail unit uses the same
FQDN as your mail server, it may become difficult to distinguish the two devices during troubleshooting.
Note: You should use a different host name for each FortiMail unit, especially when you are managing multiple FortiMail units of the same model, or when configuring a high availability (HA) cluster.
This will enable you to distinguish between different members of the cluster. If the FortiMail unit is in HA mode, the FortiMail unit will add the host name to the subject line of alert email messages. For
details, see “Configuring alert email” on page 447 .
Local domain name Enter the local domain name to which the FortiMail unit belongs.
The local domain name is used in many features such as email quarantine, Bayesian database training, quarantine report, and delivery status notification (DSN) email messages.
The FortiMail unit’s fully qualified domain name (FQDN) is in the format:
<host-name>.<local-domain-name> such as fortimail-400.example.com, where fortimail-
400 is the Host name and example.com is the Local domain
Note: The IP address should be globally resolvable into the FQDN of the FortiMail unit if it will relay outgoing email. If it is not globally resolvable, reverse DNS lookups of the FortiMail unit’s domain name by external SMTP servers will fail. For quarantine reports, if the FortiMail unit is operating in server mode or gateway mode,
DNS records for the local domain name may need to be globally resolvable to the IP address of the FortiMail unit. If it is not globally resolvable, web and email release/delete for the per-recipient quarantines may fail. For more information on configuring required
DNS records, see the FortiMail Install Guide .
Note: The Local domain name is not required to be different from
or identical to any protected domain. It can be a subdomain or different, external domain.
For example, a FortiMail unit whose FQDN is fortimail.example.com could be configured with the protected domains example.com and accounting.example.net.
SMTP server port number
Enter the port number on which the FortiMail unit’s SMTP server will listen for SMTP connections. The default port number is 25.
SMTP over SSL/TLS Enable to allow SSL- and TLS-secured connections from SMTP clients that request SSL/TLS.
When disabled, SMTP connections with the FortiMail unit’s built-in
MTA must occur as clear text, unencrypted.
Note: This option must be enabled to receive SMTPS connections.
However, it does not require them. To enforce client use of
SMTPS, see
“Configuring access control rules” on page 262
.
SMTPS server port number
Enter the port number on which the FortiMail unit’s built-in MTA listens for secure SMTP connections. The default port number is
465.
This option is unavailable if SMTP over SSL/TLS is disabled.
SMTP MSA service Enable to allow your email clients use SMTP for message submission on a separate TCP port number from deliveries or mail relay by MTAs.
For details on message submission by email clients as distinct from
SMTP used by MTAs, see RFC 2476 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
SMTP MSA port number
POP3 server port number
Enter the TCP port number on which the FortiMail unit listens for email clients to submit email for delivery. The default port number is 587.
Enter the port number on which the FortiMail unit’s POP3 server will listen for POP3 connections. The default port number is 110.
This option is available only if the FortiMail unit is operating in server mode.
Relay Server
Relay server name
Relay server port
Use SMTPs
Enter the domain name of an SMTP relay, if any, to which the
FortiMail unit will relay outgoing email.
This is typically provided by your Internet service provider (ISP), but could be a mail relay on your internal network.
If the SMTP relay’s domain name resolves to more than one IP address, for each SMTP session, the FortiMail unit will randomly select one of the IP addresses from the result of the DNS query, effectively load balancing between the SMTP relays.
If you do not configure a relay, for outgoing email delivered by the built-in MTA, the FortiMail unit will instead query the DNS server for the MX record of the mail domain in the recipient’s email address
(RCPT TO:), and relay the email directly to that mail gateway. For details, see
“When FortiMail uses the proxies instead of the built-in
Note: This option will be ignored if the FortiMail unit is operating in transparent mode, and
“Use client-specified SMTP server to send email” on page 238 is enabled.
Note: This option will be ignored for email that matches an
antispam or content profile where you have enabled Deliver to
Enter the TCP port number on which the SMTP relay listens.
This is typically provided by your Internet service provider (ISP).
Enable to initiate SSL- and TLS-secured connections to the SMTP relay if it supports SSL/TLS.
When disabled, SMTP connections from the FortiMail unit’s built-in
MTA or proxy to the relay will occur as clear text, unencrypted.
This option must be enabled to initiate SMTPS connections.
Authentication
Required
If the relay server requires use of the SMTP AUTH command, enable this option, then click the arrow to expand and configure:
• User name: Enter the name of the FortiMail unit’s account on the SMTP relay.
• Password: Enter the password for the FortiMail unit’s user name.
• Authentication type: Available SMTP authentication types include:
• AUTO (automatically detect and use the most secure SMTP authentication type supported by the relay server)
• PLAIN
• LOGIN
• DIGEST-MD5
• CRAM-MD5
Deferred oversize message delivery
To defer sending email messages that are larger than the limit, configure both Start delivering messages at n (hour) n (mins) and
Stop delivering messages at n (hour) n (mins).
For information on the deferred delivery limit, see “Configuring content profiles” on page 318 .
Note: Deferred oversize message delivery can be resourceintensive. For improved FortiMail performance, schedule delivery during times when email traffic volume is low, such as nights and weekends.
Start delivering messages at n (hour)
n (mins)
Select the hour and minute of the day at which to begin delivering oversize email messages.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
203
Configuring the built-in MTA & mail server
204
Mail Settings
Stop delivering messages at n (hour)
n (mins)
Select the hour and minute of the day at which to stop delivering oversize email messages.
DSN
DSN (NDR) email generation
Enable to allow the FortiMail unit to send delivery status notification
(DSN) email messages sent by the FortiMail unit to notify email users of delivery delays and/or failure.
For information on viewing delayed and failed deliveries, see
“Managing the deferred mail queue” on page 60 and
“Managing undeliverable mail” on page 62 .
Sender displayname The name of the sender, such as
"FortiMail administrator", as it should appear in DSN.
If this field is empty, the FortiMail unit sends DSN from the default name of "postmaster".
For more information on DSN, see “Managing the deferred mail queue” on page 60
.
Sender address The sender email address in DSN.
If this field is empty, the FortiMail unit sends DSN from the default sender email address of postmaster@<domain_str>, where
<domain_str> is the domain name of the FortiMail unit, such as example.com.
For more information on sending of DSN, see “Managing the deferred mail queue” on page 60 .
Mail Queue
Maximum time for email in queue
Maximum time for
DSN email in queue
Time before delay warning
Select the maximum number of hours that deferred email messages can remain in the deferred mail queue, during which the
FortiMail unit periodically retries to send the message.
After the maximum time has been reached, the FortiMail unit will send a final delivery status notification (DSN) email message to notify the sender that the email message was undeliverable.
For more information on the FortiMail mail queue, see
“Managing the deferred mail queue” on page 60
.
Select the maximum number of days a delivery status notification
(DSN) message can remain in the mail queues. If the maximum time is set to zero (0) days, the FortiMail unit attempts to deliver the
DSN only once.
After the maximum time has been reached, the DSN email is moved to the dead mail folder.
Select the number of hours after an initial failure to deliver an email message before the FortiMail unit sends the first delivery status notification (DSN) email message to notify the sender that the email message has been deferred.
After sending this initial DSN, the FortiMail unit will continue to retry sending the email until reaching the limit configured in Maximum
time for email in queue.
Time interval for retry Select the number of minutes between delivery retries for email messages in the deferred and spam mail queues.
The number of days a dead mail is to be kept
Enter the number of days that undeliverable email and its associated DSN will be kept in the dead mail folder. After this amount of time, the dead email and its DSN will be automatically deleted.
For more information on the dead mail folder, see
“Managing undeliverable mail” on page 62 .
Delivery Options
Disable ESMTP for outgoing email
Mark the check box to disable Extended Simple Mail Transfer
Protocol (ESMTP) for outgoing email.
By default, FortiMail units can use ESMTP commands. ESMTP supports email messages with graphics, sound, video, and text in various languages. For more information on ESMTP, see
RFC 1869 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
Domain Check
(gateway mode and transparent mode only)
Perform LDAP domain verification for unknown domains
Enable to verify the existence of domains that have not been configured as protected domains. Also configure LDAP profile for
domain check.
To verify the existence of unknown domains, the FortiMail unit queries an LDAP server for a user object that contains the email address. If the user object exists, the verification is successful, and:
• If Automatically create domain association for verified domain is
enabled, the FortiMail unit automatically adds the unknown domain as a domain associated of the protected domain selected in Internal domain to hold association.
• If Automatically create domain association for verified domain is
disabled, and the DNS lookup of the unknown domain name is successful, the FortiMail unit routes the email to the IP address resolved for the domain name during the DNS lookup. Because the domain is not formally defined as a protected domain, the email is considered to be outgoing, and outgoing recipientbased policies are used to scan the email. For more
information, see “Controlling email based upon the recipient” on page 272 .
LDAP profile for domain check
Select the LDAP profile to use when verifying existence of unknown domains.
This option is available only if Perform LDAP domain verification
for unknown domains is enabled.
Automatically create domain association for verified domain
Internal domain to hold domain association
Enable to automatically add unknown domains as domain associations if they are successfully verified by the LDAP query.
For more information, see
“Domain Association” on page 221
.
This option is available only if Perform LDAP domain verification
for unknown domains is enabled.
Select the name of a protected domain with which to associate unknown domains, if they pass domain verification.
This option is available only if Automatically create domain
association for verified domain is enabled.
•
•
Configuring global disclaimers
The Disclaimer tab enables you to configure system-wide disclaimer messages.
A disclaimer message is text that is generally attached to email to warn the recipient that the email contents may be confidential. For disclaimers added to outgoing messages, you need to configure an IP-based policy or an outgoing recipient-based policy.
Disclaimer messages can be appended for either or both incoming or outgoing email messages. For information on determining the directionality of an email message, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
Note: If the FortiMail unit is operating in transparent mode, to use disclaimers, you must enable clients to send email using their specified SMTP server. For more information, see
“Use client-specified SMTP server to send email” on page 238 .
Note: If Allow per-domain settings is enabled, you can configure disclaimer messages that
are specific to each protected domain. For more information, see
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
205
Configuring the built-in MTA & mail server Mail Settings
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure disclaimer messages, go to Mail Settings > Settings > Disclaimer.
Figure 106: Configuring global disclaimer messages
206
Allow per-domain settings Enable to allow protected domains to select from either the system-wide disclaimer messages, configured below, or their own separate disclaimer messages.
Disable to require that all protected domains use the system-wide disclaimer messages.
For information on configuring disclaimer messages
specific to a protected domain, see “Disclaimer” on page 226
.
Disclaimer in incoming message header
Enable to append a disclaimer message to the message header of incoming messages, then enter the disclaimer message. The maximum length is 256 characters.
Disclaimer in incoming message body
Enable to append a disclaimer message to the message body of incoming messages, then enter the disclaimer message. The maximum length is 1024 characters.
Disclaimer in outgoing message header
Enable to append a disclaimer message to the message header of outgoing messages, then enter the disclaimer message. The maximum length is 256 characters.
Disclaimer in outgoing message body
Enable to append a disclaimer message to the message body of outgoing messages, then enter the disclaimer message. The maximum length is 1024 characters.
Customizing replacement messages & quarantine report contents
The Custom Messages tab enables you to view and configure replacement messages.
When the FortiMail unit detects a virus in an email attachment, it replaces the attachment with a message that provides information about the virus and source of the email.
The FortiMail unit may also use replacement messages when notifying a recipient that it has blocked an email as spam or due to content filtering, or when sending a quarantine report.
Replacement messages are customizable. Most require plain text, except for quarantine reports, which allow you to use HTML tags for formatting.
To be able to access this part of the web-based manager, your administrator account’s:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the replacement messages, go to Mail Settings > Settings > Custom Messages.
Figure 107: Viewing the list of customized messages
To customize replacement messages
1 Go to Mail Settings > Settings > Custom Messages.
2 Double-click the row corresponding to the replacement message that you want to modify.
3 In the text area, enter the replacement message, or click Reset To Default to revert the replacement message to its default text.
If the replacement message is not required to be plain text, the replacement message can be either plain text or HTML. To format replacement messages in HTML, use
HTML tags, such as <b>some bold text</b>. Acceptable formats and the limit of the number of characters appear in the Allowed formats and Size fields.
Replacement messages often include variables, such as the MIME type of the file that was removed and replaced by the replacement message.
Note: Typically, you will customize text, but should not remove variables from the replacement message. Removing variables may result in an error message and reduced functionality.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
207
Configuring the built-in MTA & mail server
Figure 108: Editing a custom replacement message
Mail Settings
208
Table 25: Replacement message variables
Variable
%%EMAIL%%
%%FILE%%
%%FILE_TYPE%%
%%SPAM_DELETE_EMAIL%%
%%SPAM_RELEASE_EMAIL%%
%%VIRUS%%
Description
The recipient’s email address.
The name of the file that was removed from the email.
The MIME type of the file that was blocked. For details, see
“Configuring content profiles” on page 318
.
The email address, such as [email protected], used to release an email from the recipient’s personal quarantine. For details, see
“Configuring the quarantine control accounts” on page 389 .
The email address, such as [email protected], used to release an email from the recipient’s personal quarantine. For details, see
“Configuring the quarantine control accounts” on page 389 .
The name of the virus that was detected.
4 Click OK.
Selecting the mail data storage location
The Storage tab enables you to configure local or remote storage of mail data such as the
MTA spool, mail queues, email archives, email users’ mailboxes, and quarantined email messages.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the built-in MTA & mail server
FortiMail units can store email either locally or remotely. FortiMail units support remote storage by a centralized quarantine, and/or by a network attached storage (NAS) server using the network file system (NFS) protocol.
NAS has the benefits of remote storage which include ease of backing up the mail data and more flexible storage limits. Additionally, you can still access the mail data on the NAS server if your FortiMail unit loses connectivity.
Note: If the FortiMail unit is a member of an active-passive HA group, and the HA group stores mail data on a remote NAS server, disable mail data synchronization to prevent
duplicate mail data traffic. For details, see “Configuring the HA mode & group” on page 168 .
Tested and Supported NFS servers
• Linux NAS (NFS v2/v3)
• Red Hat 4/5
• Fedora 8/9/10
• Ubuntu 8.04/8.10
• OpenSUSE 10
• FreeNAS
• Openfiler
Untested NFS servers
• Buffalo TeraStation
• Cisco Linksys NAS server
Non-Supported NFS Servers
• Windows 2003 R2 /Windows 2008 Service for NFS
Additionally or alternatively, if you do not need consolidated storage for the mail queue and email user inboxes, FortiMail-2000A and FortiMail-4000A models can act as a centralized quarantine server. Up to 10 client FortiMail units can remotely store their system quarantines and personal quarantines on a centralized quarantine server, offloading disk storage from the clients to the server. Any FortiMail model can be a client.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure storage, go to Mail Settings > Settings > Storage.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
209
Configuring the built-in MTA & mail server Mail Settings
Figure 109: Configuring centralized quarantine storage (FortiMail-100 and FortiMail-400 models)
210
NAS
Local
NAS server
Test
Server IP
Server directory
Status
Select to store email on the FortiMail unit’s local disk or RAID. This is selected by default.
Select to store email on a remote network attached storage (NAS) server.
Click to verify the NAS server settings are correct and that the FortiMail unit can access that location.
This button is available only when NAS server is selected.
Enter the IP address of the NAS server.
Enter the directory path of the NFS export on the NAS server where the
FortiMail unit will store email.
Indicates whether or not the NFS share was successfully mounted on the
FortiMail unit’s file system, and therefore whether or not the FortiMail unit can store email on the NFS server.
This field appears only after you have configured the NAS share, clicked
Apply, and navigated away from the tab and then back again. If the NFS server is slow to respond, this may take some time.
• Not mounted: The NFS share was not successfully mounted. Verify that the NFS server is responding, the path of the NFS export is correct, and the FortiMail unit has both read and write permissions on the NFS server.
Centralized Quarantine
Disabled Select to store the quarantines on the FortiMail unit’s local disk or RAID.
This is selected by default.
Receive quarantined messages from clients
Select to act as a centralized quarantine server, then enter the IP addresses of all valid clients.
Other FortiMail units acting as clients send all their quarantined email to this FortiMail unit. This FortiMail unit will only accept a connection if the client’s IP address matches an IP address on the list of clients configured here.
This option is valid only on FortiMail-2000A and FortiMail-4000 models.
Send quarantined messages to remote server
Select to act as a centralized quarantine client. All quarantined email will be saved on the centralized quarantine server.
When selected, enter the following information:
• Name: Enter a name to identify this client to the centralized quarantine server. This value must match the name of the client as it is configured on the centralized quarantine server. Otherwise, the connection will fail.
• Host: Enter the IP address of the FortiMail unit that is acting as a centralized quarantine server.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
Configuring protected domains
The Domains tab displays the list of protected domains.
Protected domains define connections and email messages for which the FortiMail unit can performs protective email processing by describing both:
• the IP address of an SMTP server
• the domain name portion (the portion which follows the “@” symbol) of recipient email addresses in the envelope both of which the FortiMail unit compares to connections and email messages when looking for traffic that involves the protected domain.
Note: For FortiMail units operating in server mode, protected domains list only the domain name, not the IP address: the IP address of the SMTP server is the IP address of the
FortiMail unit itself.
For example, if you wanted to scan email from email addresses such as [email protected] that are hosted on the SMTP server 10.10.10.10, you would configure a protected domain of example.com whose SMTP server is 10.10.10.10.
Aside from defining the domain, protected domains also contain some settings that apply specifically to all email destined for that domain, such as mail routing and disclaimer messages.
Many FortiMail features require that you configure a protected domain. For example, when applying recipient-based policies for email messages incoming to the protected domain, the FortiMail unit will compare the domain name of the protected domain to the domain name portion of the recipient email addresses. When FortiMail units operating in transparent mode are proxying email connections for a protected domain, the FortiMail unit will pass, drop or intercept connections destined for the IP address of an SMTP server associated with the protected domain, and can use the domain name of the protected domain during the SMTP greeting.
Note: For more information on how the domain name and mail exchanger (MX) IP address
of protected domains are used, see “Incoming vs. outgoing SMTP connections” on page 231
and “Incoming vs. outgoing recipient-based policies” on page 259 .
Usually, you have already configured at least one protected domain during installation of your FortiMail unit. Some configurations may not require any protected domains. For details, see the FortiMail Install Guide . However, you can add more domains or modify the
Note: If you have many mail domains that will use identical settings, instead of creating many protected domains, you may want to create one protected domain, and then configure the others as associated domains. For details, see
“Domain Association” on page 221
.
If the FortiMail unit is operating in gateway mode, you must change the MX entries for the
DNS records for your email domain, referring email to the FortiMail unit rather than to your email servers. If you create additional protected domains, you must modify the MX records for each additional email domain. Similarly, MX records must also refer to the FortiMail unit if it is operating in server mode. For more information, see the FortiMail Installation Guide .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
For details, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
211
Configuring protected domains Mail Settings
To view the list of protected domains, go to Mail Settings > Domains > Domains.
Figure 110: Viewing the list of protected domains (transparent mode and gateway mode)
Figure 111: Viewing the list of protected domains (server mode)
212
Delete
Domain FQDN
Relay Type
(transparent mode and gateway mode only)
SMTP Server
(transparent mode and gateway mode only)
Click Delete to remove the protected domain and all associated email user
accounts and preferences.
The fully qualified domain name (FQDN) of the protected domain.
If the protected domain is a subdomain or domain association, click the + next to a domain entry to expand the list of subdomains and domain associations.
To collapse the entry, click the -.
Indicates one of the following methods of defining which SMTP server will receive email from the FortiMail unit for the protected domain:
• Host: One SMTP server and, if any, one fallback is configured in the
FortiMail unit’s configuration file, via SMTP server and Fallback SMTP
• MX Record (this domain): Query the DNS server’s MX record of the protected domain name for the FQDN or IP address of the SMTP server. If there are multiple MX records, the FortiMail unit will load balance between them.
• MX Record (alternative domain): Query the DNS server’s MX record of a domain name you specify for the FQDN or IP address of the SMTP server.
If there are multiple MX records, the FortiMail unit will load balance
between them. Specify in Alternative domain name which domain name
will be used in the query.
• IP pool: Configure the connection to one protected SMTP server or, if any,
one fallback. Also configure IP pool profile.
For more information, see
The host name or IP address and port number of the mail exchanger (MX) for this protected domain.
If Relay Type is MX Record (this domain) or MX Record (alternative domain),
this information is determined dynamically by querying the MX record of the
DNS server, and this field will be empty.
A green check indicates that the entry is a subdomain of a protected domain. Sub
(transparent mode and gateway mode only)
Association
(transparent mode and gateway mode only)
A green check indicates that the entry is a domain association. For more information on domain associations, see
“Domain Association” on page 221 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
To configure a protected domain
Before you begin, if the protected domain will use an IP pool profile, first configure the
IP pool profile. For details, see
“Configuring IP pools” on page 376
.
1 Go to Mail Settings > Domains > Domains.
2 Either New to create a new protected domain, or click the row corresponding to a protected domain that you want to modify in order to select it, then click Edit.
DKIM will appear only when modifying an existing protected domain. For DKIM, first create the protected domain, save it, then modify it to add DKIM settings.
You cannot modify domain associations, as they use the settings of the protected domain with which they are associated.
3 Configure the following:
Figure 112: Creating a protected domain (gateway mode)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
213
Configuring protected domains
Figure 113: Creating a protected domain (transparent mode)
Mail Settings
Figure 114: Creating a protected domain (server mode)
214
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
Domain name Enter the fully qualified domain name (FQDN) of the protected domain.
For example, if you want to protect email addresses such as [email protected], you would enter the protected domain name example.com.
Relay type
(transparent mode and gateway mode only)
Select from one of the following methods of defining which SMTP server will receive email from the FortiMail unit that is destined for the protected domain:
• Host: Configure the connection to one protected SMTP server or, if
any, one fallback. Also configure SMTP server and Fallback SMTP
• MX Record (this domain): Query the DNS server’s MX record of the protected domain name for the FQDN or IP address of the SMTP server. If there are multiple MX records, the FortiMail unit will load balance between them.
• MX Record (alternative domain): Query the DNS server’s MX record of a domain name you specify for the FQDN or IP address of the SMTP server. If there are multiple MX records, the FortiMail unit
will load balance between them. Also configure Alternative domain
• IP pool: Configure the connection to rotate among one or many
protected SMTP servers. Also configure IP pool profile.
Note: If an MX option is used, you may also be required to configure the
FortiMail unit to use a private DNS server whose MX and/or A records differ from that of a public DNS server. Requirements vary by the topology of your network and by the operating mode of the FortiMail unit.
• Gateway mode: A private DNS server is required. On the private
DNS server, configure the MX record with the FQDN of the SMTP server that you are protecting for this domain, causing the FortiMail unit to route email to the protected SMTP server. This is different from how a public DNS server should be configured for that domain name, where the MX record usually should contain the FQDN of the
FortiMail unit itself, causing external SMTP servers to route email through the FortiMail unit. Additionally, if both the FortiMail unit and the SMTP server are behind a NAT device such as a router or firewall, on the private DNS server, configure the protected SMTP server’s A record with its private IP address, while on the public
DNS server, configure the FortiMail unit’s A record with its public IP address.
• Transparent mode: A private DNS server is required if both the
FortiMail unit and the SMTP server are behind a NAT device such as a router or firewall. On the private DNS server, configure the protected SMTP server’s A record with its private IP address. On the
public DNS server, configure the protected SMTP server’s A record with its public IP address. Do not modify the MX record.
For DNS record examples, see the FortiMail Install Guide .
SMTP server
(transparent mode and gateway mode only)
Enter the fully qualified domain name (FQDN) or IP address of the
primary SMTP server for this protected domain, then also configure Port
If you have an internal mail relay that is located on a physically separate server from your internal mail server, this could be your internal mail relay, instead of your internal mail server. Consider your network topology, directionality of the mail flow, and the operation mode of the
FortiMail unit. For more information, see “Incoming vs. outgoing SMTP connections” on page 231
and “Avoiding scanning email twice” on page 233
.
This field appears only if Relay type is Host.
Port
(transparent mode and gateway mode only)
Enter the port number on which the SMTP server listens.
If you enable Use SMTPS, Port automatically changes to the default
port number for SMTPS, but can still be customized.
The default SMTP port number is 25; the default SMTPS port number is
465.
This field appears only if Relay type is Host.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
215
Configuring protected domains
216
Mail Settings
Use SMTPS
(transparent mode and gateway mode only)
Enable to use SMTPS for connections originating from or destined for this protected server.
This field appears only if Relay type is Host.
Fallback SMTP server
(transparent mode and gateway mode only)
Enter the fully qualified domain name (FQDN) or IP address of the secondary SMTP server for this protected domain, then also configure
This SMTP server will be used if the primary SMTP server is unreachable.
This field appears only if Relay type is Host.
Port
(transparent mode and gateway mode only)
Use SMTPS
(transparent mode and gateway mode only)
Enter the port number on which the failover SMTP server listens.
If you enable Use SMTPS, Port automatically changes to the default
port number for SMTPS, but can still be customized.
The default SMTP port number is 25; the default SMTPS port number is
465.
This field appears only if Relay type is Host.
Enable to use SMTPS for connections originating from or destined for this protected server.
This field appears only if Relay type is Host.
Alternative domain name
Port
(transparent mode and gateway mode only)
Enter the domain name to use when querying the DNS server for MX records.
This option appears only if Relay type is MX Record (alternative domain
name).
IP pool profile
(transparent mode and gateway mode only)
Select the name of the IP pool profile that is the range of IP addresses.
Also configure Port and Use SMTPS.
This field appears only if Relay type is IP pool.
Enter the port number on which the SMTP servers in the IP pool profile listen.
If you enable Use SMTPS, Port automatically changes to the default
port number for SMTPS, but can still be customized.
The default SMTP port number is 25; the default SMTPS port number is
465.
This field appears only if Relay type is IP pool.
Use SMTPS
(transparent mode and gateway mode only)
Is subdomain
Enable to use SMTPS for connections originating from or destined for this protected server.
This field appears only if Relay type is IP pool.
Mark this check box to indicate the protected domain you are creating is
a subdomain of an existing protected domain, then also configure Main
Subdomains, like their parent protected domains, can be selected when configuring policies specific to that subdomain. Unlike top-level protected domains, however, subdomains will be displayed as grouped under the parent protected domain when viewing the list of protected domains.
This option is available only when another protected domain exists to select as the parent domain.
Main domain Select the protected domain that is the parent of this subdomain. For example, lab.example.com might be a subdomain of example.com.
This option is available only when Is subdomain is enabled.
Domain Association
(transparent mode and gateway mode only)
Click to expand and configure domain associations.
Associated domains use the settings of the protected domain with which they are associated, and do not have separate protected domain settings of their own. Exceptions include DKIM keys, which will not be
used for associated domains. For more information, see “Domain
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
Recipient Address
Verification
(transparent mode and gateway mode only)
Select a method of confirming that the recipient email address in the message envelope (RCPT TO:) corresponds to an email user account that actually exists on the protected email server. If the recipient address is invalid, the FortiMail unit will reject the email. This prevents quarantine email messages for non-existent accounts, thereby conserving quarantine hard disk space.
• Disable: Do not verify that the recipient address is an email user account that actually exists.
• Use SMTP server: Query the SMTP server using either the SMTP
VRFY command or RCPT command to verify that the recipient address is an email user account that actually exists. RCPT is the default command.
If you want to query an SMTP server other than the one you have defined as the protected SMTP server, also enable Use alternative
server, then enter the IP address or FQDN of the server in the field next to it. Also configure Port with the TCP port number on which the
SMTP server listens, and enable Use SMTPS if you want to use
SMTPS for recipient address verification connections with the server.
• Use LDAP server: Query an LDAP server to verify that the recipient address is an email user account that actually exists. Also select the
LDAP profile that will be used to query the LDAP server. For more information on configuring LDAP profiles, see
“Configuring LDAP profiles” on page 333
.
Note: This option can cause a performance impact that may be noticeable during peak traffic times. For a lesser performance impact, you can alternatively periodically automatically remove quarantined email messages for invalid email user accounts, rather than actively preventing them during each email message. For more information, see
“Automatic Removal of Invalid Quarantine Accounts” on page 219 .
Note: Spam often contains invalid recipient addresses. If you have enabled spam quarantining, but have not prevented or scheduled the periodic removal of quarantined email messages for invalid email accounts, the FortiMail hard disk may be rapidly consumed during peak traffic times, resulting in refused SMTP connections when the hard disk becomes full. To prevent this, enable either this option or the periodic removal of invalid quarantine accounts. For more information, see
“Antispam issues” on page 474 .
Transparent Mode Options
This server is on
(transparent mode only)
Select the network interface (physical port) to which the protected SMTP server is connected.
Note: Selecting the wrong network interface will result in the FortiMail sending email traffic to the wrong network interface.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
217
Configuring protected domains Mail Settings
Hide the transparent box
(transparent mode only)
Enable to preserve the IP address or domain name of the SMTP client for incoming email messages in:
• the SMTP greeting (HELO/EHLO) in the envelope and in the
Received: message headers of email messages
• the IP addresses in the IP header
This masks the existence of the FortiMail unit to the protected SMTP server.
Disable to replace the SMTP client’s IP address or domain name with that of the FortiMail unit.
For example, an external SMTP client might have the IP address
172.168.1.1, and the FortiMail unit might have the domain name fortimail.example.com. If the option is enabled, the message header would contain (difference highlighted in bold):
Received: from 192.168.1.1 (EHLO 172.16.1.1)
(192.168.1.1) by smtp.external.example.com with SMTP;
Fri, 24 Jul 2008 07:12:40 -0800
Received: from smtpa ([172.16.1.2]) by [172.16.1.1] with SMTP id kAOFESEN001901 for
<[email protected]>; Fri, 24 Jul 2008
15:14:28 GMT
But if the option is disabled, the message headers would contain:
Received: from 192.168.1.1 (EHLO
fortimail.example.com) (192.168.1.1) by smtp.external.example.com with SMTP; Fri, 24 Jul 2008
07:17:45 -0800
Received: from smtpa ([172.16.1.2]) by
fortimail.example.com with SMTP id kAOFJl4j002011 for
<[email protected]>; Fri, 24 Jul 2008
15:19:47 GMT
For more information on transparency, see
“Transparency of the proxies and built-in MTA” on page 232 .
Note: If the protected SMTP server applies rate limiting according to IP addresses, enabling this option can improve performance. The rate limit will then be separate for each client connecting to the protected SMTP server, rather than shared among all connections handled by the
FortiMail unit.
Note: Unless you have enabled Take precedence over recipient based
policy match in the IP-based policy, this option supsersedes the Hide
this box from the mail server option in the session profile, and may
prevent it from applying to incoming email messages.
Use this domain’s SMTP server to deliver the mail
(transparent mode only)
Enable to proxy SMTP clients’ incoming connections when sending
outgoing email messages via the protected SMTP server.
For example, if the protected domain example.com has the SMTP server 192.168.1.1, and an SMTP client for [email protected] connects to it to send email to [email protected], enabling this option would cause the FortiMail unit to proxy the connection through to the protected SMTP server.
Disable to relay email using the built-in MTA to either the SMTP relay
defined in “Relay Server” on page 203
, if any, or directly to the MTA that is the mail exchanger (MX) for the recipient email address’s (RCPT TO:) domain. The email may not actually travel through the protected SMTP server, even though it was the relay originally specified by the SMTP client.
This option does not affect incoming connections containing incoming email messages, which will always be handled by the built-in MTA. For
details, see “When FortiMail uses the proxies instead of the built-in
Note: This option will be ignored for email that matches an antispam or
content profile where you have enabled Deliver to alternate host.
218
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
LDAP User Profile
(server mode only)
Select the name of an LDAP profile in which you have configured User
Authentication Options, User Alias Options, and Address Mapping
Options, enabling you to authenticate email users and expand alias
email addresses or replace one email address with another by using an
LDAP query to retrieve alias members. For more information, see
“Configuring LDAP profiles” on page 333 .
Automatic Removal of Invalid Quarantine
Accounts
Select a method by which to periodically remove quarantined spam for which an email user account does not actually exist on the protected email server.
(transparent mode and gateway mode only)
• Disable: Do not verify that the recipient address is an email user account that actually exists.
• Use SMTP server: Query the SMTP server to verify that the recipient address is an email user account that actually exists.
• Use LDAP server: Query an LDAP server to verify that the recipient address is an email user account that actually exists. Also select the
LDAP profile that will be used to query the LDAP server. For more information on configuring LDAP profiles, see
“Configuring LDAP profiles” on page 333
.
If you select either Use SMTP server or Use LDAP server, at 4:00 AM daily (unless configured for another time; see the FortiMail CLI
Reference ), the FortiMail unit queries the server to verify the existence of email user accounts. If an email user account does not currently exist, the FortiMail unit removes all spam quarantined for that email user account.
Note: If you have also enabled Recipient Address Verification, the
FortiMail unit is prevented from forming quarantine accounts for email user accounts that do not really exist on the protected email server. In that case, invalid quarantine accounts are never formed, and this option may not be necessary, except when you delete email user accounts on the protected email server. If this is the case, you can improve the performance of the FortiMail unit by disabling this option.
Note: Spam often contains invalid recipient addresses. If you have enabled spam quarantining, but have not prevented or scheduled the periodic removal of quarantined email messages for invalid email accounts, the FortiMail hard disk may be rapidly consumed during peak traffic times, resulting in refused SMTP connections when the hard disk becomes full. To prevent this, enable either this option or verification of recipient addresses. For more information, see
and “Antispam issues” on page 474 .
Advanced Settings
LDAP user alias
/ address mapping profile
(transparent mode and gateway mode only)
Select the name of an LDAP profile in which you have enabled and
configured User Alias Options and Address Mapping Options, enabling
you to expand alias email addresses or replace one email address with another by using an LDAP query to retrieve alias members and/or address mappings. For more information, see
“Configuring LDAP profiles” on page 333 .
Mail routing
LDAP profile
Quarantine
Report Setting
Enable to perform mail routing, then click the arrow to expand the options and select the name of an LDAP profile in which you have
enabled and configured Mail Routing Options. For more information, see
“Configuring LDAP profiles” on page 333
Click the arrow to expand the quarantine report section. For more
information, see “Quarantine Report Setting” on page 222
. For information on system-wide quarantine report settings, see
“Configuring global quarantine report settings” on page 380 .
DKIM Setting Click the arrow to expand the DKIM setting section. For more
information, see “DKIM Setting” on page 225 .
This option appears only when you are modifying a protected domain.
To configure DKIM signing, create the protected domain, save it, then double-click it to modify the protected domain.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
219
Configuring protected domains Mail Settings
Disclaimer
Webmail language
Click the arrow to expand the disclaimer section. For more information, see
.
Note: This option configures a per-domain disclaimer. For information
on system-wide disclaimer settings, see “Configuring global disclaimers” on page 205
.
Select either Use system settings, or the language that the FortiMail unit will to display webmail and quarantine folder pages. By default, the
FortiMail unit uses the same language as the web-based manager. For
more information, see “Customizing the appearance” on page 141 .
Source IP pool Select a pool of IP addresses to use as the source IP address when email is outgoing from this protected domain, according to the sender’s email address in the envelope (MAIL FROM:).
Each email that the FortiMail unit sends will use the next IP address in the range. When the last IP address in the range is used, the next email will use the first IP address.
If the FortiMail unit is operating in transparent mode, and you have
enabled Hide the transparent box or Use client-specified SMTP server
to send email, you cannot use IP pools.
For more information on IP pools, see
“Configuring IP pools” on page 376
.
SMTP greeting(EHLO/
HELO)
Select how the FortiMail unit will identify itself during the HELO or EHLO greeting of outgoing SMTP connections that it initiates.
• Use this domain name: The FortiMail unit will identify itself using the domain name for this protected domain.
If the FortiMail unit will handle internal email messages (those for which both the sender and recipient addresses in the envelope contain the domain name of the protected domain), to use this option, you must also configure your protected SMTP server to use its host name for SMTP greetings. Failure to do this will result in dropped SMTP sessions, as both the FortiMail unit and the protected
SMTP server will be using the same domain name when greeting each other.
• Use system host name: The FortiMail unit will identify itself using its own host name.
By default, the FortiMail unit uses the domain name of the protected domain. If your FortiMail unit is protecting multiple domains and using IP pool addresses, select Use system host name instead. This setting does not apply if email is incoming, according to the sender address in the envelope, from an unprotected domain.
Maximum message size(KB)
Enable then type the limit in kilobytes (KB) of the message size. Email messages over the threshold size are rejected.
Note: If both this option and Cap message size at n kilobytes in the
session profile are enabled, email size will be limited to whichever size is smaller.
Remove received header of outgoing email
Enable to remove the Received: message headers from email whose:
• sender email address belongs to this protected domain
• recipient email address is outgoing (that is, does not belong to this protected domain); if there are multiple recipients, only the first recipient’s email address is used to determine whether an email is outgoing
You can alternatively remove this header from any matching email using
session profiles. For details, see “Remove received header” on page 296
.
Advanced AS / AV Settings
Check AS/AV configuration
Mark this check box to query an LDAP server for an email user’s preferences to enable or disable antispam and/or antivirus processing for email messages destined for them, then click the arrow to expand the section and select the name of an LDAP profile in which you have enabled and configured. For more information, see
“Configuring LDAP profiles” on page 333
220
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
Use global bayesian database
Enable to use the global Bayesian database instead of the Bayesian database for this protected domain.
If you do not need the Bayesian database to be specific to the protected domain, you may want to use the global Bayesian database instead in order to simplify database maintenance and training.
Disable to use the per-domain Bayesian database.
This option does not apply if you have enabled use of personal
Bayesian databases in an incoming antispam profile, and if the personal
Bayesian database is mature. Instead, the FortiMail unit will use the
personal Bayesian database. For more information, see “Bayesian scan options” on page 304 .
Note: Train the global or per-domain Bayesian database before using it.
If you do not train it first, Bayesian scan results may be unreliable. For more information on Bayesian database types and how to train them, see
“Types of Bayesian databases” on page 419
Bayesian databases” on page 421 .
Bypass bounce verification
Mark this check box to disable bounce verification for this protected domain.
This option appears only if bounce verification is enabled. For more
information, see “Configuring bounce verification & tagging” on page 409
.
4 Click OK.
Domain Association
The Domain Association section that appears when configuring a protected domain enables you to configure associated domains. An associated domain uses the settings of the protected domain or subdomain with which it is associated.
Domain associations can be useful for saving time when you have multiple domains, and you would otherwise need to configure multiple protected domains with identical settings.
For example, if you have one SMTP server handling email for ten domains, you could create ten separate protected domains, and configure each with identical settings.
Alternatively, you could create one protected domain, listing the nine remaining domains as domain associations. The advantage of using the second method is that you do not have to repeatedly configure the same things when creating or modifying the protected domains, saving time and reducing chances for error. Changes to one protected domain automatically apply to all of its associated domains.
Exceptions to settings that associated domains will re-use include DKIM keys and signing settings. Domain keys are by nature tied to the exact protected domain only, and cannot be used for any other protected domain, including associated domains.
The maximum number of domain associations that you can create is separate from the
maximum number of protected domains. For more information, see “Appendix B:
Maximum Values Matrix” on page 487
.
To configure domain associations
1 Go to Mail Settings > Domains > Domains.
2 Either click New to create a new protected domain, or double-click to modify an existing protected domain.
3 Click the arrow to expand Domain Association.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
221
Configuring protected domains
Figure 115: Domain Association
Mail Settings
4 In the text box, enter the fully qualified domain name (FQDN) of a mail domain that you want to use the same settings as the same protected domain, then click Create.
The name of the associated domain appears in the Members area.
5 Repeat the previous step for all domains that you want to associate with this protected domain.
6 Click OK.
Quarantine Report Setting
The Quarantine Report Setting section that appears when configuring a protected domain enables you to configure quarantine report settings that are specific to this protected domain.
The quarantine report settings for a protected domain are a subset of the system-wide quarantine report settings.
For example, if the system settings for schedule include only Monday and Thursday, when you are setting the schedule for the quarantine reports of the protected domain, you will only be able to select either Monday or Thursday.
Note: For information on system-wide quarantine report settings and quarantine reports in general, see
“Configuring global quarantine report settings” on page 380
and “Customizing replacement messages & quarantine report contents” on page 206
.
To configure per-domain quarantine report settings
1 Go to Mail Settings > Domains > Domains.
2 Either click New to create a new protected domain, or double-click to modify an existing protected domain.
3 Click the arrow to expand Advanced Settings.
4 Click the arrow to expand Quarantine Report Setting.
5 Configure the following:
222
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings
Figure 116: Quarantine Report Setting
Configuring protected domains
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
223
Configuring protected domains Mail Settings
Send to individual recipients
Enable to send the quarantine report to all recipients. For more information, see
“Managing the personal quarantines” on page 63 .
Send to LDAP group owner based on LDAP profile
Send to other recipient Select to send the quarantine report to a recipient other than the individual recipients or group owner. For example, you might delegate quarantine reports by sending them to an administrator whose email address is not locally deliverable to the protected domain, such as [email protected].
Schedule
Enable to send the quarantine report to a group owner, rather than individual recipients, then select the name of an LDAP profile in
which you have enabled and configured Group Query Options. For
more information, see “Configuring LDAP profiles” on page 333 .
Setting Select the schedule to use when sending quarantine reports.
• Use system settings: Use the system-wide quarantine report schedule. For more information, see
“Configuring global quarantine report settings” on page 380
.
• Use domain settings: Use a quarantine report schedule that is specific to this protected domain, within the boundaries of time allowed by the system-wide quarantine report schedule. Also
configure These Hours and These Days.
Caution: If you change the system-wide quarantine report schedule, it will clear any quarantine report schedules for protected domains, requiring you to re-configure all per-domain quarantine report schedules.
These Hours Select which hours to send the quarantine report for this protected domain.
Some hours may not be available if they are not enabled at the system-wide level. For details, see
“Configuring global quarantine report settings” on page 380
.
This option is available only when Setting is Use domain settings.
These Days Select which days to send the quarantine report for this protected domain.
Some days may not be available if they are not enabled at the system-wide level. For details, see
“Configuring global quarantine report settings” on page 380
.
This option is available only when Setting is Use domain settings.
Report
Setting
Report email body (HTML)
Select the text that will appear in the quarantine reports.
• Use system settings: Use the system-wide quarantine report text. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206
.
• Use domain settings: Use quarantine report text that is specific
to this protected domain. Also configure Report email body
(HTML), Report email body (Text), and Report email subject
Enable to use quarantine report text that is specific to this protected domain, then enter the quarantine report text, which may include
HTML tags. For examples, see
“Customizing replacement messages
& quarantine report contents” on page 206 .
To set this per-domain quarantine report text to its default value for the firmware version, click Reset to Default.
For information on the contents of the HTML format quarantine
report, see “About the HTML formatted quarantine report” on page 384
.
224
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
Report email body (Text)
Report email subject (Text)
Enable to use quarantine report text that is specific to this protected domain, then enter the quarantine report text, which must be in plain text.
To set this per-domain quarantine report text to its default value for the firmware version, click Reset to Default.
For information on the contents of the plain text format quarantine
report, see “About the plain text formatted quarantine report” on page 382
.
Enable to use a subject line for the quarantine report that is specific to this protected domain, then enter the subject line that will be used for the quarantine report. The subject line must be in plain text.
To set the per-domain quarantine report subject line to its default value for the firmware version, click Reset to Default.
Replacement messages often include variables, such as the MIME type of the file that was removed and replaced by the replacement message.
Note: Typically, you will customize text, but should not remove variables from the replacement message. Removing variables may result in an error message and reduced functionality. For example, removing %%SPAM_DELETE_URL%% would make users incapable of using the quarantine report to delete email individually from their personal quarantines.
6 Click OK.
DKIM Setting
The DKIM Setting section that appears when configuring a protected domain enables you to create domain keys for this protected domain.
The FortiMail unit will sign outgoing email messages using the domain key for this protected domain if you have selected it when configuring sender validation in the session profile. For more information, see
“Configuring session profiles” on page 285
.
Note: Because domain keys are tied to the domain name for which they are generated,
FortiMail units will not use the domain key of a protected domain to sign email of an associated domain. If you require DKIM signing for an associated domain, convert it to a standard protected domain and then generate its own, separate domain key.
DKIM signing requires a public-private key pair. The private key is kept on and used by the
FortiMail unit to generate the DKIM signatures for the email messages; the public key is stored on the DNS server in the DNS record for the domain name, and used by receiving parties to verify the signature.
After you generate the key pair by creating a domain key selector, you can export the DNS record that contains the public key. The following is a sample of the exported DNS record: example_com._domainkey IN TXT "t=y; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5xvUazqp2sBovpfumPuR5xC+y
DvGbfndyHZuVQdSHhwdKAdsfiyOa03iPniCfQEbuM0d+4/AoPyTXHHPFBBnChMMHkW gHYlRDm5UMjrH5J1zDT5OyFxUEur+NtfS6LF29Te+6vSS+D3asfZ85V6WJDHSI9JV0
504uwDeOOh/aewIDAQAB"
Then you can publish the public key by adding it to the DNS zone file as a text record for the domain name on the DNS server. The recipient SMTP server, if enabled to use DKIM verification, will use the public key to decrypt the signature and compare the hash values of the email message in order to verify that the hash values match.
To configure a domain key pair
1 Go to Mail Settings > Domains > Domains.
2 Double-click to modify an existing protected domain.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
225
Configuring protected domains Mail Settings
Note: Because information from the protected domain is used to generate the key pair, you cannot create DKIM keys while initially creating the protected domain.
3 Click the arrow to expand Advanced Settings.
4 Click the arrow to expand DKIM Setting.
Figure 117: DKIM Setting
226
5 In the text box to the left of Create, enter a selector to use for the DKIM key, such as example_com2.
6 Click Create.
The selector name for the key pair appears in the list of domain key selectors. The key pair is generated and public key can be exported for publication on a DNS server.
Note: Only one key pair can be active at a time. If a new selector is generated, the FortiMail unit always signs email messages with the most recently generated key pair. To use an older domain key pair, you must delete all domain key pairs that have been more recently generated.
7 Click to select the domain key, then click Download.
Your web browser downloads the plain text file which contains the exported DNS record (.dkim) file.
8 Publish the public key by inserting the exported DNS record into the DNS zone file of the DNS server that resolves this domain name. For details, see the documentation for your DNS server.
Disclaimer
The Disclaimer section that appears when configuring a protected domain enables you to configure disclaimer messages specific to this protected domain.
A disclaimer message is text that is generally attached to email to warn the recipient that the email contents may be confidential. For disclaimers added to outgoing messages, you need to configure an IP-based policy or an outgoing recipient-based policy.
Disclaimer messages can be appended for either or both incoming or outgoing email messages. For information on determining the directionality of an email message, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
Note: If the FortiMail unit is operating in transparent mode, to use disclaimers, you must enable clients to send email using their specified SMTP server. For more information, see
“Use client-specified SMTP server to send email” on page 238 .
To configure a per-domain disclaimer messages
1 Go to Mail Settings > Domains > Domains.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring protected domains
2 Either click New to create a new protected domain, or double-click to modify an existing protected domain.
3 Click the arrow to expand Advanced Settings.
4 Click the arrow to expand Disclaimer.
5 Configure the following:
Figure 118: Disclaimer
Disclaimer
Setting
Disclaimer in incoming message header
Select which type of disclaimer message to append.
• Disable: Do not append disclaimer messages.
• Use system settings: Append the system-wide disclaimer
messages. For more information, see “Configuring global disclaimers” on page 205 .
• Use domain settings: Append the disclaimer messages configured specifically for this protected domain. Also configure the per-domain disclaimer messages in For
Incoming Messages and For Outgoing Messages.
This option is available only if you have enabled per-domain
disclaimer messages. For more information, see “Allow perdomain settings” on page 206
.
Enable to use append a disclaimer message to the message header of incoming messages that is specific to this protected domain, then enter the disclaimer message. The maximum length is 256 characters.
This option is available only if Setting is Use domain settings.
Disclaimer in incoming message body
Enable to use append a disclaimer message to the message body of incoming messages that is specific to this protected domain, then enter the disclaimer message. The maximum length is 1024 characters.
This option is available only if Setting is Use domain settings.
Disclaimer in outgoing message header
Enable to use append a disclaimer message to the message header of outgoing messages that is specific to this protected domain, then enter the disclaimer message. The maximum length is 256 characters.
This option is available only if Setting is Use domain settings.
Disclaimer in outgoing message body
Enable to use append a disclaimer message to the message body of outgoing messages that is specific to this protected domain, then enter the disclaimer message. The maximum length is 1024 characters.
This option is available only if Setting is Use domain settings.
6 Click OK.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
227
Managing the global address book Mail Settings
Managing the global address book
The Address Book tab enables you to create and maintain a global address book.
Note: This menu option appears only when the FortiMail unit is operating in server mode.
Individual FortiMail webmail users can import the global address book into their accounts, allowing them access to a common set of contact information when composing email messages. For more information, log in to FortiMail webmail and click Help.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the address book, go to Mail Settings > Address Book > Address Book.
Figure 119: Managing the global address book
228
Export .CSV
Import .CSV
Name
Click to download a copy of the address book in comma-separated value
(.csv) file format.
Exporting the address book can be useful for backup purposes, or when using a spreadsheet application such as Microsoft Excel to make large numbers of changes to the address book before importing it again.
Click the Browse button to locate a comma-separated value (.csv) file from which to import address book entries, then click Import .CSV to upload the file.
Importing the address book can be useful when restoring a backup of the address book, or when importing large numbers of address book entries.
Note: To replace existing entries, first delete those entries, then import the address book file. The FortiMail unit compares the Webmail_ID value of each entry in the address book file, and will not overwrite existing address book entries.
The first and last name for the selected address book entry, not including the middle name and/or nickname.
The email address for the entry.
To configure a new contact
1 Go to Mail Settings > Address Book > Address Book.
2 Click New.
3 Enter information for the contact.
You must enter a first name (Given name), a last name (Last name), or an email address (Email). Other fields are optional. For additional contact information fields, click the Address and Custom tabs.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings
Figure 120: Creating an address book entry
Configuring the proxies & implicit relay
4 Click Create.
Configuring the proxies & implicit relay
The Proxies submenu enables you to configure connection pick-up of the proxies and implicit relay.
Note: This menu option appears only when the FortiMail unit is operating in transparent mode.
In addition to this submenu, the protected domains and session profiles also configure aspects of the proxies and implicit relay, such as transparency. For details, see
“Configuring protected domains” on page 211
and
“Configuring session profiles” on page 285
.
This topic includes:
•
About the transparent mode proxies
•
Configuring SMTP proxy/implicit relay pick-up
About the transparent mode proxies
FortiMail has two transparent proxies: an incoming proxy and an outgoing proxy. The proxies’ degree of transparency at the IP layer and at the SMTP layer varies by your configuration. Proxy behaviors are configured separately based upon whether the SMTP connection is considered to be incoming or outgoing.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
229
Configuring the proxies & implicit relay Mail Settings
Depending on your network topology, you may need to verify that email is not being scanned twice.
Rather than use either of the proxies, depending on your configuration, a FortiMail unit operating in transparent mode may implicitly use its built-in MTA instead.
For details, see:
•
When FortiMail uses the proxies instead of the built-in MTA
•
Incoming vs. outgoing SMTP connections
•
Transparency of the proxies and built-in MTA
•
•
Relaying using FortiMail’s built-in MTA vs. unprotected SMTP servers
When FortiMail uses the proxies instead of the built-in MTA
When operating in transparent mode, a FortiMail unit has two ways of handling an SMTP connection: to proxy, or to relay. A FortiMail unit will proxy a connection only if you have enabled the proxy option applicable to the connection’s directionality, either:
• Use client-specified SMTP server to send email (for outgoing connections), or
• Use this domain’s SMTP server to deliver the mail (for incoming connections
containing outgoing email messages)
Otherwise, it will use its built-in MTA instead.
Unlike in gateway mode, in transparent mode, the built-in MTA is used implicitly. SMTP clients do not explicitly connect to it, but unless proxied, all connections traveling through the FortiMail unit are implicitly handled by the built-in MTA. In this sense, while in transparent mode, the built-in MTA may initially seem to be similar to the proxies, which are also used implicitly, and not specifically requested by the SMTP client. However, the proxies or the built-in MTA may reroute connections to different destination IP addresses, and thereby may affect mail routing.
Because the outgoing proxy does not queue undeliverable email, while the built-in MTA and incoming proxy do, whether a proxy or the built-in MTA handles a connection may also affect the FortiMail unit’s mail queues.
Table 26: Mail routing in transparent mode
Destination IP of connection
(incoming connection)
RCPT TO: Configuration Result
Built-in MTA establishes session with
A protected domain
(incoming email)
Not a protected domain
(outgoing email)
N/A
is enabled
disabled
configured
not configured
Incoming queueing proxy establishes
Built-in MTA establishes session with
Built-in MTA performs MX lookup of the domain in RCPT TO: and establishes session with the resulting
MTA
230
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the proxies & implicit relay
Table 26: Mail routing in transparent mode
connection)
N/A
is disabled
configured
not configured
Outgoing non-queueing proxy establishes session with the unprotected MTA
Built-in MTA establishes session with
Built-in MTA performs MX lookup of the domain in RCPT TO: and establishes session with the resulting
MTA
You can determine whether a connection was handled using the built-in MTA or one of the proxies by viewing the Mailer column of the history log messages.
• mta: The connection was handled by the built-in MTA.
• proxy: The connection was handled by either the incoming proxy or the outgoing proxy.
For information on viewing the history log, see
“Viewing log messages” on page 83 .
Incoming vs. outgoing SMTP connections
At the network connection level, directionality is determined by the destination IP address.
• Incoming connections: The destination IP address matches a protected domain’s
• Outgoing connections: The destination IP address does not match any protected
Connection level directionality does not consider a connection’s source IP address, nor whether or not the recipient email address’s (RCPT TO:) mail domain is a protected domain.
Figure 121: Incoming vs. outgoing SMTP connections
Directionality at the connection level may be different than directionality at the level
of email messages contained by the connection. It is possible that an incoming connection could contain an outgoing email message, and vice versa.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
231
Configuring the proxies & implicit relay Mail Settings
For example, in Figure 121 on page 231
, connections from the internal mail relays to the internal mail servers are outgoing connections, but they contain incoming email messages. Conversely, connections from remote MUAs to the internal mail relays are incoming connections, but may contain outgoing email messages if the recipients’ email addresses (RCPT TO:) are external.
Note: For information on the concept of incoming vs. outgoing at the application layer, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
When the FortiMail unit is operating in transparent mode, directionality correlates with which proxy will be used, if any.
For example, in Figure 121 on page 231
, the protected domain is example.com.
Mailboxes for example.com are stored on servers located at the company’s headquarters, separate from the mail relays, which are located at a branch office. All email is routed through the mail relays, and so the FortiMail unit is deployed in front of the mail relays at the branch office.
On the FortiMail unit, you have configured the protected domain’s SMTP server to be
192.168.0.1, a mail relay, because all email must be routed through that mail relay. You
have also enabled Use client-specified SMTP server to send email, so, for outgoing
connections, the outgoing proxy will be used instead of the built-in MTA. However, you
have not enabled Use this domain’s SMTP server to deliver the mail, so, for incoming
connections, the built-in MTA will be used, rather than the incoming proxy.
Note: You can configure interception and transparency separately for each of the two proxies. Regardless of which proxy is used, the proxy may not be fully transparent unless
you have configured it to be so. For details, see “Transparency of the proxies and built-in
Transparency of the proxies and built-in MTA
A FortiMail unit ‘s built-in MTA and proxies are not necessarily fully transparent, even if the
FortiMail unit is operating in transparent mode.
If you want the FortiMail unit to behave truly transparently, you must:
• enable Hide this box from the mail server in each session profile
• enable Hide the transparent box in each protected domain
Otherwise, the source IP address of connection initiations, the destination IP address of reply traffic, and the SMTP greeting (HELO/EHLO) will contain either:
• the management IP address (for connections occurring through bridged network interfaces), or
• the network interface’s IP address (for connections through out-of-bridge network interfaces)
In addition to preserving the original IP addresses and domain names, for connections to unprotected domains, to be hidden with regards to authentication, the FortiMail unit must pass SMTP AUTH commands through to the SMTP server instead of applying an
authentication profile. To do this, you must enable Use client-specified SMTP server to
send email in order to use the outgoing proxy instead of the built-in MTA. The outgoing
proxy will transmit SMTP AUTH commands to the server, instead of applying the IP-based policy’s authentication profile on behalf of the server.
232
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the proxies & implicit relay
Avoiding scanning email twice
Depending on your network topology, in transparent mode, you may need to verify that the
FortiMail unit is not scanning the same email twice.
Redundant scanning can result if all origins of outgoing email are not physically located on
the same network as the protected domain’s mail relay ( “SMTP server” on page 215
). This is especially true if your internal relays and mail servers are physically located on separate servers, and those servers are not located on the same network. Due to mail routing, an email could travel through the FortiMail unit multiple times in order to reach its final destination. As a result, if you have selected Are proxied more than once in
Mail Settings > Proxies > Proxies, it is possible that an email could be scanned more than once, decreasing the performance of your email system and unnecessarily increasing delivery time.
There are some topologies, however, when it is correct to select Are proxied for multiple network interfaces, or even for both incoming and outgoing connections on the same network interface. It is important to understand the impact of the relevant configuration options in order to configure transparent mode proxy/relay pick-up correctly.
The following two examples demonstrate correct configurations for their topology, and illustrate the resulting mail routing.
Example 1
All email is required to be routed through the internal mail relays. Internal mail servers, internal MUAs, and remote MUAs all send mail through the mail relays, whether the recipient is a member of the protected domain or not. Because of this, the FortiMail unit is deployed directly in front of the internal mail relays, which are physically located on a network separate from the mail servers that store email for retrieval by email users. For
each protected domain, SMTP server is configured with the IP address of an internal mail
relay.
Table 27 on page 234 shows the configuration options that result in correct mail routing for this desired scenario. Figure 122 on page 233 shows the mail routing that would result from this configuration, in this topology.
Figure 122: Avoiding scanning email twice: Example 1 topology
External MTAs
10.0.0.1
Remote MUA
SMTP Server:
192.168.0.1
TELECOMMUTE
WORKERS
Connection could contain either incoming or outgoing email messages
Protected Domain’s
“SMTP Server”
Internal Mail Relays
192.168.0.1
INCOMING
CONNECTION
(DST IP=192.168.0.1)
OUTGOING
CONNECTION
(DST IP=NOT 192.168.0.1)
Internet
Incoming connection contains outgoing email messages
172.16.0.1
Internal Mail Servers port2 port1
TRANSPARENT MODE
Outgoing connection contains incoming email messages
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
233
Configuring the proxies & implicit relay Mail Settings
Table 27: Avoiding scanning email twice: Example 1 configuration
Setting
MUAs’ SMTP server/MTA each protected domain’s
each protected domain’s Use this domain’s SMTP server to deliver the mail
Use client-specified SMTP server to send email port1’s Incoming SMTP connections
port1’s Outgoing SMTP connections
port2’s Incoming SMTP connections
port2’s Outgoing SMTP connections
Value the virtual IP on the FortiGate unit, or other public IP address, that routes to 192.168.0.1 (the internal mail relays)
192.168.0.1
enabled enabled
Are passed through or Are dropped
Are passed through
Are proxied
Are passed through or Are dropped
Because the FortiMail unit is deployed directly in front of the relays, which are not on the same network as either the remote MUAs or the internal mail servers, if proxy/relay pickup is not configured correctly, outgoing email could be scanned twice: once as it travels from port2 to port1, and again as it travels from port1 to port2. In addition, if proxying is not configured correctly, email would be picked up by the built-in MTA instead of the proxy, and might never reach the internal mail relays. This would violate the requirement that all email be routed through the internal mail relays.
To solve this, the FortiMail unit should not be configured to use its built-in MTA to intercept incoming connections and deliver email messages itself. Instead, it should proxy the incoming connections, allowing them to reach the internal mail relays. Because all email has already been scanned once during the incoming connection, when the internal mail relay initiates the outgoing connection to either an external MTA or to the internal mail server, the FortiMail unit should not need be configured to scan the email a second time.
In addition, because queues are maintained by the internal mail relays, the FortiMail unit does not need to maintain queues for outgoing connections, and can instead use its outgoing proxy, which does not queue, and will not reroute email. Finally, there should be no incoming connections on port1, nor outgoing connections on port2, so they can be configured either as Are passed through or Are dropped.
Example 2
All incoming email is required to be routed through the internal mail relays. The internal mail server also routes outgoing email through the relays. Because of this, the FortiMail unit is deployed directly in front of the internal mail relays, which are physically located on the same network as the mail servers that store email for retrieval by email users. For
each protected domain, SMTP server is configured with the IP address of an internal mail
relay.
Remote MUAs’ outgoing email must not be routed through the internal mail relays.
Table 28 on page 235 shows the configuration options that result in correct mail routing for
this desired scenario. Figure 123 on page 235 shows the mail routing that would result from this configuration, in this topology.
234
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the proxies & implicit relay
Figure 123: Avoiding scanning email twice: Example 2 topology
External MTAs
10.0.0.1
INCOMING
CONNECTION
(DST IP=192.168.0.1)
OUTGOING
CONNECTION
(DST IP=NOT 192.168.0.1)
TRANSPARENT MODE port2 port1
Protected Domain’s
“SMTP Server”
Internal Mail Relay
192.168.0.1
Internet
Remote MUA
SMTP Server:
192.168.0.2
Connection could contain either incoming or outgoing email messages
192.168.0.2
Internal Mail
Server
Implicit MTA intercepts and redirects to the recipient’s domain’s MX
TELECOMMUTE
WORKERS
Table 28: Avoiding scanning email twice: Example 2 configuration
Setting
MUAs’ SMTP server/MTA each protected domain’s
each protected domain’s Use this domain’s SMTP server to deliver the mail
Use client-specified SMTP server to send email port1’s Incoming SMTP connections
port1’s Outgoing SMTP connections
port2’s Incoming SMTP connections
port2’s Outgoing SMTP connections
MX record for each protected domain on the internal DNS server
Value the virtual IP on the FortiGate unit, or other public IP address, that routes to 192.168.0.2 (the internal mail server, not the internal mail relays)
192.168.0.1
disabled disabled
Are passed through
Are proxied
Are proxied
Are proxied not configured domain name resolving to 192.168.0.1 (the internal mail relays)
Unlike external MTAs making incoming connections to the relays, remote MUAs instead make outgoing connections through port2: their destination is the internal mail server, whose IP address is not configured in the protected domain. (The protected domain’s
SMTP server field is instead configured with the IP address of the internal mail relay.) As a
result, you can configure pick-up for these connections separately from those of external
MTAs — they pass through the same port, but are distinct in their directionality.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
235
Configuring the proxies & implicit relay
236
Mail Settings
In this case, we want to intercept connections for both external MTAs and remote MUAs.
To solve this, we select Are proxied for both Incoming SMTP connections from external
However, the remote MUAs’ configuration also means that the directionality of remote
MUAs’ connections coincides with that of the internal relays’ connections to external relays: both are outgoing. Therefore if you configure the FortiMail unit to proxy outgoing
connections instead of using the built-in MTA by enabling Use client-specified SMTP
server to send email, both outgoing connections are proxied.
Remote MUAs’ connections would all travel through the internal mail server, regardless of whether the recipient has an account on that mail server or not. Outgoing email would then need to be forwarded to the internal mail relay, and back out through the FortiMail unit. The result? Outgoing email from remote MUAs would travel extra mail hops. This would burden the internal network with traffic destined for an external network, and needlessly increases points of potential failure.
Additionally, because the FortiMail unit is deployed directly in front of both the relays and the mail server, which is not on the same network as remote MUAs, remote MUAs’ outgoing email could be scanned twice: once as it travels from port2 to port1, and again as it travels from port1 to port2. This is resource-inefficient.
To solve this, the FortiMail unit should not be configured to use its proxy to intercept outgoing connections. Instead, it should use its built-in MTA. The built-in MTA forms its own separate connections based upon the MX lookup of the recipient’s domain, rerouting email if necessary. Notice that as a result of this lookup, although remote MUAs are configured to connect to the internal mail server, connections for incoming email are actually diverted by the built-in MTA through the internal mail relays. This has the benefit of providing a common relay point for all internal email.
Rerouting also prevents outgoing email from passing through the FortiMail unit multiple times, receiving redundant scans. This prevents externally-destined email from burdening the internal mail relays and internal mail servers.
Finally, there should be no incoming connections on port1, so it can be configured either as Are passed through or Are dropped.
Relaying using FortiMail’s built-in MTA vs. unprotected SMTP servers
When not proxying, FortiMail units can use their own built-in SMTP relay to deliver email.
In
Figure 121 on page 231 , if an email user at the branch office, behind a FortiMail unit,
specifies the unprotected SMTP server 10.0.0.1 as her outgoing SMTP server, you can either let the email user send email using that specified unprotected SMTP server, or ignore the client’s specification and insist that the FortiMail unit send the email message itself.
• If you permit the client to specify an unprotected SMTP server, the FortiMail unit will allow the email client to connect to it, and will not act as a formal relay. If the client’s attempt fails, the outgoing proxy will simply drop the connection and will not queue the email or retry.
• If you insist that the client relay email using the FortiMail unit’s built-in MTA rather than the client-specified relay, the FortiMail unit will act as an MTA, queuing email for temporary delivery failures and sending error messages back to the email senders for permanent delivery failures. It may also reroute the connection through another relay server, or by performing an MX lookup of the recipient’s domain, and delivering the email directly to that mail gateway instead.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the proxies & implicit relay
Enabling the FortiMail unit to allow clients to connect to unprotected SMTP servers may be useful if, for example, you are an Internet service provider (ISP) and allow customers to use the SMTP servers of their own choice, but do not want to spend resources to maintain
SMTP connections and queues to external SMTP servers.
Unlike the outgoing proxy, the incoming proxy does queue and retry. In this way, it is similar to the built-in MTA.
For information on configuring use of the incoming proxy or outgoing proxy instead of
using the built-in MTA, see “Use client-specified SMTP server to send email” on page 238
(for outgoing connections) and
“Use this domain’s SMTP server to deliver the mail” on page 218
(for incoming connections containing outgoing email messages).
Configuring SMTP proxy/implicit relay pick-up
The Proxies tab enables you to configure the following SMTP pick-up separately for incoming and outgoing SMTP connections.
Note: For definitions of incoming and outgoing connections, see “Incoming vs. outgoing
.
When operating in transparent mode, the FortiMail unit can use either transparent proxies or an implicit relay to inspect SMTP connections. If connection pick-up is enabled for connections on that network interface, the FortiMail unit can scan and process the connection. If not enabled, the FortiMail unit can either block or permit the connection to pass through unmodified.
Exceptions to SMTP connections that can be proxied or relayed include SMTP connections destined for the FortiMail unit itself. For those local connections, such as email messages from email users requesting deletion or release of their quarantined email, you must choose to either allow or block the connection.
Note: When a FortiMail unit proxies or relays traffic, whether the email will be scanned or
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the SMTP proxies, go to Mail Settings > Proxies > Proxies.
Figure 124: Configuring SMTP proxy/implicit relay pick-up
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
237
Configuring the proxies & implicit relay Mail Settings
Use client-specified SMTP server to send email
Enable to, for outgoing SMTP connections, use the outgoing proxy instead of the built-in MTA.
This allows the client to send email using the SMTP server that they specify, rather than enforcing the use of the FortiMail unit’s own built-in MTA. The outgoing proxy will refuse the connection if the client’s specified destination SMTP server is not available. In addition, it will not queue email from the SMTP client, and if the client does not successfully complete the connection, the outgoing proxy will simply drop the connection, and will not retry.
Disable to relay email using the built-in MTA to either the
SMTP relay defined in
“Relay Server” on page 203 , if any,
or directly to the MTA that is the mail exchanger (MX) for the recipient email address’s (RCPT TO:) domain. The email may not actually travel through the unprotected
SMTP server, even though it was the relay originally
specified by the SMTP client. For details, see “When
FortiMail uses the proxies instead of the built-in MTA” on page 230
.
Caution: If this option is enabled, consider also enabling
“Prevent open relaying” on page 294 . Failure to do so
could allow clients to use open relays.
Note: If this option is disabled, and an SMTP client is configured to authenticate, you must configure and apply an authentication profile. Without the profile, authentication with the built-in MTA will fail. Also, the mail server must be explicitly configured to allow relay in this case.
Note: If this option is enabled, you will not be able to use
IP pools. For more information, see “Source IP pool” on page 220
.
Note: For security reasons, this option does not apply if there is no session profile selected in the applicable IPbased policy. For more information on configuring IP policies, see
“Controlling email based upon IP addresses” on page 278 .
Port The name of a network interface through which SMTP connections ingress. The proxy or built-in MTA on this network interface can be configured to pass through, drop, or intercept and process SMTP connections according to the incoming or outgoing directionality of the connection.
Incoming SMTP connections Select how the proxy or built-in MTA will handle SMTP connections on each network interface that are incoming to the IP addresses of email servers belonging to a protected domain.
• Are passed through: Permit connections but do not proxy or relay. Because traffic is not proxied or relayed, no policies will be applied.
• Are dropped: Drop connections.
• Are proxied: Proxy or relay connections. Once intercepted, policies determine any further scanning or logging actions. For more information, see
.
Note: Depending on your network topology, you may want to verify that email is not being scanned twice. This could result if, due to mail routing, an email would travel through the FortiMail unit multiple times in order to reach its final destination, and you have selected Are proxied more than once on this page. For an example, see
“Avoiding scanning email twice” on page 233
.
238
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Mail Settings Configuring the proxies & implicit relay
Outgoing SMTP connections Select how the proxy or built-in MTA will handle SMTP connections on each network interface that are outgoing to the IP addresses of email servers that are not a protected domain.
• Are passed through: Permit connections but do not proxy or relay. Because traffic is not proxied or relayed, no policies will be applied.
• Are dropped: Drop connections.
• Are proxied: Proxy or relay connections. Once intercepted, policies determine any further scanning or logging actions. For more information, see
.
Note: Depending on your network topology, you may want to verify that email is not being scanned twice. This could result if, due to mail routing, an email would travel through the FortiMail unit multiple times in order to reach its final destination, and you have selected Are proxied more than once on this page. For an example, see
“Avoiding scanning email twice” on page 233
.
Local SMTP connections Select how the FortiMail unit will handle SMTP connections on each network interface that are destined for the FortiMail unit itself, such as quarantine release or delete messages and Bayesian training messages.
• Are allowed: SMTP connections will be allowed.
• Are not allowed: SMTP connections will be blocked.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
239
Configuring the proxies & implicit relay Mail Settings
240
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring and managing local user accounts
User
The User menu enables you to configure email user-related settings, such as groups,
PKI authentication, preferences, address mappings, and email address aliases.
If the FortiMail unit is operating in server mode, the User menu also enables you to add email user accounts. Email users can then access their email that is hosted on the
FortiMail unit using webmail, POP3 and/or IMAP.
This topic includes:
•
Configuring and managing local user accounts
•
Configuring users’ preferences
•
Configuring PKI authentication
•
•
•
Configuring and managing local user accounts
The User tab enables you to configure email user accounts whose mailboxes are hosted on the FortiMail unit.
Note: This option appears only if the FortiMail unit is operating in server mode.
Email users can check their email using webmail or through an email client such as
Microsoft Outlook, Mozilla Thunderbird, or Eudora, using POP3 or IMAP. For information
on webmail and other features used directly by email users, see “Setup for email users” on page 479
.
Some antispam behaviors can be configured specifically for each email user account. For example, each email user can train their own per-user Bayesian database and create white lists and black lists specific to their email user account. For information on
configuring per-user white lists and black lists, see “Configuring users’ preferences” on page 243
. For information on per-user Bayesian databases, see
“Backing up, batch training, & monitoring the Bayesian databases” on page 424 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of email user accounts, go to User > User > User.
Figure 125: Viewing the list of email user accounts
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
241
Configuring and managing local user accounts User
Export .CSV
Import .CSV
Domain
Click to download a backup of the email users list in comma-separated value
(CSV) file format.
Caution: Most of the email user accounts’ data, such as mailboxes and preferences, is not included in the .csv file. For information on performing a complete backup, see
“Backup and restore” on page 97 .
In the field to the right side of Import .CSV, enter the location of a CSV-formatted email user backup file, then click Import .CSV to upload the file to your FortiMail unit.
Before importing a user list or adding an email user, you must first configure one or more protected domains to which the email users will belong. For more information, see
“Configuring protected domains” on page 211 . You may also
want to back up the existing email user accounts. For details, see “Backup and restore” on page 97
.
Select the protected domain to display its email users, or to select the protected domain to which you want to add an email user account before clicking New.
(Check box in column heading.)
User Name
Mark the check box in the column heading to select the check boxes of all email users.
Mark the check boxes in the rows of individual email users to select only those email users.
The user name of an email user, such as user1. This is also the local-part portion of the email user’s primary email address.
Display Name The display name of an email user, such as "J Smith". This name appears in the From: field in the message headers of email messages sent from this email user.
Disk Usage (M) The disk space used by mailboxes for the email user, in megabytes (MB).
To configure an email user account
Before importing a user list or adding an email user, you must first configure one or more protected domains to which the email users will belong. For more information, see
“Configuring protected domains” on page 211
.
1 Go to User > User > User.
2 From Domain, select the name of the protected domain to which you want to add an email user.
3 Either click New to add an email user, or double-click to select an email user that you want to modify.
Figure 126: Configuring a new email user account
242
4 In User name, enter the name of the account whose email will be locally deliverable on the FortiMail unit.
For example, an email user may have numerous aliases, mail routing, and other email addresses on other systems in your network, such as [email protected]; this user name, however, reflects the email user’s account that they will use to log on to this
FortiMail unit, such as jsmith if their email address is [email protected].
5 In the drop-down menu to the right of the '@' symbol, select the name of the protected domain to which the email user belongs.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring users’ preferences
6 Select either:
• Password, then enter the password for this email account, or
• LDAP, then select the name of an LDAP profile in which you have enabled and
configured the User Authentication Options query, which enables the FortiMail unit
to query the LDAP server to authenticate the email user.
Note: The LDAP option requires that you first create an LDAP profile in which you have
enabled and configured User Authentication Options. For more information, see
“Configuring LDAP profiles” on page 333 .
7 In Display Name, enter the name of the user as it should appear in the message envelope.
For example, an email user whose email address is [email protected] may prefer that their Display Name be "J Smith".
8 Click OK.
The account is created, but authentication is not yet enabled, and a policy may not exists that allows the account to send and receive email.
9 To enable the user account, create a recipient-based policy that both matches its email
address and uses a resource profile in which User account status is enabled. For
details, see “How to enable & configure authentication of email users” on page 332 and
“Configuring resource profiles” on page 329 .
10 To allow the user account to send and receive email, configure an access control rule and either an IP-based policy or an incoming recipient-based policy. For details, see
Configuring users’ preferences
The User Preferences tab enables you to configure preferences for each email user, such as per-user white lists and preferred webmail/personal quarantine language.
Preferences may be for email user accounts that are either:
• local, as with server mode (see “Configuring and managing local user accounts” on page 241 ), or
• hosted on your protected SMTP server, such as with gateway mode or transparent mode
Although you may have created a local user account, his or her preferences entry may not have been created. You can either wait for an event that requires it to be automatically initialized using the default values, or you can manually create and modify it.
Both FortiMail administrators and email users can modify the email user’s preferences.
Administrators can modify preferences for each email user through the web-based manager; email users can modify their own preferences by logging in to the FortiMail webmail or quarantine.
Available preferences for email users vary by whether or not the FortiMail unit is operating in server mode. For example, out-of-office status messages and mail forwarding can only be configured for email user accounts when the FortiMail unit is operating in server mode.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of user preferences, go to User > User > User Preferences.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
243
Configuring users’ preferences
Figure 127: Viewing the list of user preferences
User
Domain
(Check box in column heading)
User Name
Language
White List
Black List
Select the protected domain to display its email users, or to select the protected domain to which you want to add an email user account before clicking New.
Mark the check box in the column heading to select the checkboxes of all email user preference entries.
Mark the check boxes in the rows of individual email user preference entries to select only those email users.
The user name of an email user, such as user1.
The language in which this email user prefers to display their quarantine and, if the FortiMail unit is operating in server mode, webmail. By default, this language preference is the same as the system-wide default webmail language preference. For more information, see
“Customizing the appearance” on page 141 .
Indicates whether or not a personal white list currently exists for this email user, and enables you to configure, back up, and restore the personal white list. White lists include sender IP addresses, domain names, and email addresses that the email user wants to permit.
• New: A personal white list does not currently exist for this email user.
Click to create a per-user white list.
• Edit: A personal white list currently exists for this email user. Click to modify the personal white list, or to back up or restore the email user’s personal white list.
Note: System-level lists take precedence over domain-level lists while domain-level lists take precedence over personal-level lists.
For more information on white lists and black lists, see
“Configuring the black lists & white lists” on page 390 .
Indicates whether or not a personal black list currently exists for this email user, and enables you to configure, back up, and restore the personal black list. White lists include sender IP addresses, domain names, and email addresses that the email user wants to block.
• New: A personal black list does not currently exist for this email user.
Click to create a personal black list.
• Edit: A personal white list currently exists for this email user. Click to modify the personal black list, or to back up or restore the email user’s personal black list.
Note: System-level lists take precedence over domain-level lists while domain-level lists take precedence over personal-level lists.
For more information on white lists and black lists, see
“Configuring the black lists & white lists” on page 390 .
244
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring users’ preferences
Secondary Accounts Indicates whether or not this email user will also handle quarantined email messages for other email addresses.
• New: A list of email addresses whose quarantines will be managed by this email user does not currently exist. Click to add this list of email addresses.
• Edit: A list of email addresses whose quarantines will be managed by this email user already exists. Click to modify this list of email addresses.
Add Outgoing Email
Addresses to
WhiteList
Indicates whether or not the FortiMail unit will automatically add recipient addresses in outgoing email sent by this email user to their per-user white list, if it is allowed in the antispam profile. For more information, see
“Configuring antispam action profiles” on page 312
.
• Empty check box: Automatic per-user whitelisting is disabled.
• Marked check box: Automatic per-user whitelisting is enabled.
Email users can change this setting in their webmail preferences. For more information, log in to the FortiMail webmail, then click Help.
This setting can be initialized manually or automatically. FortiMail administrators can manually create and configure this setting when configuring email user preferences. If the setting has not yet been created when either:
• an email user logs in to FortiMail webmail
• an email user sends outgoing email through the FortiMail unit
• a FortiMail administrator configures the email user’s personal black or
white list (see “Configuring the personal black lists & white lists” on page 396
) then the FortiMail unit will automatically initialize this setting as disabled.
To configure the preferences for an email user
1 Go to User > User > User Preferences.
2 Either click New, or double-click the user name of the email user whose preferences you want to modify.
3 Configure the following:
Figure 128: Configuring user preferences
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
245
Configuring users’ preferences User
Language
On holiday
(server mode only)
Set auto-reply message
(server mode only)
Auto forward
(server mode only)
Set auto-reply message
(server mode only)
Leave a copy in mailbox
(server mode only)
Select the email user’s preferred language in which to display the quarantine and, if the FortiMail unit is operating in server mode,
FortiMail webmail. Languages available include:
• Arabic
• Traditional Chinese
• Simplified Chinese
• English
• French
• German
• Hebrew
• Italian
• Japanese
• Korean
• Polish
• Portuguese
• Spanish
• Turkish
• Welsh
Additional languages may be available if you have installed their
language resource files. For more information, see “Customizing the appearance” on page 141 .
Select whether or not the FortiMail unit automatically responds to email messages received for this email user, which is typically used for out-ofoffice/vacation responses.
•
On: Enable automatic response. Also configure Set auto-reply
• Off: Disable automatic response.
Click to enter the message body that the FortiMail unit will use to
automatically reply when On holiday is set to On.
Select whether or not the FortiMail unit will automatically forward email messages received for this email user to another email address.
• On: Automatically forward, then enter the email address to which email will be forwarded.
• Off: Disable automatic forwarding.
Click to enter the recipient email address that the FortiMail unit will use
to when Auto forward is set to On.
Mark this check box to retain a copy of email messages received for this user that have been automatically forwarded.
This option is available only if Auto forward is On, after you have
entered the email address to which email will be forwarded.
246
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring users’ preferences
Add outgoing email addresses to White list
Black/White Lists
Select whether or not to automatically add recipient addresses in outgoing email sent by this email user to their per-user white list, if it is allowed in the antispam profile. For more information, see
“Configuring antispam action profiles” on page 312 .
• On: Automatically whitelist recipient addresses in outgoing email for this email user.
• Off: Do not automatically whitelist recipient addresses in outgoing email for this email user.
Email users can change this setting in their webmail preferences. For more information, log in to the FortiMail webmail, then click Help.
This setting can be initialized manually or automatically. FortiMail administrators can manually create and configure this setting when configuring email user preferences. If the setting has not yet been created when either:
• an email user logs in to FortiMail webmail
• an email user sends outgoing email through the FortiMail unit
• a FortiMail administrator configures the email user’s personal black or white list (see
“Configuring the personal black lists & white lists” on page 396
) then the FortiMail unit will automatically initialize this setting as disabled.
Links to configure the per-user white and/or black list for this email user.
• Black: Click to view, modify, back up or restore the per-user black list for this email user.
• White: Click to view, modify, back up or restore the per-user white list for this email user.
For an alternative method to configuring per-user white lists and black lists, see
“Configuring users’ preferences” on page 243 . For information
on white lists and black lists in general, see “Configuring the black lists
.
Receive spam report Select whether or not the FortiMail unit will automatically periodically generate quarantine reports for this email user.
• On: Periodically generate quarantine reports for this email user.
Depending on your configuration, quarantine reports may be sent to an email address other than the email address of this email user.
For example, you could configure the FortiMail unit to send quarantine reports to the email address of a person who is responsible for reviewing quarantine reports for multiple users.
FortiMail units will generate a quarantine report for an email user only if all of the following conditions are true:
• In antispam profiles that have been used to process email for this
email user, you have enabled the options Quarantine and Send
quarantine report. For more information, see
“Configuring antispam action profiles” on page 312 .
• The email user’s Bulk folder exists.
• The email user has received spam since the previous quarantine report was generated. (If no spam has been received, there is nothing to report.)
• The email user preference Receive spam report is On.
• Off: Do not generate quarantine reports for this email user.
This option applies only if generation of quarantine reports has been enabled for the protected domain. For more information, see
“Configuring protected domains” on page 211 .
For more information on quarantine reports, see
“Configuring global quarantine report settings” on page 380
.
Primary Accounts Click an email address to view the email user preferences of that primary account. Email addresses listed in this field are email users for which this email user is a secondary account.
This option is not available (None appears) if this email user has not been configured as the secondary account of any other email user. For information on configuring secondary accounts, see
Secondary Accounts Click None or an email address to define other email addresses whose quarantine will be managed by this email user. Email addresses listed in this field are email users for which this email user is a primary account.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
247
Configuring PKI authentication User
4 Click OK.
Configuring PKI authentication
The PKI User tab displays a list of public key infrastructure (PKI) users.
PKI users can authenticate by presenting a valid client certificate, rather than by entering a user name and password. A PKI user can be either an email user or a FortiMail administrator.
When the PKI user connects to the FortiMail unit with his or her web browser, the web browser presents the PKI user’s certificate to the FortiMail unit. If the certificate is valid, the FortiMail unit then authenticates the PKI user. To be valid, a client certificate must:
• Not be expired
• Not be revoked by either certificate revocation list (CRL) or, if enabled, online certificate status protocol (OCSP)
• Be signed by a certificate authority (CA), whose certificate you have imported into the
FortiMail unit
• Contain a CA field whose value matches the CA certificate
• Contain a Issuer field whose value matches the Subject field in the CA certificate
• Contain a Subject field whose value contains the subject, or is empty
• If LDAP Query is enabled, contain a Common Name (CN) or Subject Alternative field whose value matches the email address of a user object retrieved using the User
Query Options of the LDAP profile
Note: Web browsers may have their own certificate validation requirements in addition to
FortiMail requirements. For example, personal certificates may be required to contain the
PKI user’s email address in the Subject Alternative Name field, and that Key Usage field contain Digital Signature, Data Encipherment, Key Encipherment. For browser requirements, see your web browser’s documentation.
If the client certificate is not valid, depending on whether you have configured the
FortiMail unit to require valid certificates, authentication will either fail absolutely, or fail over to a user name and password mode of authentication.
If the certificate is valid and authentication succeeds, the PKI user’s web browser is redirected to either the web-based manager (for PKI users that are FortiMail administrators) or FortiMail webmail or the personal quarantine (for PKI users that are email users).
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of PKI users, go to User > User > PKI User.
Figure 129: Viewing the list of PKI users
248
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring PKI authentication
Name
Domain
CA
Subject
LDAP
OCSP
The user name of the PKI user.
The protected domain to which the PKI user is assigned. If Domain is empty,
.
The name of the CA certificate used when validating the CA’s signature of the
The value which must match the Subject field of the client certificate. If empty, matching values are not considered when validating the client certificate presented by the PKI user’s web browser.
If LDAP query is enabled, the LDAP configuration of this PKI user is shown in
three parts:
• Whether the LDAP query setting is enabled (indicated by E) or disabled
(indicated by “-”).
• The name of the LDAP profile used for the query. For more information,
see “Configuring LDAP profiles” on page 333 .
• The name of the field in the client certificate (either Subject Alternative or
CN) whose value must match the email address of a user object in the
LDAP directory.
For example, E/ldapprof/Subject Alternative indicates that LDAP query is enabled, and will use the LDAP profile named ldapprof to validate the Subject Alternative field of the client certificate.
If OCSP is enabled, the OCSP configuration of this PKI user is shown in three
parts:
• Whether OSCP is enabled (indicated by E) or disabled (indicated by “-”).
• The URL of the OCSP server.
• The action to take if the OCSP server is unavailable. If set to ignore, the
FortiMail unit allows the user to authenticate. If set to revoke, the FortiMail unit behaves as if the certificate is currently revoked, and authentication fails.
For example, E/https://www.example.com/Revoke indicates OCSP is enabled, using the OSCP server at https://www.example.com, and if the
OSCP server is unavailable, the FortiMail unit prevents the user from authenticating.
To configure a PKI authenticator
1 Go User > User > PKI User.
2 Click New to add PKI authentication for an email user or administrator account, or double-click to select an account that you want to modify.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
249
Configuring PKI authentication
Figure 130: Configuring a PKI user
User
250
User Name
Domain
CA
Enter the name of the PKI user entry.
This is not required to be the same as the administrator or email user’s account name, although you may find it helpful to be so.
For example, you might have an administrator account named admin1.You might therefore find it most straightforward to also name the PKI user admin1, making it easy to remember which account you intended to use these PKI settings.
Select either the protected domain to which the PKI user is assigned, or, if the
PKI user is a FortiMail administrator, select System.
Select either None or the name of the CA certificate to use when validating the
If you select None, you must configure Subject.
Subject Enter the value which must match the Subject field of the client certificate, or leave this field empty. If empty, matching values are not considered when validating the client certificate presented by the PKI user’s web browser.
If you do not configure Subject, you must configure CA.
LDAP query Enable to query an LDAP directory, such as Microsoft Active Directory, to determine the existence of the PKI user who is attempting to authenticate, then
also configure LDAP profile and Query field.
Note: If this option is enabled, no local user configuration is necessary. Instead, the FortiMail unit will create the personal quarantine folder and other necessary items when PKI authentication queries the LDAP server.
OCSP
LDAP profile Select the LDAP profile to use when querying the LDAP server.
For more information, see “Configuring LDAP profiles” on page 333
.
This option is available only if LDAP query is enabled.
Query field Select the name of the field in the client certificate (either CN or
Subject Alternative) which contains the email address of the
PKI user.
This email address will be compared with the value of the email address attribute for each user object queried from the LDAP directory to determine if the PKI user exists in the LDAP directory.
This option is available only if LDAP query is enabled.
Enable to use an Online Certificate Status Protocol (OCSP) server to query
whether the client certificate has been revoked, then also configure URL,
Remote certificate, and Unavailable action.
URL The URL of the OCSP server.
This option is available only if OCSP is enabled.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring user groups
Remote certificate
Unavailable action
Select the remote certificate that is used to verify the identity of the OCSP server. For more information, see
“Managing OCSP server certificates” on page 197
.
This option is available only if OCSP is enabled.
Select the action to take if the OCSP server is unavailable. If set to ignore, the FortiMail unit allows the user to authenticate.
If set to revoke, the FortiMail unit behaves as if the certificate is currently revoked, and authentication fails.
This option is available only if OCSP is enabled.
4 Click Create.
5 Configure the following aspects of the FortiMail unit and the PKI user’s computer:
• Enable PKI authentication using the following CLI command: config system global set pki-mode enable end
• Import each PKI user’s client certificate into the web browser of each computer from which the PKI user will access the FortiMail unit. For details on installing certificates, see the documentation for your web browser. Client certificates must be valid. For information on how FortiMail units validate the client certificates of PKI users, see
“Configuring PKI authentication” on page 248
.
• Import the CA certificate into the FortiMail unit. For more information, see
“Managing certificate authority certificates” on page 195 .
• For PKI users that are FortiMail administrators, select the PKI authentication type and select a PKI user to which the administrator account corresponds. For more information, see
“Configuring administrator accounts & access profiles” on page 144
.
• For PKI users that are email users, enable PKI user authentication in the incoming recipient-based policies which match those email users. For more information, see
“Controlling email based upon the recipient” on page 272 .
Caution: Control access to each PKI user’s computer. Certificate-based PKI authentication controls access to the FortiMail unit based upon PKI certificates, which are installed on each email user or administrator’s computer. If anyone can access the computers where those PKI certificates are installed, they can gain access to the FortiMail unit, which can compromise the security of your FortiMail unit.
Configuring user groups
The User Group tab enables you to group related email user accounts.
Email user groups can simplify the creation of policies: when creating policies, you can select the name of an email user group, rather than entering each email user name individually.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of user groups, go to User > User > User Group.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
251
Configuring aliases User
Figure 131: Viewing the list of user groups
Domain
Name
Members
Select the name of a protected domain to display user groups that belong to it.
The name of the user group.
The email users that are members of this user group.
To configure an email user group
Tip: Alternatively to configuring user groups locally, you can configure the FortiMail unit to
query an LDAP directory. For details, see “Configuring LDAP profiles” on page 333 .
1 Go to User > User > User Group.
2 Either click New to add a group, or double-click to select a group that you want to modify.
Figure 132: Configuring a user group
3 In Group name, enter the name of the email user group.
4 Select the members of the email user group:
• In the Available users area, select the names of one or more email users that you want to add to the email user group, then click the right arrow to move them to the Members area.
• In the Members area, select the names of one or more email users that you want to remove from the email user group, then click the left arrow to return them to the
Available users area.
5 Click Create.
Configuring aliases
The User Alias tab enables you to configure email address aliases for protected domains.
252
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring aliases
Aliases are sometimes also called distribution lists, and may translate one email address to the email addresses of several recipients, also called members, or may be simply a literal alias — that is, an alternative email address that resolves to the real email address of a single email user.
For example, [email protected] might be an alias that the FortiMail unit will expand to [email protected] and [email protected], having the effect of distributing an email message to all email addresses that are members of that alias, while [email protected] might be an alias that the FortiMail unit translates to [email protected]. In both cases, the FortiMail unit converts the alias in the recipient fields of incoming email messages into the member email addresses of the alias, each of which are the email address of an email user that is locally deliverable on the SMTP server or FortiMail unit.
Note: Members of an alias can include the email address of the alias itself.
Unlike address maps, aliases can be one-to-many relationships between the alias and its members, but cannot be bidirectional — that is, recipient email addresses that are aliases are translated into their member email addresses, but sender email addresses that are members are not translated into aliases.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Others category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of alias addresses, go to User > User Alias > User Alias.
Figure 133: Viewing the list of aliases
Domain
Alias Name
Members
Select the name of a protected domain to view email address aliases for that protected domain.
The email address of the alias, such as [email protected].
The email addresses to which the alias will translate, which may be the email addresses of one or more local or non-local email users. Multiple email addresses are comma-delimited.
Aliases can contain both or either local and non-local email addresses as members of the alias. For example, if the local protected domain is mail.example.com, you could create an email address alias whose members are:
• [email protected], which is locally deliverable to the protected domain
• [email protected], which is not locally deliverable to the protected domain
To configure an alias
Tip: Alternatively to configuring aliases locally, you can configure the FortiMail unit to query an LDAP directory. For details, see
“Configuring LDAP profiles” on page 333 .
1 Go to User > User Alias > User Alias.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
253
Configuring aliases
2 Either click New to add an alias, or double-click to select an alias that you want to modify.
A dialog appears. Its appearance varies by whether or not the FortiMail unit is operating in server mode.
Figure 134: Configuring an alias (gateway mode and transparent mode)
User
Figure 135: Configuring an alias (server mode)
254
3 If the FortiMail unit is operating in server mode, from Select an internal domain, select the name of a protected domain to display the email addresses of users from a specific protected domain.
The email addresses of email users from the selected protected domain (that is, local users) appear in the Available users area.
4 In Alias name, enter the local-part (the part before the '@' symbol) of the email address alias, then select the name of its protected domain.
For example, for the alias [email protected], you would enter group1 and select example.com.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring address mappings
5 Select the members of the alias.
If the FortiMail unit is operating in gateway mode or transparent mode:
• To add members to the alias, in the field to the left of the right arrow button, enter the email address, then click the right arrow button. The email address appears in the Members area.
• To remove members from the alias, in the Members area, select one or more email addresses, then click Remove Selected.
If the FortiMail unit is operating in server mode:
• To add local email addresses as members to the alias, in the Available users area, select one or more email addresses, then click the right arrow. The email addresses are removed from the Available users area, and appear in the Members area.
• To add non-local email addresses as members to the alias, in the External Email
address field, enter the email address, then click the right arrow next to the field.
The email address appears in the Members area.
• To remove members from the alias, in the Members area, select one or more email addresses, then click the left arrow. The email addresses are removed from the
Members area; local email addresses return to the Available users area.
•
6 Click Create.
Configuring address mappings
Address mappings are bidirectional, one-to-one or many-to-many mappings. They can be useful when:
• you want to hide a protected domain’s true email addresses from recipients
• a mail domain’s domain name is not globally DNS-resolvable, and you want to replace the domain name with one that is
• you want to rewrite email addresses
Like aliases, address mappings translate email addresses. They do not translate many email addresses into a single email address. However, unlike aliases:
• Mappings cannot translate one email address into many.
• Mappings cannot translate an email address into one that belongs to an unprotected domain. (This restriction applies to locally defined address mappings only. This is not enforced for mappings defined on an LDAP server.)
• Mappings are applied bidirectionally, when an email is outgoing as well as when it is incoming to the protected domain.
• Mappings may affect both sender and recipient email addresses, and may affect those email addresses in both the message envelope and the message header, depending on the match condition.
The following table illustrates the sequence in which parts of each email are compared with address mappings for a match, and which locations’ email addresses are translated if a match is found.
Note: Both RCPT TO: and MAIL FROM: email addresses are always evaluated for a match with an address mapping. If both RCPT TO: and MAIL FROM: contain email addresses that match the mapping, both mapping translations will be performed.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
255
Configuring address mappings User
Table 29: Match evaluation and rewrite behavior for email address mappings
Order of evaluation
1
Match condition
2
If yes...
Rewrite to...
Does RCPT TO: match an external email address?
Does MAIL FROM: match an internal email address?
Replace RCPT TO:.
For each of the following, if it matches an internal email address, replace it:
• MAIL FROM:
• RCPT TO:
• From:
• To:
• Return-Path:
• Cc:
• Reply-To:
• Return-Receipt-To:
• Resent-From:
• Resent-Sender:
• Delivery-Receipt-To:
• Disposition-Notification-To:
Internal email address
External email address
For example, you could create an address mapping between the internal email address [email protected] and the external email address [email protected]. The following effects would be observable on the simplest case of an outgoing email and an incoming reply:
• For email from [email protected] to others: [email protected] in both the message envelope (MAIL FROM:) and many message headers (From:, Cc:, etc.) would then be replaced with [email protected]. Recipients would only be aware of the email address [email protected].
• For email to [email protected] from others: The recipient address in the message envelope (RCPT TO:), but not the message header (To:), would be replaced with [email protected]. [email protected] would be aware that the sender had originally sent the email to the mapped address, [email protected].
You can alternatively create address mappings by configuring the FortiMail unit to query an LDAP server that contains address mappings. For more information, see
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Others category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the address map list, go to User > Address Map > Address Map.
Figure 136: Viewing the list of address mappings
256
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
User Configuring address mappings
Domain
Internal Email
Address
External Email
Address
Select the name of a protected domain to view address maps whose internal email address belongs to that protected domain.
Either an email address, such as [email protected], or an email address pattern, such as *@example.com, that exists in a protected domain.
This email address is hidden to the external network by being rewritten into the external email address according to the match conditions and effects described in Table 29 on page 256 .
Either an email address, such as [email protected], or an email address pattern, such as *@example.net, that exists in a protected domain.
This email address is visible to the internal network, but will be rewritten into the internal email address according to the match conditions and effects described in Table 29 on page 256 .
To configure an address mapping
Tip: Alternatively to configuring address mappings locally, you can configure the FortiMail unit to query an LDAP directory. For details, see
“Configuring LDAP profiles” on page 333
.
1 Go to User > Address Map > Address Map.
2 Either click New to add an address mapping, or double-click to select a mapping that you want to modify.
3 Configure the following:
Figure 137: Configuring an address mapping
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
257
Configuring address mappings User
Internal email address
External email address
Enter either an email address, such as [email protected], or an email address pattern, such as *@example.com, that exists in a protected domain.
This email address is hidden when passing to the external network by being rewritten into the external email address according to the match conditions and effects described in Table 29 on page 256 .
Note: If you enter a pattern with a wild card (* or ?):
• You must enter a pattern using the same wild card in the external email address. The wild card indicates that the mapping could match many email addresses, but also indicates, during the rewrite, which substring of the original email address will be substituted into the position of the wild card in the external address. If there is no wild card in the other half of the mapping, or the wild card is not the same (that is, * mapped to ? or vice versa), this substitution will fail.
• The external email address must not be within the same protected domain. Otherwise, it may cause situations where an email address is rewritten twice, by matching both the sender and recipient rewrite conditions, and the result is therefore the same as the original email address and possibly not deliverable.
Enter either an email address, such as [email protected], or an email address pattern, such as *@example.net, that exists in a protected domain.
This email address is visible to the internal network, but will be rewritten into the internal email address according to the match conditions and effects described in Table 29 on page 256 .
Note: If you enter a pattern with a wild card (* or ?):
• You must enter a pattern using the same wild card in the internal email address. The wild card indicates that the mapping could match many email addresses, but also indicates, during the rewrite, which substring of the original email address will be substituted into the position of the wild card in the internal address. If there is no wild card in the other half of the mapping, or the wild card is not the same (that is, * mapped to ? or vice versa), this substitution will fail.
• The internal email address must not be within the same protected domain. Otherwise, it may cause situations where an email address is rewritten twice, by matching both the sender and recipient rewrite conditions, and the result is therefore the same as the original email address and possibly not deliverable.
4 Click Create.
258
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy What is a policy?
Policy
The Policy menu enables you to create policies that use profiles to filter email.
It also enables you to control who can send email through the FortiMail unit, and stipulate rules for how it will deliver email that it proxies or relays.
Caution: Modify or delete policies and policy settings with care. Any changes made to a policy take effect immediately.
This topic includes:
•
•
•
Controlling SMTP access & delivery
•
Controlling email based upon the recipient
•
Controlling email based upon IP addresses
What is a policy?
A policy defines which way traffic will be filtered. It may also define user account settings, such as authentication type, disk quota, and access to webmail.
After creating the antispam, antivirus, content, authentication, TLS, or resource profiles
), you need to apply them to policies for them to take effect.
FortiMail units support three types of policies:
• Access control and delivery rules, typical to SMTP relays and servers (see
“Controlling SMTP access & delivery” on page 261
)
• Recipient-based policies (see
“Controlling email based upon the recipient” on page 272 )
• IP-based policies (see
“Controlling email based upon IP addresses” on page 278 )
Recipient-based policies vs. IP-based policies
• Recipient-based policies: Applied based upon the recipient’s email address or the recipient’s user group. May also define authenticated webmail or POP3 access by that email user to their per-recipient quarantine. Since version 4.0, the recipient-based policies also check sender patterns.
• IP-based policies: Applied based upon the SMTP client’s IP address (server mode or gateway mode), or the IP addresses of both the SMTP client and SMTP server
(transparent mode).
Incoming vs. outgoing recipient-based policies
Which recipient-based policy is applied is determined by whether an email message is incoming or outgoing.
Whether the email is incoming or outgoing is decided by the domain name in the recipient’s email address. If the domain is a protected domain, the FortiMail unit considers the message to be incoming and applies the first matching incoming recipient-based policy. If the recipient domain is not a protected domain, the message is considered to be outgoing, and applies outgoing recipient-based policy.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
259
How to use policies Policy
To be more specific, the FortiMail unit actually matches the recipient domain’s IP address with the IP list of the protected SMTP servers where the protected domains reside. If there is an IP match, the domain is considered as protected and the email destined to this domain is considered to be incoming. If there is no IP match, the domain is considered as unprotected and the email destined to this domain is considered to be outgoing.
For more information on protected domains, see
“Configuring protected domains” on page 211
.
Note: IP-based policies are not divided into incoming and outgoing types. The client IP address and, for transparent mode, the server IP address are only used to determine whether or not the IP-based policy matches.
How to use policies
Access control rules and delivery rules can be used as you would typically use them to control which SMTP clients can send email through an SMTP relay, and how it would deliver email that it proxies or relays.
Recipient-based policies are applied to individual email messages based on the recipient’s email address.
IP-based policies are applied based upon the IP address of the connecting SMTP client and, if the FortiMail unit is operating in transparent mode, the SMTP server.
Whether to use IP-based or recipient-based policies
Since there are two types of policies, which type of policies should you use?
You can use either or both.
Exceptions include the following scenarios, which require IP-based policies:
• Mail Hosting Service Providers: There is a great number of domains, and it is not feasible to configure them all as protected domains on the FortiMail unit.
• Internet Service Providers (ISPs): Mail domains of customers are not known.
• Session control: Even if protected domains are known and configured on the
FortiMail unit, an IP-based policy must be created in order to apply a session profile.
Session profiles are only available in IP-based policies.
• Differentiated services based upon the network of origin: To apply antispam and/or antivirus based upon the IP address of the SMTP client or based upon a notion of the internal or external network, rather than the domain in a recipient’s email address, you must use an IP-based policy.
As a general rule, it is simpler to use IP-based policies. Use recipient-based policies only where they are required, such as when the policy must be tailored for a specific email address.
For example, if your company is an ISP, you can use recipient-based policies to apply antispam and antivirus profiles for only the customers who have paid for those services.
If both a recipient-based policy and an IP-based policy match the email, unless you have
enabled Take precedence over recipient based policy match in the IP-based policy, the
settings in the recipient-based policy will have precedence.
Order of execution of policies
Arrange policies in the policy list by placing the most specific policy at the top and more general policies at the bottom.
260
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling SMTP access & delivery
For example, a recipient-based policy created with an asterisk (*) entered for the user name is the most general policy possible because it will match all users in the domain.
When you create more specific policies, you should move them above this policy.
Otherwise, the general policy would always match all email for the domain, and no other recipient-based policy would ever be applied.
FortiMail units execute policies in the following order:
1 The FortiMail unit looks for a matching IP-based policy.
Policies are evaluated for a match with the IP address of the SMTP client and, for transparent mode, the server. Evaluation occurs in the order of each policy’s distance from the top of the list of IP-based policies. Once a match is found, the FortiMail unit does not evaluate subsequent IP-based policies.
If you have enabled Take precedence over recipient based policy match in the IP-
based policy, the FortiMail unit applies the profiles in the IP-based policy, and ignores recipient-based policies. It does not continue to step
.
2 The FortiMail unit looks for a matching recipient-based policy.
Policies are evaluated for a match with the domain name portion of the recipient’s email address (RCPT TO:), also known as the domain-part. Incoming policies are evaluated for matches before outgoing policies. Evaluation occurs in the order of each policy’s distance from the top of the list of recipient-based policies. Once a match is found, the FortiMail unit does not evaluate subsequent recipient-based policies.
3 The FortiMail unit applies the profiles in the matching recipient-based policy, if any.
4 The FortiMail unit applies the profiles in the matching IP-based policy, if any, only if you
have not already applied profiles of that type in step 3 .
Caution: If SMTP traffic does not match any IP-based or recipient-based policy, it is allowed. However, no antivirus or antispam protection may be applied.
If you are certain that you have configured policies to match and allow all required traffic, you can tighten security by adding an IP policy at the bottom of the policy list to reject all other, unwanted connections.
Which policy/profile is applied when an email has multiple recipients?
When applying recipient-based policies, an email message with multiple recipients is treated as if it were multiple email messages, each with a single recipient. This allows a fine degree of control for each recipient, but also means that separate recipient-based policies may block the email for one of the recipients but allow it for another.
Exceptions include use of an antivirus profile. In this case, the FortiMail unit will treat an email with multiple recipients as a single email. Starting with the first recipient email address, the FortiMail unit will look for a matching recipient-based policy. If none is found, the FortiMail unit will evaluate each subsequent recipient email address for a matching policy. The FortiMail unit will apply only the first matching policy; it will not evaluate subsequent recipients for a matching policy. If no matching recipient-based policy is found, the FortiMail unit will apply the antivirus profile from the IP-based policy, if any.
If no recipient-based or IP-based policy matches, no profiles will be applied.
Controlling SMTP access & delivery
The Access Control submenu enables you to configure access control rules for SMTP sessions.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
261
Controlling SMTP access & delivery
262
Policy
(if the FortiMail unit is operating in transparent mode), access control rules take effect after the FortiMail unit has initiated or received an
IP- and TCP-level connection, at the application layer of the network.
Note: Other protocols can also be restricted if the connection’s destination is the FortiMail
unit. For details, see “Configuring the network interfaces” on page 121
.
Access control rules are categorized separately based upon whether they affect either the receipt or delivery of email messages by the FortiMail unit — that is, whether or not the
FortiMail unit initiated the SMTP session, or was the destination.
This topic includes:
•
Configuring access control rules
•
•
Configuring access control rules
The Receive tab displays a list of access control rules that apply to SMTP sessions being
received by the FortiMail unit.
Access control rules, sometimes also called the access control list or ACL, specify whether the FortiMail unit will process and relay/proxy, reject, or discard email messages for SMTP sessions that are initiated by SMTP clients.
When an SMTP client attempts to deliver email through the FortiMail unit, the FortiMail unit compares each access control rule to the commands used by the SMTP client during the SMTP session, such as the envelope’s sender email address (MAIL FROM:), recipient email address (RCPT TO:), authentication (AUTH), and TLS (STARTTLS). Rules are evaluated for a match in the order of their list sequence, from top to bottom. If all the attributes of a rule match, the FortiMail unit applies the action selected in the matching rule to the SMTP session, and no subsequent access control rules are applied.
Only one access control rule is ever applied to any given SMTP session.
Note: If no access control rules are configured, or no matching access control rules exist,
and if the SMTP client is not configured to authenticate, the FortiMail unit will perform the default action, which varies by whether or not the recipient email address in the envelope
(RCPT TO:) is a member of a protected domain.
• For protected domains, the default action is RELAY.
• For unprotected domains, the default action is REJECT.
For information on protected domains, see “Configuring protected domains” on page 211
.
Without any configured access control rules, the FortiMail unit’s access control prevents
SMTP clients from using your protected server or FortiMail unit as an open relay: senders can deliver email incoming to protected domains, but cannot deliver email outgoing to unprotected domains.
If you want to allow SMTP clients such as your email users or email servers to send email to unprotected domains, you must configure at least one access control rule.
You may need to configure additional access control rules if, for example, you want to:
• discard or reject email from or to some email addresses, such as email addresses that no longer exist in your protected domain
• discard or reject email from some SMTP clients, such as a spammer that is not yet known to blacklists
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling SMTP access & delivery
For information on the sequence in which access control rules are used relative to other
antispam methods, see “Order of execution” on page 24
.
Like IP-based policies, access control rules can reject connections based upon IP address.
Unlike IP-based policies, however, access control rules cannot affect email in ways that occur after the session’s DATA command, such as by applying antispam profiles. Access control rules also cannot be overruled by recipient-based policies, and cannot match connections based upon the IP address of the SMTP server. (By the nature of how the
ACL controls access to or through the FortiMail unit, the SMTP server is always the
FortiMail unit itself, unless the FortiMail unit is operating in transparent mode.) For more
information on IP-based policies, see “Controlling email based upon IP addresses” on page 278
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of access control rules, go to Policy > Access Control > Receive.
Figure 138: Viewing the list of access control rules
Move
Enabled
ID
Click an access control rule to select it, click Move, then select either:
• the direction in which to move the selected rule (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the rule’s new location by entering the ID of another access control rule
FortiMail units match the rules in sequence, from the top of the list downwards.
Indicates whether or not the access control rule is currently in effect.
To disable an access control rule, mark the checkbox, then click Yes to confirm.
The number identifying the rule.
Note: This may be different from the order in which they appear on the page, which indicates order of evaluation.
FortiMail units evaluate delivery rules in sequence. Only the topmost matching delivery rule will be applied.
Sender Pattern
Recipient Pattern
The complete or partial envelope sender email address to match, or:
• Internal: Match any email address from a protected domain.
• External: Match any email address from an unprotected domain.
If the pattern is listed with a R/ prefix, it is set to use regular expression syntax. If the pattern is listed with a -/ prefix, it does not use regular expression syntax.
The complete or partial envelope recipient email address to match, or:
• Internal: Match any email address from a protected domain.
• External: Match any email address from an unprotected domain.
If the pattern is listed with a R/ prefix, it is set to use regular expression syntax. If the pattern is listed with a -/ prefix, it does not use regular expression syntax.
Sender IP/Netmask The IP address and netmask of the SMTP client attempting to deliver the email message. 0.0.0.0/0.0.0.0 matches any IP address.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
263
Controlling SMTP access & delivery Policy
Reverse DNS
Pattern
Authentication
Status
TLS Profile
Action
The pattern to compare to the result of a reverse DNS look-up of the IP address of the SMTP server delivering the email message.
If the pattern is listed with a R/ prefix, it is set to use regular expression syntax. If the pattern is listed with a -/ prefix, it does not use regular expression syntax.
Indicates whether this rule applies only to messages delivered by clients that have authenticated with the FortiMail unit.
• Any: Match or do not match this access control rule regardless of whether the client has authenticated with the FortiMail unit.
• Authenticated: Match this access control rule only for clients that have authenticated with the FortiMail unit.
• Not Authenticated: Match this access control rule only for clients that have not authenticated with the FortiMail unit.
Indicates the TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile.
• If the attributes match, the access control action is executed.
• If the attributes do not match, the FortiMail unit performs the Failure action configured in the TLS profile.
To edit the TLS profile, click its name. For details, see
“Configuring security profiles” on page 370 .
The action the FortiMail unit will perform for SMTP sessions matching this access control rule.
• BYPASS: Relay or proxy and deliver the email, but, if the sender or recipient belongs to a protected domain, bypass all antispam profile processing. Antivirus, content, greylisting, and other scans will still occur.
• DISCARD: Accept the email, but silently delete it and do not deliver it. Do not inform the SMTP client.
• RELAY: Relay or proxy, process, and deliver the email normally if it passes all configured scans. Do not apply greylisting.
• REJECT: Reject delivery of the email and respond to the SMTP client with SMTP reply code 550 (Relaying denied).
To configure an access control rule
Caution: If possible, verify configuration of access control rules in a testing environment before applying them to a FortiMail unit in active use. Failure to verify correctly configured reject, discard, and accept actions can result in inability to correctly handle SMTP sessions.
Caution: Do not create an access control rule whose Sender pattern is *, Recipient
pattern is *, Authentication status is Any, TLS profile is None, and Action is RELAY. This
access control rule matches and relays all connections, allowing open relay, which could result in other MTAs and DNSBL servers blacklisting your protected domain.
1 Go to Policy > Access Control > Receive.
2 Either click New to add a access control rule, or double-click to select a access control rule that you want to modify, then click Edit.
3 Configure the following settings:
264
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy
Figure 139: Configuring an access control rule
Controlling SMTP access & delivery
Enabled
Sender pattern
Regular expression
Recipient pattern
Regular expression
Sender IP/netmask
Select whether or not the access control rule is currently in effect.
Select User Defined and enter a complete or partial sender
(MAIL FROM:) email address to match, or select:
• Internal: Match any email address from a protected domain.
• External: Match any email address from an unprotected domain.
Wild card characters allow you to enter partial patterns that can match multiple sender email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
For example, the sender pattern ??@*.com will match messages sent by any email user with a two letter email user name from any
“.com” domain name.
Mark this check box to use regular expression syntax instead of wildcards to specify the sender pattern. For more information, see
“Using regular expressions” on page 31 .
Select User Defined and enter a complete or partial recipient
(RCPT TO:) email address to match, or select:
• Internal: Match any email address from a protected domain.
• External: Match any email address from an unprotected domain.
Wild card characters allow you to enter partial patterns that can match multiple recipient email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
For example, the recipient pattern *@example.??? will match messages sent to any email user at example.com, example.net, example.org, or any other “example” domain ending with a three-letter top-level domain name.
Mark this check box to use regular expression syntax instead of wildcards to specify the recipient pattern. For more information, see
“Using regular expressions” on page 31 .
Enter the IP address and netmask of the SMTP client attempting to deliver the email message. Use the netmask, the portion after the slash (/), to specify the matching subnet.
For example, enter 10.10.10.10/24 to match a 24-bit subnet, or all addresses starting with 10.10.10. This will appear as
10.10.10.0/24 in the access control rule table, with the 0 indicating that any value is matched in that position of the address.
Similarly, 10.10.10.10/32 will appear as 10.10.10.10/32 and match only the 10.10.10.10 address.
To match any address, enter 0.0.0.0/0.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
265
Controlling SMTP access & delivery Policy
Reverse DNS pattern
Regular expression
Authentication status
TLS profile
Action
Enter a pattern to compare to the result of a reverse DNS look-up of the IP address of the SMTP client delivering the email message.
Because domain names in the SMTP session are self-reported by the connecting SMTP server and easy to fake, the FortiMail unit does not trust the domain name that an SMTP server reports.
Instead, the FortiMail does a DNS lookup using the SMTP server’s
IP address. The resulting domain name is compared to the reverse
DNS pattern for a match. If the reverse DNS query fails, the access control rule match will also fail. If no other access control rule matches, the connection will be rejected with SMTP reply code 550
(Relaying denied).
Wildcard characters allow you to enter partial patterns that can match multiple reverse DNS lookup results. An asterisk (*) represents one or more characters; a question mark (?) represents any single character.
For example, the recipient pattern mail*.com will match messages delivered by an SMTP server whose domain name starts with “mail” and ends with “.com”.
Note: Reverse DNS queries for access control rules require that the domain name be a valid top level domain (TLD). For example, “.lab” is not a valid top level domain name, and thus the FortiMail unit cannot successfully perform a reverse DNS query for it.
Mark this check box to use regular expression syntax instead of wildcards to specify the reverse DNS pattern. For more information, see
“Using regular expressions” on page 31
.
Select whether or not to match this access control rule based upon client authentication.
• Any: Match or do not match this access control rule regardless of whether the client has authenticated with the FortiMail unit.
• Authenticated: Match this access control rule only for clients that have authenticated with the FortiMail unit.
• Not Authenticated: Match this access control rule only for clients that have not authenticated with the FortiMail unit.
Select a TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile.
• If the attributes match, the access control action is executed.
• If the attributes do not match, the FortiMail unit performs the
Failure action configured in the TLS profile.
For more information on TLS profiles, see
“Configuring TLS profiles” on page 370 .
Select which action the FortiMail unit will perform for SMTP sessions matching this access control rule.
• BYPASS: Relay or proxy and deliver the email, but, if the sender or recipient belongs to a protected domain, bypass all antispam profile processing. Antivirus, content, greylisting and other scans will still occur.
• DISCARD: Accept the email, but silently delete it and do not deliver it. Do not inform the SMTP client.
• RELAY: Relay or proxy, process, and deliver the email normally if it passes all configured scans. Do not apply greylisting.
• REJECT: Reject delivery of the email and respond to the SMTP client with SMTP reply code 550 (Relaying denied).
266
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling SMTP access & delivery
When configuring access control rules, do not leave any pattern fields blank.
Instead, to have the FortiMail unit ignore a pattern:
• If Regular expression is disabled for the field, enter an asterisk (*) in the pattern field.
• If Regular expression is enabled for the field, enter a dot-star (.*) character sequence in the pattern field.
For example, if you enter an asterisk (*) in the Recipient Pattern field and do not enable Regular expression, the asterisk matches all recipient addresses, and therefore will not exclude any SMTP sessions from matching the access control rule.
4 Click Create.
The access control rule appears at the bottom of the list of access control rules. As a result, the FortiMail unit will evaluate it as a match for the SMTP session only if no previous access control rule matches. If you want your new rule to be evaluated before another rule, move your new access control rule to its intended position in the list. For
details, see “Move” on page 263
.
Example: Access control rule with wild cards
If your protected domain, example.com, contains email addresses in the format of [email protected], [email protected], etc., and you want to allow those email addresses to send email to any external domain as long as they authenticate their identities and use TLS, you might configure the following access control rule:
Table 30: Example access control rule
Sender Pattern
Recipient Pattern
Sender IP/Netmask
Reverse DNS Pattern
Authentication Status
TLS Profile
Action user*@example.com
*
0.0.0.0/0
* authenticated tlsprofile1
RELAY
Example: Access control rules with regular expressions
Example Corporation uses a FortiMail unit that is operating in gateway mode, and that has been configured with only one protected domain: example.com. The FortiMail unit has also been configured with the access control rules illustrated in Table 31 .
Table 31: A list of example access control rules
TLS
Profile
Action Enabled ID Sender
Yes
Yes
Yes
1
Pattern
-/*
Recipient
Pattern
-
/user932
@exampl e.com
2 R/^\s*$ -/*
3 -/* -
/*@examp le.com
Sender
IP/Netmask
0.0.0.0/0
0.0.0.0/0
172.20.120.0
/24
Reverse
DNS Pattern
-/*
-/*
-
/mail.exampl
e.org
Authentication
Any
Any
Any
REJECT
REJECT
RELAY
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
267
Controlling SMTP access & delivery
268
Policy
Table 31: A list of example access control rules
Yes
Yes
4 -
/*@exam ple.org
5 -/*
-/*
R/^user\d*
@exampl e\.com$
0.0.0.0/0
0.0.0.0/0
-/*
-/*
Any
Any
REJECT
RELAY
Rule 1
The email account of former employee user932 receives a large amount of spam. Since this employee is no longer with the company and all of his external contacts were informed of their new Example Corporation employee contacts, messages addressed to the former employee’s address must be spam.
Rule 1 uses only the recipient pattern. All the other access control rule attributes are configured to match any value. This rule rejects all messages sent to the [email protected] recipient email address. Rejection at the access control stage prevents these messages from being scanned for spam and viruses, saving FortiMail system resources.
This rule is placed first because it is the most specific access control rule in the list. It applies only to SMTP sessions for that single recipient address. SMTP sessions sending email to any other recipient do not match it. If a rule that matched all messages were placed at the top of the list, no rule after the first would ever be checked for a match, because the first would always match.
SMTP sessions not matching this rule are checked against the next rule.
Rule 2
Much of the spam received by the Example Corporation has no sender specified in the message envelope. Most valid email messages will have a sender email address.
Rule 2 uses only the sender pattern. The regular expression ^\s*$ will match a sender string that contains one or more spaces, or is empty. If any non-space character appears in the sender string, this rule does not match. This rule will reject all messages with a no sender, or a sender containing only spaces.
Not all email messages without a sender are spam, however. Delivery status notification
(DSN) messages often have no specified sender. Bounce notifications are the most common type of DSN messages. The FortiMail administrators at the Example Corporation decided that the advantages of this rule outweigh the disadvantages.
Messages not matching this rule are checked against the next rule.
Rules 3 and 4
Recently, the Example Corporation has been receiving spam that appears to be sent by example.org. The FortiMail log files revealed that the sender address is being spoofed and the messages are sent from servers operated by spammers. Because spam servers often change IP addresses to avoid being blocked, the FortiMail administrators decided to use two rules to block all mail from example.org unless delivered from a server with the proper address and host name.
When legitimate, email messages from example.org are sent from one of multiple mail servers. All of these servers have IP addresses within the 172.20.120.0/24 subnet and have a domain name of mail.example.org that can be verified using a reverse DNS query.
Rule 3 uses the recipient pattern, the sender IP, and the reverse DNS pattern. This rule will relay messages to email users of example.com sent from a client whose domain name is mail.example.org and IP address is between 172.20.120.1 and 172.20.120.255.
Messages not matching this rule are checked against the next rule.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling SMTP access & delivery
Rule 4 works in conjunction with rule 3. It uses only the sender pattern. Rule 4 rejects all messages from example.org. But because it is positioned after rule 3 in the list, rule 4 affects only messages that were not already proven to be legitimate by rule 3, thereby rejecting only email messages with a fake sender.
Rules 3 and 4 must appear in the order shown. If they were reversed, all mail from example.org would be rejected. The more specific rule 3 (accept valid mail from example.org) is placed first, and the more general rule 4 (reject all mail from example.org) follows.
Messages not matching these rules are checked against the next rule.
Rules 5
The administrator of example.com has noticed that during peak traffic, a flood of spam using random user names causes the FortiMail unit to devote a significant amount of resources to recipient verification. Verification is performed with the aid of an LDAP server which also expends significant resources servicing these requests. Example Corporation email addresses start with “user” followed by the user’s employee number, and end with
“@example.com”.
Rule 5 uses only the recipient pattern. The recipient pattern is a regular expression that will match all email addresses that start with “user”, end with “@example.com”, and have one or more numbers in between. Email messages matching this rule are relayed.
Default implicit rules
For messages not matching any of the above rules, the FortiMail unit will perform the default action, which varies by whether or not the recipient email address in the envelope
(RCPT TO:) is a member of a protected domain.
• For protected domains, the default action is RELAY.
• For unprotected domains, the default action is REJECT.
Configuring delivery rules
The Delivery tab displays a list of delivery rules that apply to SMTP sessions being
initiated by the FortiMail unit in order to deliver email.
Delivery rules enable you to require TLS for the SMTP sessions the FortiMail unit initiates when sending email to other email servers. They also enable you to apply secure MIME
(S/MIME).
When initiating an SMTP session, the FortiMail unit compares each delivery rule to the domain name portion of the envelope recipient address (RCPT TO:), and to the IP address of the SMTP server receiving the connection. Rules are evaluated for a match in the order of their list sequence, from top to bottom. If a matching delivery rule does not exist, the email message is delivered. If a match is found, the FortiMail unit compares the
TLS profile settings to the connection attributes and the email message is sent or the connection is not allowed, depending on the result; if an encryption profile is selected, its settings are applied. No subsequent delivery rules are applied. Only one delivery rule is ever applied to any given SMTP session.
If you are using a delivery rule to apply S/MIME encryption, the destination of the connection can be another FortiMail unit, but it could alternatively be any email gateway or server, as long as either:
• the destination’s MTA or mail server
• the recipient’s MUA supports S/MIME and possesses the sender’s certificate and public key, which is necessary to decrypt the email. Otherwise, the recipient will not be able to read the email.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
269
Controlling SMTP access & delivery
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the delivery rule list, go to Policy > Access Control > Delivery.
Figure 140: Viewing the list of delivery rules
Policy
270
Move
Enabled
Click a delivery rule to select it, click Move, then select either:
• the direction in which to move the selected rule (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the rule’s new location by entering the ID of another delivery rule
FortiMail units match the rules in sequence, from the top of the list downwards.
Indicates whether or not the delivery rule is currently in effect.
To disable a delivery rule, mark the checkbox, then click Yes to confirm.
ID
Sender Pattern
Recipient Pattern
IP
TLS Profile
The number identifying the rule.
Note: This may be different from the order in which they appear on the page, which indicates order of evaluation.
FortiMail units evaluate delivery rules in sequence. Only the topmost matching delivery rule will be applied.
The complete or partial envelope sender email address to match.
The complete or partial envelope recipient email address to match.
The IP address and netmask of the system to which the FortiMail is sending the email message. 0.0.0.0/0.0.0.0 matches any IP address.
Indicates he TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile.
• If the attributes match, the access control action is executed.
• If the attributes do not match, the FortiMail unit performs the Failure action configured in the TLS profile.
To edit the TLS profile, click its name. For details, see
“Configuring security profiles” on page 370 .
Encryption Profile Indicates the encryption profile used to apply S/MIME encryption to the email.
To configure a delivery control rule
1 Go to Policy > Access Control > Delivery.
2 Either click New to add a delivery control rule, or double-click to select a delivery control rule that you want to modify.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy
Figure 141: Configuring a message delivery rule
Controlling SMTP access & delivery
Enabled
Sender pattern
Select whether or not the access control rule is currently in effect.
Enter a complete or partial envelope sender (MAIL FROM:) email address to match.
Wild card characters allow you to enter partial patterns that can match multiple sender email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
For example, the sender pattern ??@*.com will match messages sent by any email user with a two letter email user name from any “.com” domain name.
Recipient pattern Enter a complete or partial envelope recipient (RCPT TO:) email address to match.
Wild card characters allow you to enter partial patterns that can match multiple recipient email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
For example, the recipient pattern *@example.??? will match messages sent to any email user at example.com, example.net, example.org, or any other “example” domain ending with a three-letter top-level domain name.
Destination
IP/netmask
TLS profile
The IP address and netmask of the system to which the FortiMail unit is sending the email message. Use the netmask, the portion after the slash
(/) to specify the matching subnet.
For example, enter 10.10.10.10/24 to match a 24-bit subnet, or all addresses starting with 10.10.10. This will appear as 10.10.10.0/24 in the access control rule table, with the 0 indicating that any value is matched in that position of the address.
Similarly, 10.10.10.10/32 will appear as 10.10.10.10/32 and match only the 10.10.10.10 address.
To match any address, enter 0.0.0.0/0.
Note: This field is not used when considering whether or not to apply an encryption profile.
Select a TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile.
• If the attributes match, the access control action is executed.
• If the attributes do not match, the FortiMail unit performs the Failure action configured in the TLS profile.
For more information on TLS profiles, see “Configuring TLS profiles” on page 370 .
Encryption profile Select an encryption profile to apply identity-based encryption, if a corresponding sender identity exists in the certificate bindings.
For more information on encryption profiles, see
“Configuring encryption profiles” on page 372
and “Configuring certificate bindings” on page 373 .
4 Click Create.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
271
Controlling email based upon the recipient Policy
Controlling email based upon the recipient
The Recipient Policies section of the Policies tab enables you to create recipient-based policies based on the incoming or outgoing directionality of an email message with respect to the protected domain.
Recipient-based policies have precedence if an IP-based policy is also applicable but conflicts. Exceptions include IP-based policies where you have enabled
based and IP-based policies are executed and how the order of polices affects the execution, see
“How to use policies” on page 260
.
Tip: If the FortiMail unit protects many domains, and therefore creating recipient-based policies would be very time-consuming, such as it might be for an Internet service provider
Alternatively, consider configuring recipient-based policies only for exceptions that must be treated differently than indicated by the IP-based policy.
Profiles used by the policy, if any, are listed in the policy table, and appear as linked text.
To modify profile settings, click the name of the profile.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of incoming or outgoing recipient-based policies, go to Policy > Policies >
Policies, then, in the Recipient Policies section, select Incoming or Outgoing from
Direction.
Figure 142: Viewing the list of incoming recipient-based policies
272
Move
Domain
Direction
Enabled
Policy ID
Click a policy to select it, click Move, then select either:
• the direction in which to move the selected policy (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the policy’s new location by entering the ID of another policy
FortiMail units match the policies in sequence, from the top of the list downwards.
Select a domain to display its recipient-based policy list.
Either Incoming for an incoming recipient-based policy, or Outgoing for an outgoing recipient-based policy. For definitions of outgoing and incoming
email, see “Incoming vs. outgoing recipient-based policies” on page 259 .
Select whether or not the policy is currently in effect.
The number identifying the policy.
Note: This may be different from the order in which they appear on the page, which indicates order of evaluation.
FortiMail units evaluate policies in sequence. More than one policy may be applied. For details, see
“Order of execution of policies” on page 260
and
“Which policy/profile is applied when an email has multiple recipients?” on page 261
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon the recipient
Direction
Domain Name
Indicates the incoming or outgoing directionality of the policy. For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259
.
Indicates the domain part of the recipient’s email address in the envelope
(RCPT TO:) that an email must match in order to be subject to the policy.
• For incoming recipient-based policies, this is the name of a protected domain.
• For outgoing recipient-based policies, this is System, indicating that the recipient does not belong to a protected domain.
Sender Pattern A sender email address (MAIL FROM:) as it appears in the envelope or a wild card pattern indicating which sender email addresses will match the policy.
Recipient Pattern A recipient email address (RCPT TO:) as it appears in the envelope or a wild card pattern indicating which recipient email addresses will match the policy.
AntiSpam The antispam profile selected for the matching recipients.
To modify the profile, click the name. The profile appears in a pop-up window.
For details, see “Configuring antispam profiles” on page 297 .
AntiVirus
Content
Resource
(server mode only)
Authentication
(gateway mode and transparent mode only)
The antivirus profile selected for the matching recipients.
To modify the profile, click the name. The profile appears in a pop-up window.
For details, see “Configuring antivirus profiles” on page 315 .
The content profile selected for the matching recipients.
To modify the profile, click the name. The profile appears in a pop-up window.
For details, see “Configuring content profiles” on page 318 .
The resource profile selected for the matching recipients.
To modify the profile, click the name. The profile appears in a pop-up window.
For details, see “Configuring resource profiles” on page 329 .
The authentication profile selected for the matching recipients.
To modify the profile, click the name. The profile appears in a pop-up window.
For details, see “Configuring authentication profiles” on page 330
or
“Configuring LDAP profiles” on page 333 .
To configure a recipient-based policy
Before beginning, you first must have configured:
• at least one protected domain (see
“Configuring protected domains” on page 211
)
• at least one user group or LDAP profile with a configured group query, if you will use either to define which recipient email addresses will match the policy (see
“Configuring user groups” on page 251
or “Configuring LDAP profiles” on page 333
)
• at least one PKI user, if you will allow or require email users to access their perrecipient quarantine using PKI authentication (see
“Configuring PKI authentication” on page 248 )
1 Go to Policy > Policies > Policies.
2 Either click New to add a policy, or double-click to select a policy that you want to modify.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
273
Controlling email based upon the recipient
Figure 143: Configuring a recipient-based policy (gateway mode or transparent mode; incoming directionality)
Policy
274
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon the recipient
Figure 144: Configuring a recipient-based policy (server mode; incoming directionality)
Enable
Direction
Select whether or not the policy is currently in effect.
Select either Incoming for a recipient-based policy that affects incoming email, or Outgoing for a recipient-based policy that affects outgoing email.
For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259
.
Subsequent steps and options vary by this selection.
Profiles Select the profiles that you want to apply to the policy.
Note: If you have created a system profile and a domain profile with the same profile name, the profile that appears in the profile drop-down lists is the domain profile, not the system profile. Thus, only the domain profile will be selected.
AntiSpam
AntiVirus
Select which antispam profile, if any, to apply to email matching the policy.
If you have not yet configured the profile that you want to apply, click New to add the profile in a pop-up dialog. If you need to modify an existing profile before applying it, click Edit. For details, see
“Configuring antispam profiles” on page 297 .
Tip: You can use an LDAP query to enable or disable antispam
scanning on a per-user basis. For details, see “AS/AV On/Off
and “Check AS/AV configuration” on page 220 .
Select which antivirus profile, if any, to apply to email matching the policy.
If you have not yet configured the profile that you want to apply, click New to add the profile in a pop-up dialog. If you need to modify an existing profile before applying it, click Edit. For details, see
“Configuring antivirus profiles” on page 315
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
275
Controlling email based upon the recipient Policy
Content
Resource
Select which content profile, if any, to apply to email matching the policy.
If you have not yet configured the profile that you want to apply, click New to add the profile in a pop-up dialog. If you need to modify an existing profile before applying it, click Edit. For details, see
“Configuring content profiles” on page 318
.
Select which resource profile, if any, to apply to email matching the policy.
If you have not yet configured the profile that you want to apply, click New to add the profile in a pop-up dialog. If you need to modify an existing profile before applying it, click Edit. For details, see
“Configuring resource profiles” on page 329 .
This option appears only if the FortiMail unit is operating in
server mode, and only if Direction is Incoming. For gateway
mode or transparent mode, select an authentication profile instead. For details, see “Authentication profile” on page 276 .
4 If you are configuring a policy for incoming email, configure the following:
Recipient Pattern
Sender Pattern
Select one of the following ways to define recipient
(RCPT TO:) email addresses that match this policy:
• Recipient: Enter a recipient email address or a pattern with wild cards, such as *@protected.example.com.
• Local group: Select the name of a protected domain in the second drop-down list, then select the name of a user group in the first drop-down list.
• LDAP group: Select an LDAP profile in which you have enabled and configured a group query, then enter either the group’s full or partial membership attribute value as it appears in the LDAP directory.
Depending on your LDAP directory’s schema, and whether
or not you have enabled “Use group name with base DN as group DN” on page 338
, this may be a value such as 1001, admins, or cn=admins,ou=Groups,dc=example,dc=com.
Wild card characters allow you to enter patterns that can match multiple email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
Enter a sender (MAIL FROM:) email address or a pattern with wild cards, such as *@external.example.org, indicating which senders will match this policy.
Wild card characters allow you to enter patterns that can match multiple email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
Authentication and Access This section appears only if the FortiMail unit is operating in gateway mode or transparent mode. For server mode, select a resource profile instead. For details, see “Resource” on page 276 .
Authentication profile
If you want the email user to be able to authenticate using an external authentication server, from the first
Authentication profile drop-down list, select the type of the profile (SMTP, POP3, IMAP, RADIUS, or LDAP), then in the second drop-down list, select the name of the profile.
Note: In addition to specifying an authentication server for
SMTP email messages that this policy governs, configuring
Authentication profile also allows email users to authenticate when accessing their per-recipient quarantine using HTTP or
HTTPS. For more information, see
“How to enable, configure, and use per-recipient quarantines” on page 67
.
276
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon the recipient
Use for SMTP authentication
Allow different
SMTP sender identity
Allow quarantined email access through POP3
Allow quarantined email access through webmail
Advanced Settings
Enable PKI authentication for web mail spam access
Certificate validation is mandatory
Enable to allow the SMTP client to use the SMTP AUTH command, and to use the server defined in Authentication
profile to authenticate the connection.
Disable to make SMTP authentication unavailable.
This option is available only if you have selected an
Authentication profile.
Note: Enabling this option allows, but does not require, SMTP authentication. To enforce SMTP authentication for connecting
SMTP clients, ensure that all access control rules require
authentication. For details, see “Configuring access control rules” on page 262
.
Enable to allow the SMTP client to send email using a different sender email address (MAIL FROM:) than the user name that they used to authenticate.
Disable to require that the sender email address in the SMTP envelope match the authenticated user name.
This option is available only if Use for SMTP authentication is enabled.
Enable to allow email users matching this policy to use POP3 and IMAPv4 to retrieve the contents of their personal
.
This option is available only if you have selected an
Authentication profile.
Enable to allow email users matching this policy to use
FortiMail webmail (HTTP or HTTPS) to retrieve the contents of their personal quarantine. For more information, see
“How to enable, configure, and use per-recipient quarantines” on page 67 .
This option is available only if you have selected an
Authentication profile.
This section appears only if the FortiMail unit is operating in gateway mode or transparent mode. For server mode, select a resource profile instead. For details, see “Resource” on page 276 .
Enable if you want to allow email users to log in to their personal quarantine or FortiMail webmail by presenting a certificate rather than a user name and password. Also configure “Certificate validation is mandatory” .
For more information on configuring PKI users and what
defines a valid certificate, see “Configuring PKI authentication” on page 248 .
If the email user’s web browser does not provide a valid personal certificate, the FortiMail unit will fall back to standard user name and password-style authentication. To require valid certificates only and disallow password-style fallback, enable this option.
5 If you are configuring a policy for outgoing email, configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
277
Controlling email based upon IP addresses Policy
Sender Pattern
Recipient Pattern
Select one of the following ways to define sender
(MAIL FROM:) email addresses that match this policy:
• Sender: Enter a sender email address or a pattern with wild cards, such as *@protected.example.com.
• Local group: Select the name of a protected domain in the second drop-down list, then select the name of a user group in the first drop-down list.
• LDAP group: Select an LDAP profile in which you have enabled and configured a group query, then enter either the group’s full or partial membership attribute value as it appears in the LDAP directory.
Depending on your LDAP directory’s schema, and whether
or not you have enabled Use group name with base DN as
group DN, this may be a value such as 1001, admins, or
cn=admins,ou=Groups,dc=example,dc=com.
Wild card characters allow you to enter patterns that can match multiple email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
Enter a recipient (RCPT TO:) email address or a pattern with wild cards, such as *@external.example.org, indicating which recipients will match this policy.
Wild card characters allow you to enter patterns that can match multiple email addresses. The asterisk (*) represents one or more characters and the question mark (?) represents any single character.
6 Click Create.
Controlling email based upon IP addresses
The IP Policies section of the Policies tab enables you to create policies that apply profiles to SMTP connections based upon the IP addresses of SMTP clients and/or servers.
Due to the nature of relay in SMTP, an SMTP client is not necessarily always located on an email user’s computer. The SMTP client is the connection initiator; it could be, for example, another email server or a mail relay attempting to deliver email. The SMTP server, however, is always a mail relay or email server that receives the connection.
For example, if computer A opened a connection to computer B to deliver mail, A is the client and B is the server. If computer B later opened a connection to computer A to deliver a reply email, B is now the client and A is now the server.
Like access control rules, IP-based policies can reject connections based upon IP address.
Unlike access control rules, however, IP-based policies can affect email in many ways that occur after the session’s DATA command, such as by applying antispam profiles. IPbased policies can also be overruled by recipient-based policies, and, if the FortiMail unit is operating in server mode, may match connections based upon the IP address of the
SMTP server, not just the SMTP client. For more information on access control rules, see
“Configuring access control rules” on page 262 .
Note: IP-based policies can apply in addition to recipient-based policies, although
recipient-based policies have precedence if the two conflict unless you enable Take
precedence over recipient based policy match.
For information about how recipient-based and IP-based policies are executed and how the order of polices in the list affects the order of execution, see
“How to use policies” on page 260
.
278
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon IP addresses
Caution: If SMTP traffic does not match any IP-based or recipient-based policy, it is allowed. However, no antivirus or antispam protection may be applied.
If you are certain that you have configured policies to match and allow all required traffic, you can tighten security by adding an IP policy at the bottom of the policy list to reject all other, unwanted connections.
To do this, create a new IP policy, enter 0.0.0.0/0 as the client IP/netmask, and set the action to Reject. See the following procedures about how to configure an IP policy. Then, move the policy to the very bottom of the IP policy list. Because this policy matches any connection, all connections that do not match any other policy will match this final policy, and be rejected.
Profiles used by the policy, if any, are listed in the policy table, and appear as linked text.
To modify profile settings, click the name of the profile.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
Note: Domain administrators can create and modify IP-based policies. Because they can affect any IP address, a domain administrator could therefore create a policy that affects another domain. If you do not want to allow this, do not grant Read-Write permission to the
Policy category in domain administrators’ access profiles.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of IP-based policies, go to Policy > Policies > Policies, then look in the
IP Policies section.
Figure 145: Viewing the list of IP-based policies (gateway mode)
Figure 146: Viewing the list of IP-based policies (transparent mode)
Figure 147: Viewing the list of IP-based policies (server mode)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
279
Controlling email based upon IP addresses Policy
Move
Enabled
Policy ID
Match
Session
AntiSpam
AntiVirus
Content
IP Pool
Authentication
Exclusive
Click a policy to select it, click Move, then select either:
• the direction in which to move the selected policy (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the policy’s new location by entering the ID of another policy
FortiMail units match the policies in sequence, from the top of the list downwards.
Select whether or not the policy is currently in effect.
The number identifying the policy.
Note: This may be different from the order in which they appear on the page, which indicates order of evaluation.
FortiMail units evaluate policies in sequence. More than one policy may be applied. For details, see
“Order of execution of policies” on page 260 and
“Which policy/profile is applied when an email has multiple recipients?” on page 261
.
The IP address of the SMTP client to which the policy applies, or, for transparent mode, the IP addresses of both the SMTP client and the SMTP server.
The name of the session profile applied by this policy.
To modify the profile, click the name. The profile appears in a pop-up window. For details, see
“Configuring session profiles” on page 285 .
The name of the antispam profile applied by this policy.
To modify the profile, click the name. The profile appears in a pop-up window. For details, see
“Configuring antispam profiles” on page 297
.
The name of the antivirus profile applied by this policy.
To modify the profile, click the name. The profile appears in a pop-up window. For details, see
“Configuring antivirus profiles” on page 315
.
The name of the content profile applied by this policy.
To modify the profile, click the name. The profile appears in a pop-up window. For details, see
“Configuring content profiles” on page 318
.
The name of the IP pool profile applied by this policy.
The IP pool profile will be ignored if the Take precedence over recipient
based policy match option is disabled.
To modify the profile, click the name. The profile appears in a pop-up window. For details, see
“Configuring IP pools” on page 376 .
The name of the authentication profile applied by this policy.
To modify the profile, click the name. The profile appears in a pop-up window.
This option does not appear if the FortiMail unit is operating in server mode.
For details, see
“Configuring authentication profiles” on page 330
or
“Configuring LDAP profiles” on page 333 .
Indicates whether or not Take precedence over recipient based policy
match is enabled in this policy.
• Green check mark icon: The option is enabled. Recipient-based policies will not be applied if a connection matches this IP-based policy.
• Red X mark icon: The option is disabled. Both the IP-based policy and any applicable recipient-based policies will be applied.
To configure an IP-based policy
1 Go to Policy > Policies > Policies.
2 In the IP Policies section, click New to add a policy, or double-click to select a policy that you want to modify.
3 Configure the following:
280
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon IP addresses
Figure 148: Creating an IP-based policy (gateway mode)
Figure 149: Creating an IP-based policy (transparent mode)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
281
Controlling email based upon IP addresses
Figure 150: Creating an IP-based policy (server mode)
Policy
282
Enable
Client IP/netmask
Server IP/netmask
Action
Session
AntiSpam
AntiVirus
Content
IP pool
Select whether or not the policy is currently in effect.
Enter the IP address and subnet mask of the SMTP client to whose connections this policy will apply.
To match all clients, enter 0.0.0.0/0.
Enter the IP address and subnet mask of the SMTP server to whose connections this policy will apply.
To match all servers, enter 0.0.0.0/0.
This option applies only for FortiMail units operating in transparent mode. For other modes, the FortiMail unit receives the SMTP connection, and therefore acts as the server.
Select whether to:
• Scan: Accept the connection and perform any scans configured in the profiles selected in this policy.
• Reject: Reject the email and respond to the SMTP client with SMTP reply code 550, indicating a permanent failure.
• Fail Temporarily: Reject the email and indicate a temporary failure.
Select the name of a session profile, if any, that this policy will apply.
This option is applicable only if Action is Scan.
Select the name of an outgoing antispam profile, if any, that this policy will apply.
This option is applicable only if Action is Scan.
Select the name of an antivirus profile, if any, that this policy will apply.
This option is applicable only if Action is Scan.
Select the name of an outgoing content profile, if any, that this policy will apply.
This option is applicable only if Action is Scan.
Select the name of an IP pool profile, if any, that this policy will apply.
This option is applicable only if Action is Scan.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Policy Controlling email based upon IP addresses
Authentication
Use for SMTP authentication
Select the name of an authentication or LDAP profile, if any, that this policy will apply.
This option is applicable only if Action is Scan, and the FortiMail unit is
not operating in server mode. (If the FortiMail unit is operating in server mode, configure resource profiles to govern authentication instead. For details, see
“Configuring resource profiles” on page 329
.)
Note: In addition to specifying an authentication server for SMTP connections that this policy governs, configuring this option also allows email users to authenticate when accessing their per-recipient quarantine using HTTP or HTTPS. For more information, see
“How to enable, configure, and use per-recipient quarantines” on page 67 .
Enable to allow the SMTP client to use the SMTP AUTH command, and
to use the server defined in Use for SMTP authentication to authenticate
the connection.
Disable to make SMTP authentication unavailable.
This option is applicable only if you have selected the name of an
authentication or LDAP profile in Authentication.
Note: Enabling this option allows, but does not require, SMTP authentication. To enforce SMTP authentication for connecting SMTP clients, ensure that all access control rules require authentication. For details, see
“Configuring access control rules” on page 262 .
Allow different SMTP sender identity
Enable to allow the SMTP client to send email using a different sender email address (MAIL FROM:) than the user name that they used to authenticate.
Disable to require that the sender email address in the SMTP envelope match the authenticated user name.
This option is applicable only if Use for SMTP authentication is enabled.
Take precedence over recipient based policy match
Enable to omit use of recipient-based policies for connections matching this IP-based policy. For information on how policies are executed, see
“How to use policies” on page 260
.
This option is applicable only if Action is Scan.
Note: Enabling this option also causes the FortiMail unit to ignore the
option Hide the transparent box in the protected domain.
4 Click OK.
Example: Strict & loose IP-based policies
You have a FortiMail unit running in gateway mode to protect your internal mail server
(192.168.1.1). The FortiMail unit receives email incoming to, and relays email from, the internal mail server.
You can create two IP-based policies:
• Policy 1: Enter 192.168.1.1/32 as the SMTP client’s IP address to match outgoing email connections from the mail server, and select a "loose" session profile, which may have sender reputation and other similar restrictions disabled, since the sender (that is,
SMTP client) will always be your mail server.
• Policy 2: Enter 0.0.0.0/0 as the SMTP client’s IP address to match incoming email connections from all other mail servers, and select a “strict” session profile, which has all the antispam options enabled.
You would then move policy 1 above policy 2, as policies are evaluated for a match with the connection in order of their display on the page.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
283
Controlling email based upon IP addresses Policy
284
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
Profile
The Profile menu enables you to configure profiles, which are a collection of settings for antispam, antivirus, authentication, or other features.
After creating and configuring a profile, you can apply it either directly in a policy, or indirectly, by inclusion in another profile that is selected in a policy. Policies apply each selected profile to all email messages and SMTP connections that the policy governs. For information about policies, see
Creating multiple profiles for each type of policies enables you to customize your email service by applying different profiles to policies that govern different SMTP connections or email users. For instance, if you are an Internet Service Provider (ISP), you might want to create and apply antivirus profiles only to policies governing email users who pay you to provide antivirus protection.
This topic includes:
•
•
Configuring antispam profiles and antispam action profiles
•
Configuring antivirus profiles
•
Configuring content profiles and content action profiles
•
•
Configuring authentication profiles
•
•
Configuring dictionary profiles
•
•
Configuring session profiles
The Session tab enables you to create session profiles.
While, like antispam profiles, session profiles protect against spam, session profiles focus on the connection and envelope portion of the SMTP session, rather than the message header, body, or attachments.
Similar to access control rules or delivery rules, session profiles control aspects of sessions in an SMTP connection.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of session profiles, go to Profile > Session > Session.
Figure 151: Viewing the list of session profiles
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
285
Configuring session profiles Profile
To configure a session profile
1 Go to Profile > Session > Session.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 In Profile name, type the name of the profile.
In Connection Settings, configure the following connection settings options to restrict the number and duration of connections to the FortiMail unit. When any of these limits are exceeded, the FortiMail unit blocks further connections. Setting any of these values to 0 disables the limit.
Figure 152: Connection Settings (gateway mode and server mode)
Figure 153: Connection Settings (transparent mode)
286
Hide this box from the mail server
(transparent mode only)
Restrict the number of connections per client to n per n minutes
Enable to preserve the IP address or domain name of the SMTP client in:
• the SMTP greeting (HELO/EHLO) and in the
Received: message headers of email messages
• the IP addresses in the IP header
This masks the existence of the FortiMail unit.
Disable to replace the IP addresses or domain names with that of the FortiMail unit.
Note: Unless you have enabled
“Take precedence over recipient based policy match”
in the IP-based policy, the
“Hide the transparent box” option in the protected
domain supersedes this option, and may prevent it from applying to incoming email messages.
Note: For full transparency, also enable “Hide the transparent box” on page 218 .
Enter a rate limit to the number of connections per client IP address, then enter the number of minutes that defines the time interval of the limit.
Restrict the number of messages per client to n per n minute(s)
Enter a rate limit to the number of message sent per client IP address, then enter the number of minutes that defines the time interval of the limit.
Each client can only connect n times concurrently
Enter a limit to the number of concurrent connections per client.
Limit the total number of connections to n
Enter a limit to the total number of concurrent connections from all sources.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
Drop connections after n seconds of client inactivity
Enter a limit to the number of seconds a client may be idle before the FortiMail unit drops the connection.
Do not let client connect to blacklisted SMTP servers
(transparent mode only)
Enable to prevent clients from connecting to SMTP servers that have been blacklisted in antispam profiles or, if enabled, the FortiGuard AntiSpam service.
4 Click the arrow to expand Sender Reputation.
Configure the sender reputation settings to restrict the number of email messages sent from SMTP clients based upon whether they have a reputation of sending an excessive number of email messages, email with invalid recipients, or email infected with viruses.
For more information on sender reputations, see “Viewing the sender reputation statuses” on page 76
.
Note: Sender reputation scores can be affected by sender validation results.
Note: Enabling sender reputation can improve performance by rejecting known spammers before more resource-intensive antispam scans are performed.
Figure 154: Sender Reputation
Enable sender reputation checking
Throttle client at n
Restrict number of emails per hour to n
Restrict email to n percent of the previous hour
Temporarily fail client at n
Enable to accept or reject email based upon sender reputation scores.
Enter a sender reputation score over which the
FortiMail unit will rate limit the number of email messages that can be sent by this SMTP client.
The enforced rate limit is either Restrict number of
emails per hour to n or Restrict email to n percent of
the previous hour, whichever value is greater.
This option applies only if Enable sender reputation
checking is enabled.
Enter the maximum number of email messages per hour that the FortiMail unit will accept from a throttled
SMTP client.
Enter the maximum number of email messages per hour that the FortiMail unit will accept from a throttled
SMTP client, as a percentage of the number of email messages that the SMTP client sent during the previous hour.
Enter a sender reputation score over which the
FortiMail unit will return a temporary failure error when the SMTP client attempts to initiate a connection.
This option applies only if Enable sender reputation
checking is enabled.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
287
Configuring session profiles Profile
Reject client at n Enter a sender reputation score over which the
FortiMail unit will reject the email and reply to the
SMTP client with SMTP reply code 550 when the
SMTP client attempts to initiate a connection.
This option applies only if Enable sender reputation
checking is enabled.
5 Click the arrow to expand Endpoint Reputation.
Configure the Endpoint Reputation settings to restrict the ability of an MSISDN or subscriber ID to send email or MM3 multimedia messaging service (MMS) messages from a mobile device based upon its endpoint reputation score. The MSISDN reputation score is similar to a sender reputation score.
For more information on configuring endpoint reputation-based behavior, see
“Configuring endpoint reputation” on page 412 .
Note: Enabling endpoint reputation can improve performance by rejecting known spammers before more resource-intensive antispam scans are performed.
Figure 155: Endpoint Reputation
288
Enable Endpoint Reputation
Action
Auto blacklist score trigger value
Auto blacklist duration
Enable to accept, monitor, or reject email based upon endpoint reputation scores.
This option requires that your RADIUS server provide mappings between dynamic IP addresses and
MSISDNs/subscriber IDs to the FortiMail unit. If this profile governs sessions of SMTP clients with static IP addresses, instead consider “Enable sender reputation checking” on page 287 .
Select either:
• Reject: Reject email and MMS messages from
MSISDNs/subscriber IDs whose MSISDN reputation scores exceed Auto blacklist score
trigger value.
• Monitor: Log, but do not reject, email and MMS messages from MSISDNs/subscriber IDs whose
MSISDN reputation scores exceed Auto blacklist
score trigger value. Log entries appear in the history log.
Enter the MSISDN reputation score over which the
FortiMail unit will add the MSISDN/subscriber ID to the automatic blacklist.
The trigger score is relative to the period of time configured as the automatic blacklist window. For more information on the automatic blacklist window, see
“Configuring the endpoint reputation score window” on page 418
.
Enter the number of minutes that an
MSISDN/subscriber ID will be prevented from sending email or MMS messages after they have been automatically blacklisted.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
6 Click the arrow to expand Sender Validation.
Configure the Sender Validation settings to confirm sender and message authenticity.
Failure to validate does not guarantee that an email is spam, just as successful validation does not guarantee that an email is not spam, but it may help to indicate spam. Validation results are used to adjust the sender reputation scores and deep header scans.
Note: Enabling sender validation can improve performance by rejecting invalid senders before more resource-intensive antispam scans are performed.
Figure 156: Sender Validation
Enable DKIM check
Enable DKIM signing for outgoing messages
Enable DKIM signing for authenticated senders only
Enable Domain Key check
Enable to, if a DKIM signature is present, query the
DNS server that hosts the DNS record for the sender’s domain name to retrieve its public key to decrypt and verify the DKIM signature.
An invalid signature increases the client sender reputation score and affect the deep header scan. A valid signature decreases the client sender reputation score.
If the sender domain DNS record does not include
DKIM information or the message is not signed, the
FortiMail unit omits the DKIM signature validation.
Enable to sign outgoing email with a DKIM signature.
This option requires that you first generate a domain key pair and publish the public key in the DNS record for the domain name of the protected domain. If you do not publish the public key, destination SMTP servers will not be able to validate your DKIM signature. For details on generating domain key pairs and publishing the public key, see
.
Enable to sign outgoing email with a DKIM signature only if the sender is authenticated.
This option is available only if “Enable DKIM signing for outgoing messages” is enabled.
Enable to, if the DNS record for the domain name of the sender lists DomainKeys authorized IP addresses, compare the client IP address to the IP addresses of authorized senders.
An unauthorized client IP address increases the client sender reputation score. An authorized client IP address decreases the client sender reputation score.
If the DNS record for the domain name of the sender does not publish DomainKeys information, the FortiMail unit omits the DomainKeys client IP address validation.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
289
Configuring session profiles Profile
Enable SPF check Enable to, if the sender domain DNS record lists SPF authorized IP addresses, compare the client IP address to the IP addresses of authorized senders in the DNS record.
An unauthorized client IP address increases the client sender reputation score. An authorized client IP address decreases the client sender reputation score.
If the DNS record for the domain name of the sender does not publish SPF information, the FortiMail unit omits the SPF client IP address validation.
Bypass Bounce Verification check Enable to, if bounce verification is enabled, omit verification of bounce address tags on incoming bounce messages.
This bypass does not omit bounce address tagging of outgoing messages.
For more information, see “Configuring bounce verification & tagging” on page 409
.
7 Click the arrow to expand Session Settings, and configure the following:
Figure 157: Session Settings (gateway mode and server mode)
Figure 158: Session Settings (transparent mode)
290
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
Reject EHLO/HELO commands with invalid characters in the domain
Rewrite EHLO/HELO domain to
[n.n.n.n] IP string of the client address
(transparent mode only)
Enable to return SMTP reply code 501, rejecting the
SMTP greeting, if the client or server uses a greeting that contains a domain name with invalid characters.
To avoid disclosure of a real domain name, spammers sometimes spoof an SMTP greeting domain name with random characters, rather than using a genuine, valid domain name. If this option is enabled, such connections are rejected.
In the following example, the invalid command is highlighted in bold:
220 FortiMail-400.localdomain ESMTP
Smtpd; Wed, 14 Feb 2008 13:30:20 GMT
EHLO ^^&^&^#$
501 5.0.0 Invalid domain name
Valid characters for domain names include:
• alphanumerics (A to Z and 0 to 9)
• brackets ( [ and ] )
• periods ( . )
• dashes ( - )
• underscores ( _ )
• number symbols( # )
• colons ( : )
Enable to rewrite the domain name in the SMTP greeting (HELO/EHLO) to the IP address of the client to prevent domain name spoofing.
Rewrite EHLO/HELO domain to
(transparent mode only)
Enable to rewrite the domain name in the SMTP greeting (HELO/EHLO) to the specified value.
Prevent encryption of the session
(transparent mode only)
Allow pipelining for the session
(transparent mode only)
Enforce strict RFC compliance
(transparent mode only)
Enable to block STARTTLS/MD5 commands so that email connections cannot be TLS-encrypted.
Caution: Disable this option only if you trust that SMTP clients connecting using TLS through the FortiMail unit will not be sources of viruses or spam. FortiMail units operating in transparent mode cannot scan encrypted connections traveling through them. Disabling this option could thereby permit viruses and spam to travel through the FortiMail unit.
Enable to allow SMTP command pipelining, allowing multiple SMTP commands to be accepted and processed simultaneously, improving performance for high-latency connections.
Disable to allow the SMTP client to send only a single command at a time during an SMTP session.
Enable to limit pipelining support to strict compliance with RFC 2920 , SMTP Service Extension for Command
Pipelining.
This option is available only if “Allow pipelining for the session” is enabled.
Reject SMIME encrypted messages Enable to reject the email if it is encrypted using secure
MIME (S/MIME). Encrypted email content cannot be scanned for spam, viruses, or banned content unless a certificate binding can be found to decrypt the content
(see “Configuring certificate bindings” on page 373 ).
Alternatively, you can reject encrypted email through the content profile. For details, see
“Configuring content profiles” on page 318 or “Configuring content profiles” on page 318 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
291
Configuring session profiles
292
Profile
Perform strict syntax checking
Switch to SPLICE mode after n seconds/kilobytes
(transparent mode only)
Enable to return SMTP reply code 503, rejecting a
SMTP command, if the client or server uses SMTP commands that are syntactically incorrect.
EHLO or HELO, MAIL FROM:, RCPT TO: (can be multiple), and DATA commands must be in that order.
AUTH, STARTTLS, RSET, or NOOP commands can arrive at any time. Other commands, or commands in an unacceptable order, return a syntax error.
In the following example, the invalid commands are highlighted in bold:
220 FortiMail-400.localdomain ESMTP
Smtpd; Wed, 14 Feb 2008 13:41:15 GMT
EHLO example.com
250-FortiMail-400.localdomain Hello
[192.168.1.1], pleased to meet you
RCPT TO:<[email protected]>
503 5.0.0 Need MAIL before RCPT
Enable to use splice mode, then type a threshold value based on time (seconds) or data size (kilobytes).
Splice mode enables the FortiMail unit to simultaneously scan an email and relay it to the SMTP server. This increases throughput and reduces the risk of a server timeout.
If the FortiMail unit detects spam or a virus, it terminates the server connection and returns an error message to the sender, listing the spam or virus name and infected file name.
ACK EOM before AntiSpam check Enable to acknowledge the end of message (EOM) signal immediately after receiving the carriage return and line feed (CRLF) characters that indicate the EOM, rather than waiting for antispam scanning to complete.
If the FortiMail unit has not yet completed antispam scanning by the time that four (4) minutes has elapsed, it will return SMTP reply code 451(Try again later), resulting in no permanent problems, as according to RFC 2821 , the minimum timeout value should be 10 minutes. However, in rare cases where the server or client’s timeout is shorter than 4 minutes, the sending client or server could time-out while waiting for the FortiMail unit to acknowledge the EOM command. Enabling this option prevents those rare cases.
Send DSN to sender when spam is detected
Enable to send a delivery status notification (DSN) to the sender when spam is detected. DSN is described in
RFC 1891 , RFC 3461 , and RFC 3463 .
By default, this feature is disabled, because enabling this feature could enable spammers to use the FortiMail unit to spam via DSN. In this attack, spammers spoof a legitimate sender email address, expecting that the
FortiMail unit will reject the email and then send a DSN, containing the spam, to the spoofed sender address, which is the true target of the attack. However, there may be reasons why you want to enable this option.
For example:
• If you have disabled recipient validation but enabled tagging of spam, after the FortiMail unit sends tagged spam to the protected email server, the protected email server will return the SMTP reply code 550 (user unknown), thereby wasting system resources of both the FortiMail unit and the protected email server.
• According to RFC 2821 , the FortiMail unit should send a DSN to notify the sender of the delivery failure.
8 Click the arrow to expand For Unauthenticated Sessions, and configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
Figure 159: For Unauthenticated Sessions (gateway mode and server mode)
Figure 160: For Unauthenticated Sessions (transparent mode)
Check HELO/EHLO domain
Check sender domain
Check recipient domain
Enable to return SMTP reply code 501, rejecting the
SMTP command, if the domain name accompanying the SMTP greeting is not a domain name that exists in either MX or A records.
Enable to return SMTP reply code 421, rejecting the
SMTP command, if the domain name portion of the sender address is not a domain name that exists in either MX or A records.
In the following example, the invalid command is highlighted in bold:
220 FortiMail-400.localdomain ESMTP
Smtpd; Wed, 14 Feb 2008 14:32:51 GMT
EHLO
250-FortiMail-400.localdomain Hello
[192.168.1.1], pleased to meet you
MAIL FROM:<[email protected]>
421 4.3.0 Could not resolve sender domain.
Enable to return SMTP reply code 550, rejecting the
SMTP command, if the domain name portion of the recipient address is not a domain name that exists in either MX or A records.
In the following example, the invalid command is highlighted in bold:
220 FortiMail-400.localdomain ESMTP
Smtpd; Wed, 14 Feb 2008 14:48:32 GMT
EHLO example.com
250-FortiMail-400.localdomain Hello
[192.168.1.1], pleased to meet you
MAIL FROM:<[email protected]>
250 2.1.0 <[email protected]>... Sender ok
RCPT TO:<[email protected]>
550 5.7.1 <[email protected]>... Relaying denied. IP name lookup failed
[192.168.1.1]
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
293
Configuring session profiles Profile
Reject empty domains
Prevent open relaying
(transparent mode only)
Enable to return SMTP reply code 553, rejecting the
SMTP command, if a domain name does not follow the
“@” symbol in the sender email address.
Because the sender address is invalid and therefore cannot receive delivery status notifications (DSN), you may want to disable this feature.
In the following example, the invalid command is highlighted in bold:
220 FortiMail-400.localdomain ESMTP
Smtpd; Wed, 14 Feb 2007 14:48:32 GMT
EHLO example.com
250-FortiMail-400.localdomain Hello
[192.168.171.217], pleased to meet you
MAIL FROM:<user1@>
553 5.1.3 <user1@>... Hostname required
Enable to prevent clients from using open relays to send email by blocking sessions that are unauthenticated. (Unauthenticated sessions are assumed to be occurring to an open relay.)
If you permit SMTP clients to use open relays to send email, email from your domain could be blacklisted by other SMTP servers.
This option has an effect only if you have enabled
“Use client-specified SMTP server to send email” on page 238
for outgoing mail. Otherwise, the FortiMail unit forces clients to use the gateway you have defined
in “Relay Server” on page 203 ,if any, or the MTA of the
domain name in the recipient email address
(RCPT TO:), as determined using an MX lookup, so it is not possible for them to use an open relay.
Reject if recipient and helo domain match but sender domain is different
Enable to reject the email if the domain name in the
SMTP greeting (HELO/EHLO) and recipient email address (RCPT TO:) match, but the domain name in the sender email address (MAIL FROM:) does not.
Mismatching domain names is sometimes used by spammers to mask the true identity of their SMTP client.
9 Click the arrow to expand SMTP Limits, and configure the following:
Figure 161: SMTP Limits
294
Restrict number of EHLO/HELOs per session to n
Enter the limit of SMTP greetings that a connecting
SMTP server or client can perform before the FortiMail unit terminates the connection. Restricting the number of SMTP greetings allowed per session makes it more difficult for spammers to probe the email server for vulnerabilities, as a greater number of attempts results in a greater number of terminated connections, which must then be re-initiated.
Restrict number of emails per session to n
Enter the limit of email messages per session to prevent mass mailing.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring session profiles
Restrict number of recipients per email to n
Cap message size at n kilobytes
Enter the limit of recipients to prevent mass mailing.
Cap header size at n kilobytes
Drop connection after n NOOPs
Drop connection after n RSETs
Enter the limit of the message size. If enabled, messages over the threshold size are rejected.
Note: If both this option and Maximum message
size(KB) in the protected domain are enabled, email
size will be limited to whichever size is smaller.
Enter the limit of the message header size. If enabled, messages with headers over the threshold size are rejected.
Enter the limit of NOOP commands that are permitted per SMTP session. Some spammers use NOOP commands to keep a long session alive. Legitimate sessions usually require few NOOPs.
Enter the limit of RSET commands that are permitted per SMTP session. Some spammers use RSET commands to try again after receiving error messages such as unknown recipient. Legitimate sessions should require few RSETs.
10 Click the arrow to expand Error Handling.
Configure Error Handling to specify how the FortiMail unit should handle connections from SMTP clients that are error-prone. Errors sometime indicate attempts to misuse the server. You can impose delays or drop connections if there are errors. Setting any of these values to 0 disables the limit.
Note: Configuring error handling can improve performance by dropping connections with error-prone SMTP clients.
Figure 162: Error Handling
Client is allowed n “free” errors.
The first non-free error will incur a delay of n seconds
Subsequent error delays will increment by n seconds
The connection will drop after n errors
Enter the number of number of errors permitted before the FortiMail unit will impose a delay. By default, five errors are permitted before the FortiMail unit imposes the first delay.
Enter the delay time for the first error after the number of “free” errors is reached.
Enter the number of seconds by which to increase the delay for each error after the first delay is imposed.
Enter the total number of errors the FortiMail unit will accept before dropping the connection.
11 Click the arrow to expand Header Manipulation.
Email processing software and hardware can add extra lines to the message header of each email message. When multiple lines are added, this can significantly increase the size of the email message. You can configure Header manipulation settings to reduce the number of message headers.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
295
Configuring session profiles
Figure 163: Header Manipulation
Profile
Remove received header
Remove headers
Enable to remove all Received: message headers from email messages.
You can alternatively remove this header on a perdomain basis. For details, see
“Remove received header of outgoing email” on page 220
.
Enable to remove other configured headers from email messages, then click Edit to configure which headers should be removed.
12 Click the arrow to expand Lists.
Configure the sender and recipient black lists and white lists, if any, that will be used with the session profile. Black and white lists are separate for each session profile, and will apply only to traffic controlled by the IP-based policy to which the session profile is applied.
Email addresses in each black list or white list are listed in alphabetical order. For more information on how blacklisted email addresses are handled, see
“Order of execution of black lists & white lists” on page 390
.
Note: If you require regular expression support for whitelisting and blacklisting sender and recipient email addresses in the envelope, do not configure white lists and black lists in the session profile. Instead, configure access control rules and message delivery rules. For
more information, see “Managing the global address book” on page 228 .
Note: Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance, but can also cause false positives and false negatives if not used carefully. For example, a white list entry of *.edu would allow all email from the
.edu top level domain to bypass the FortiMail unit's other antispam scans.
Figure 164: Lists
296
Enable sender white list checking Enable to use an envelope sender (MAIL FROM:) white list in SMTP sessions to which this profile is applied, then click Edit to define the whitelisted email addresses.
Enable sender black list checking Enable to use an envelope sender (MAIL FROM:) black list in SMTP sessions to which this profile is applied, then click Edit to define the blacklisted email addresses.
Allow recipients on this list Enable to use an envelope recipient (RCPT TO:) white list in SMTP sessions to which this profile is applied, then click Edit to define whitelisted email addresses.
Disallow recipients on this list Enable to use an envelope recipient (RCPT TO:) black list in SMTP sessions to which this profile is applied, then click Edit to define blacklisted email addresses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
13 Click OK.
Configuring antispam profiles and antispam action profiles
The AntiSpam submenu enables you to configure antispam profiles and their antispam action profiles.
This topic includes:
•
•
Configuring antispam action profiles
Configuring antispam profiles
The AntiSpam tab enables you to configure antispam profiles.
Antispam profiles are sets of antispam scans that you can apply by selecting one in a policy.
FortiMail units can use various methods to detect spam, such as the FortiGuard Antispam service, DNSBL queries, Bayesian scanning, and heuristic scanning. Antispam profiles contain settings for these features that you may want to vary by policy. Depending on the feature, before you configure antispam policies, you may need to enable the feature or configure its system-wide settings. For more information, see
.
For information on the order in which FortiMail units perform each type of antispam scan,
see “Order of execution” on page 24 .
Antispam profiles are created and applied separately based upon the incoming or outgoing directionality of the SMTP connection or email message. For more information,
see “Incoming vs. outgoing recipient-based policies” on page 259
and
“Incoming vs. outgoing SMTP connections” on page 231 .
Tip: You can use an LDAP query to enable or disable antispam scanning on a per-user basis. For details, see
“Configuring LDAP profiles” on page 333 and
“Check AS/AV configuration” on page 220
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of incoming antispam profiles, go to Profile > AntiSpam > AntiSpam.
Figure 165: Viewing the list of antispam profiles
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
297
Configuring antispam profiles and antispam action profiles Profile
Batch Edit
Profile Name
Domain Name
Direction
Select two or more antispam profiles by marking their check boxes, then click this button to apply the same change to all of the selected profiles.
The name of the profile.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
Either Incoming for a profile that can be used by an incoming policy, or
Outgoing for a profile that can be used by an outgoing policy. For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259
.
To configure an antispam profile
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 Configure the following:
Figure 166: Creating an antispam profile
298
Domain
Profile Name
Direction
Default action
FortiGuard scan
Select the entire FortiMail unit (System) or name of a protected domain.
For more information, see
“About administrator account permissions & domains” on page 144 .
Enter the name of the profile.
Select either Incoming for a profile that can be used by an incoming policy, or Outgoing for a profile that can be used by an outgoing policy.
For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
“Configuring antispam action profiles” on page 312
“FortiGuard scan options” on page 300 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Greylist scan
DNSBL scan
Deep header scan
SURBL scan
Bayesian scan
Heuristic scan
Dictionary scan
Enable to apply greylisting. For more information, see
“Configuring greylisting” on page 400
.
Note: Enabling greylisting can improve performance by blocking most spam before it undergoes other, more resource-intensive antispam scans.
“DNSBL scan options” on page 301
.
“Deep header scan options” on page 302
See “SURBL scan options” on page 303
.
See “Bayesian scan options” on page 304 .
“Heuristic scan options” on page 306 .
“Dictionary scan options” on page 307
.
.
Banned word scan
See “Banned word scan options” on page 308 .
Whitelist word scan
See “Whitelist word scan options” on page 309
.
Image spam scan
See “Image spam scan options” on page 311
.
Treat messages with viruses as spam
Enable to have the FortiMail unit perform the action configured in this antispam profile, instead of the action configured in the antivirus profile.
See “Configuring antispam action profiles” on page 312 .
Viruses will be removed before quarantining, rewriting the recipient, or applying a subject line or header tag.
Forged IP scan
Scan Conditions
Other Settings
Enable to convert the message sender's IP address to a canonical host name and compare the IP addresses returned from a reverse DNS lookup of the host name to the client's IP address. If the client's IP address is not found, the FortiMail unit treats the email message as spam.
However, this also means that if the client IP address is valid but not listed in the DNS table, the IP address will be treated as forged.Therefore, enabling this feature may cause some false positives.
See “Scan Conditions options” on page 311
.
Automatically update user's personal whitelist
Enable to allow the FortiMail unit to add the recipient email addresses from an email user’s outgoing email to their personal white list, if the option is also enabled in the email user’s preferences.
Email users’ preferences can be configured from both the Preferences tab of FortiMail webmail and from the web-based manager. For more information, see
“Configuring users’ preferences” on page 243 .
This option appears only for incoming profiles.
4 Click Create.
To configure a profile by duplicating an existing profile
1 Go to Profile > AntiSpam > AntiSpam.
2 Click the row corresponding to the profile whose settings you want to duplicate when creating the new profile, then click Clone.
3 Enter a name for the new profile.
4 Click OK.
The new profile appears in the list of profiles. Changes to this new profile do not affect the original profile from which it was created.
To apply changes to multiple profiles
1 Go to Profile > AntiSpam > AntiSpam.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
299
Configuring antispam profiles and antispam action profiles Profile
2 In the row corresponding to an existing profiles whose settings you want to modify, mark their check boxes.
3 Alternatively, click to select the first profile, then press and hold the Ctrl key while clicking to select the rest of the profiles that you want to change.
The option to apply changes to multiple profiles does not appear when creating a new profile. You must modify an existing profile.
4 Click Batch Edit.
5 Modify the profile, changing only those settings that you want to apply to multiple profiles.
6 Click Apply To All.
A dialog appears, summarizing the changes you are about to apply.
7 If you want to undo some of the changes or make additional changes, click Change
Profile. Otherwise, proceed by clicking Select Profiles.
8 In the Available profiles area, select the names of one or more profiles to which you want to apply the changes, then click the right arrow to move them into the Selected
profiles area.
9 Click OK.
A success message appears. To display the list of profiles, click Return.
FortiGuard scan options
The FortiGuard scan section of antispam profiles enables you to configure the FortiMail unit to query the FortiGuard Antispam service to determine if any of the uniform resource identifiers (URI) in the message body are associated with spam. If any URI is blacklisted, the FortiMail unit considers the email to be spam, and you can select the action that the
FortiMail unit will perform.
If you enable the Black IP scan option, in addition to the URI query, the FortiMail unit will query the FortiGuard Antispam service to determine if the IP address of the current SMTP
client is blacklisted. If the Black IP scan option located in the Deep header scan section is
enabled, FortiGuard scan will also examine the IP addresses of all other SMTP servers that appear in the Received: lines of the message header. For more information, see
“Deep header scan options” on page 302
.
FortiGuard Antispam scans do not examine private network addresses, which are defined in RFC 1918 .
Before enabling FortiGuard scan, you must enable and configure FortiGuard Antispam rating queries. For more information, see
“Verifying connectivity with FortiGuard services” on page 113 .
Note: If the FortiGuard scan option is enabled, you may be able to improve performance and the spam catch rate by also enabling Black IP scan and caching. For details on enabling caching, see
“Configuring FortiGuard updates & FortiGuard Antispam queries” on page 110
.
To configure FortiGuard antispam scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable FortiGuard scan.
300
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 167: FortiGuard scan
4 From Action, select the action profile that you want the FortiMail unit to use if the
FortiGuard Antispam scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
5 If you want the FortiMail unit to query the FortiGuard Antispam service to determine if the IP address of the SMTP server is blacklisted, enable Black IP scan.
Whether the FortiMail unit queries for the blacklist status of the IP address of only the most recent SMTP server or of all SMTP servers in the Received: lines of the message header varies by the configuration of Deep header scan. For more
information, see “Deep header scan options” on page 302 .
If this option is disabled, the FortiMail unit will query FortiGuard Antispam for URIs associated with spam, but will not query for IP addresses.
6 From Action, select the action profile that you want the FortiMail unit to use if the
FortiGuard Antispam scan determines that the email is spam.
7 Click Create.
DNSBL scan options
In addition to supporting Fortinet’s FortiGuard Antispam DNSBL service, the FortiMail unit supports third-party DNS Blacklist servers. You can enable DNSBL filtering as part of the antispam profile, and define multiple DNSBL servers for each antispam profile. Consult the third-party DNSBL service providers for any conditions and restrictions.
The DNSBL scan section of antispam profiles enables you to configure the FortiMail unit to query one or more DNS black list (DNSBL) servers to determine if the IP address of the
SMTP client has been blacklisted. If the IP address is blacklisted, the FortiMail unit considers the email to be spam, and you can select the action that the FortiMail unit will perform.
DNSBL scans examine the IP address of the SMTP client that is currently delivering the
email message. If the Black IP scan option located in the Deep header scan section is
enabled, DNSBL scan will also examine the IP addresses of all other SMTP servers that
.
DNSBL scans do not examine private network addresses, which are defined in RFC 1918 .
To configure DNSBL scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable DNSBL scan.
Figure 168: DNSBL scan
4 From Actions, select the action profile that you want the FortiMail unit to use if the
DNSBL scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
301
Configuring antispam profiles and antispam action profiles Profile
5 Next to DNSBL scan, click Configuration.
A pop-up window appears, enabling you to enter the domain names of DNSBL servers that will be used with this profile.
6 Configure the following:
Caution: Closing the pop-up window does not save the antispam profile and its associated
DNSBL server list. To save changes to the DNSBL server list, in the antispam profile, click
OK before navigating away to another part of the web-based manager.
Figure 169: DNSBL server list
302
DNSBL Server Address The domain name of the DNSBL server.
Since the servers will be queried from top to bottom, you may want to put the reliable servers with less traffic at the top of the list.
7 Click OK.
The pop-up window closes.
8 In the profile, click Create.
The FortiMail unit saves the profile and its associated DNSBL server list.
Deep header scan options
The Deep header scan section of antispam profiles enables you to configure the FortiMail unit for more extensive inspection of message headers. Deep header scanning involves two separate checks:
• Black IP checking examines the Received: message header. The FortiMail unit then extracts any URIs or IPs from the header and passes them to the FortiGuard Antispam service, DNSBL, or SURBL servers for spam checking.
• Header analysis examines the entire message header for spam characteristics.
If the message header inspection indicates that the email message is spam, the FortiMail unit considers the email to be spam, and you can select the action that the FortiMail unit will perform.
To configure deep header scanning
1 Go to Profile > AntiSpam > AntiSpam.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Click the arrow to expand Deep header scan.
Figure 170: Deep header scan
4 Enable Deep header scan.
5 From Actions, select the action profile that you want the FortiMail unit to use if the deep header scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
6 Configure the following:
Black IP scan Enable to query for the blacklist status of the IP addresses of all SMTP servers appearing in the Received: lines of header lines.
If this option is disabled, the FortiMail unit checks only the IP address of the current SMTP client.
This option applies only if you have also configured either or both
FortiGuard scan and DNSBL scan. For more information, see
“FortiGuard scan options” on page 300 and
“DNSBL scan options” on page 301
.
Headers analysis Enable to inspect all message headers for known spam characteristics.
If FortiGuard scan is enabled, this option uses results from that scan, providing up-to-date header analysis. For more information, see
“FortiGuard scan options” on page 300
.
7 Click Create.
SURBL scan options
In addition to supporting Fortinet’s FortiGuard Antispam SURBL service, the FortiMail unit supports third-party Spam URI Realtime Block Lists servers. You can specify which public
SURBL servers to use as part of an antispam profile. Consult the third-party DNSBL service providers for any conditions and restrictions.
The SURBL scan section of antispam profiles enables you to configure the FortiMail unit to query one or more spam URI realtime black list (SURBL) servers to determine if any of the uniform resource identifiers (URI) in the message body are associated with spam. If any URI is blacklisted, the FortiMail unit considers the email to be spam, and you can select the action that the FortiMail unit will perform.
To configure SURBL scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable SURBL scan.
Figure 171: SURBL scan
4 From Actions, select the action profile that you want the FortiMail unit to use if the
SURBL scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
303
Configuring antispam profiles and antispam action profiles Profile
5 Next to SURBL scan, click Configuration.
A pop-up window appears, enabling you to enter the domain names of SURBL servers that will be used with this profile.
6 Configure the following:
Caution: Closing the pop-up window does not save the antispam profile and its associated
SURBL server list. To save changes to the SURBL server list, in the antispam profile, click
OK before navigating away to another part of the web-based manager.
Figure 172: SURBL server list
304
SURBL Server Address The domain name of the SURBL server.
Since the servers will be queried from top to bottom, you may want to put the reliable servers with less traffic to the top of the list.
7 Click OK.
The pop-up window closes.
8 In the profile, click Create.
The FortiMail unit saves the profile and its associated SURBL server list.
Bayesian scan options
The Bayesian scan section of antispam profiles enables you to configure the FortiMail unit to use Bayesian databases to determine if the email is likely to be spam. If the Bayesian scan indicates that the email is likely to be spam, the FortiMail unit considers the email to be spam, and you can select the action that the FortiMail unit will perform.
FortiMail units can maintain multiple Bayesian databases: a global, per-domain, and peruser.
• For outgoing email, the FortiMail unit uses the global Bayesian database.
• For incoming email, which database will be used when performing the Bayesian scan varies by configuration of the incoming antispam profile, configuration of the protected domain, and the maturity of the personal Bayesian database.
For more information, see
“Types of Bayesian databases” on page 419 ,
“Configuring protected domains” on page 211
, and “Training the Bayesian databases” on page 421 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Before using Bayesian scans, you must train one or more Bayesian databases in order to teach the FortiMail unit which words indicate probable spam. If a Bayesian database is not sufficiently trained, it can increase false positive and/or false negative rates. You can train the Bayesian databases of your FortiMail unit in several ways. For more information, see
“Training the Bayesian databases” on page 421 .
Caution: Be aware that, without ongoing training, Bayesian scanning will become significantly less effective over time and thus Fortinet does not recommend enabling the
Bayesian scanning feature.
To configure Bayesian scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Click the arrow to expand Bayesian scan.
4 Enable Bayesian scan.
5 From Actions, select the action profile that you want the FortiMail unit to use if the
Bayesian scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
6 Configure the following:
Figure 173: Bayesian scan
Use personal database
Enable to use the per-user Bayesian databases instead of the global or perdomain Bayesian database, if the personal Bayesian database is mature. If the email user’s personal Bayesian database is not yet mature, the FortiMail unit will instead continue to use the global or per-domain Bayesian database.
For more information on determining the maturity of personal Bayesian databases, see
“Backing up, batch training, & monitoring the Bayesian databases” on page 424 .
Personal databases can provide better individual results because they are trained by the email user and therefore contain statistics derived exclusively from that email user's messages.
Disable to use either the global or per-domain Bayesian database. Whether the
FortiMail will use the global or per-domain Bayesian database varies by your selection in the protected domain. For more information, see
“Configuring protected domains” on page 211 .
This option appears only if Direction is Incoming. (Personal Bayesian
databases cannot be used when the recipient does not belong to a protected domain, which defines outgoing email.)
Note: Bayesian scan results may be unreliable if the Bayesian database being used has not been sufficiently trained. For more information, see
Bayesian databases” on page 421 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
305
Configuring antispam profiles and antispam action profiles
306
Profile
Accept training messages from users
Enable to accept training messages from email users.
Training messages are email messages that email users forward to the email addresses of control accounts, such as [email protected], in order to train or correct Bayesian databases. For information on Bayesian control
see “Training Bayesian databases” on page 479 .
FortiMail units apply training messages to either the global or per-domain
Bayesian database depending on your configuration of the protected domain to
which the email user belongs. For more information, see “Configuring protected domains” on page 211
. If Use personal database is enabled, the
FortiMail unit will also apply training messages to the email user’s personal
Bayesian database.
Disable to discard training messages.
This option appears only if Direction is Incoming. (Personal and per-domain
Bayesian databases cannot be used when the recipient does not belong to a protected domain, which defines outgoing email.)
Use other techniques for auto training
Enable to use scan results from FortiGuard scan, SURBL scan, and per-user and system-wide white lists to train per-user Bayesian databases until those databases are considered to be mature. For information on database maturity,
see “Backing up, batch training, & monitoring the Bayesian databases” on page 424 .
This option appears only if Direction is Incoming. (Personal and per-domain
Bayesian databases cannot be used when the recipient does not belong to a protected domain, which defines outgoing email.)
7 Click Create.
Heuristic scan options
The FortiMail unit includes rules the heuristic filter uses. Each rule has an individual score used to calculate the total score for an email. An threshold for the heuristic filter is set for each antispam profile. To determine if an email is spam, the heuristic filter examines an email message and adds the score for each rule that applies to get a total score for that email. For example, if the subject line of an email contains “As seen on national TV!”, it might match a heuristic rule that increases the heuristic scan score towards the threshold.
• Email is spam if the total score equals or exceeds the threshold
• Email is not spam if the total score is less than the threshold
The FortiMail unit comes with a default heuristic rule set, which can also be updated by
using the FortiGuard Antispam service (see “Configuring FortiGuard updates &
FortiGuard Antispam queries” on page 110 ). New rules are added and rule scores are
adjusted for maximum advantage.
Default threshold values are recommended as only a starting point. Later fine-tuning is required. You can fine-tune the threshold values to cause higher or lower scores to be considered spam. If the false positive ratio is too high, increase the upper level threshold value until you achieve a satisfactory ratio. If your spam catch rate is too low, reduce the lower level threshold value until you achieve a satisfactory rate.
Note: Heuristic scanning is resource intensive. If spam detection rates are acceptable without heuristic scanning, consider disabling it or limiting its application to policies for problematic hosts.
Note: You can also apply this scan to PDF attachments. For more information, see “Scan
Conditions options” on page 311
.
To configure heuristic scanning
1 Go to Profile > AntiSpam > AntiSpam.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Click the arrow to expand Heuristic scan.
4 Enable Heuristic scan.
5 From Actions, select the action profile that you want the FortiMail unit to use if the heuristic scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
6 Configure the following:
Figure 174: Heuristic scan
Threshold
The percentage of rules used
Enter the score equal to or above which the FortiMail unit considers an email to be spam.
Enter the percentage of the total number of heuristic rules that will be used to calculate the heuristic score for an email message.
To ensure that the currently most common spam methods are included in the percentage of rules used to calculate the score, update your
FortiGuard Antispam packages regularly. For details, see
FortiGuard updates & FortiGuard Antispam queries” on page 110 .
The FortiMail unit compares this total score to the threshold to determine if an email is:
• spam (score equals or exceeds the threshold)
• not spam (score is less than the threshold)
7 Click Create.
Dictionary scan options
The Dictionary scan section of antispam profiles enables you to configure the FortiMail unit to use dictionary profiles to determine if the email is likely to be spam. If the FortiMail unit considers the email to be spam, you can select the action that the FortiMail unit will perform.
When dictionary scanning is enabled and an email is found to contain a dictionary word,
FortiMail units add X-FEAS-DICTIONARY: to the message header, followed by the dictionary word or pattern that was found in the email. The header may be useful for troubleshooting purposes, when determining which dictionary word or pattern caused an email to be blocked.
For information on dictionaries, see “Configuring dictionary profiles” on page 367
.
Unlike banned word scans, dictionary scans are more resource-intensive. If you do not require dictionary features such as regular expressions and/or non-ASCII character encoding such as UTF-8, consider using a banned word scan instead. For information on banned word scans, see
“Banned word scan options” on page 308 .
To configure dictionary scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Click the arrow to expand Dictionary scan.
4 Enable Dictionary scan.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
307
Configuring antispam profiles and antispam action profiles
5 From Actions, select the action profile that you want the FortiMail unit to use if the heuristic scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
6 Configure the following:
Figure 175: Dictionary scan
Profile
308
With dictionary group Select the name of a group of dictionary profiles to use with the dictionary scan.
With dictionary profile Select the name of a dictionary profile to use with the dictionary scan.
Minimum dictionary score
Enter the number of dictionary term matches above which the email will be considered to be spam.
For information on creating dictionary profiles, see “Configuring dictionary profiles” on page 367 .
7 Click Create.
Banned word scan options
The Banned word scan section of antispam profiles enables you to configure the FortiMail unit to consider email messages whose subject line and/or message body contain a prohibited word or phrase to be spam. If the email message contains a banned word, the
FortiMail unit considers the email to be spam, and you can select the action that the
FortiMail unit will perform.
When banned word scanning is enabled and an email is found to contain a banned word, the FortiMail unit adds X-FEAS-BANNEDWORD: to the message header, followed by the banned word that was found in the email. The header may be useful for troubleshooting purposes, when determining which banned word or phrase caused an email to be blocked.
Unlike dictionary scans, banned word scans do not support regular expressions or character encodings other than ASCII, such as UTF-8. For information on dictionary scans, see
“Dictionary scan options” on page 307
.
Note: You can also apply this scan to PDF attachments. For more information, see “Scan
Conditions options” on page 311
.
To configure banned word scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable Banned word scan.
Figure 176: Banned word scan
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
4 From Actions, select the action profile that you want the FortiMail unit to use if the banned word scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
5 Next to Banned word scan, click Configuration.
A pop-up window appears, enabling you to enter the words or phrases that will be prohibited by this profile.
6 Configure the following:
Caution: Closing the pop-up window does not save the antispam profile and its associated banned word list. To save changes to the banned word list, first click OK before navigating away to another part of the web-based manager.
Figure 177: Banned word list
Banned Word Click New, then enter the banned word in the field that appears. Wild cards are not supported.
Subject Select whether or not the subject line will be inspected for the banned word.
• Empty check box: The subject line will not be inspected.
• Check mark: The subject line will be inspected.
Body Select whether or not the message body will be inspected for the banned word.
• Empty check box: The message body will not be inspected.
• Check mark: The message body will be inspected.
7 Click OK.
The pop-up window closes.
8 In the profile, click OK.
The FortiMail unit saves the profile and its associated banned word list.
Whitelist word scan options
The Whitelist word scanWhitelist word scan section of antispam profiles enables you to configure the FortiMail unit to consider email messages whose subject line and/or message body contain a whitelisted word or phrase to be indisputably not spam. If the email message contains a whitelisted word, the FortiMail unit does not consider the email to be spam, and will not perform any further antispam scans.
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
309
Configuring antispam profiles and antispam action profiles Profile
To configure white list word scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable Whitelist word scan.
Figure 178: Whitelist word scan
4 Next to Whitelist word scan, click Configuration.
A pop-up window appears, enabling you to enter the words or phrases that will be prohibited with this profile.
5 Configure the following:
Caution: Closing the pop-up window does not save the antispam profile and its associated banned word list. To save changes to the banned word list, first click Save before navigating away to another part of the web-based manager.
Figure 179: Whitelist word list
310
Whitelist Word
Subject
Body
Click New, then enter the whitelisted word in the field that appears. Wild cards are not supported.
Select whether or not the subject line will be inspected for the whitelisted word.
• Empty check box: The subject line will not be inspected.
• Check mark: The subject line will be inspected.
Select whether or not the message body will be inspected for the whitelisted word.
• Empty check box: The message body will not be inspected.
• Check mark: The message body will be inspected.
6 Click OK.
The pop-up window closes.
7 In the profile, click OK.
The FortiMail unit saves the profile and its associated whitelisted word list.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Image spam scan options
The Image spam scan section of antispam profiles enables you to configure the FortiMail unit to analyze the contents of GIF, JPG, and PNG graphics to determine if the email is spam. If the email message contains a spam image, the FortiMail unit considers the email to be spam, and will not perform any further antispam scans.
Image spam scanning may be useful when, for example, the message body of an email contains graphics but no text, and text-based antispam scans are therefore unable to determine whether or not an email is spam.
To configure image spam scanning
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Enable Image spam scan.
Figure 180: Image spam scan
4 From Actions, select the action profile that you want the FortiMail unit to use if the banned word scan determines that the email is spam.
For more information, see “Configuring antispam action profiles” on page 312 .
5 Configure the following:
Aggressive scan Enable to inspect image file attachments in addition to embedded graphics.
Enabling this option increases workload when scanning email messages that contain image file attachments. If you do not require this feature, consider disabling this option to improve performance.
Note: This option applies only if you enable PDF scanning. For more information, see
“Scan Conditions options” on page 311
.
6 Click Create.
Scan Conditions options
The Scan Conditions section of antispam profiles enables you to configure conditions that cause the FortiMail unit to omit antispam scans, or to apply some antispam scans to PDF attachments.
To configure Scan Conditions
1 Go to Profile > AntiSpam > AntiSpam.
2 Either click New to add a profile, or, double-click the row corresponding to an existing profile that you want to modify.
3 Click the arrow to expand Scan Conditions.
4 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
311
Configuring antispam profiles and antispam action profiles
Figure 181: Scan Conditions
Profile
Max message size to scan
Bypass scan on
SMTP authentication
Scan pdf attachment
Enter the maximum size of email messages, in bytes, that the FortiMail unit will scan for spam. Messages larger than the maximum message size will not be scanned for spam.
To disable the size limit, causing all messages to be scanned, regardless of size, enter 0.
Note: Resource requirements for scanning messages increase with the size of the email message. If the spam you receive tends not to be smaller than a certain size, consider limiting antispam scanning to messages under this size to improve performance.
Enable to bypass spam scanning for SMTP connections that have been authenticated.
Note: If you can trust that authenticating SMTP clients are not a source of spam, consider enabling this option to improve performance.
Spammers may attach a PDF file to an otherwise empty message, to get their email messages past spam safeguards. The PDF file contains the spam information. Since the message body contains no text, antispam scanners cannot determine if the message is spam.
Enable this option to use the heuristic, banned word, and image spam scans to inspect the first page of PDF attachments.
This option applies only if you have enabled and configured heuristic, banned word, and/or image spam scans. For information on configuring those scans, see
“Heuristic scan options” on page 306
,
“Banned word scan options” on page 308
, and “Image spam scan options” on page 311
.
5 Click Create.
Configuring antispam action profiles
The Action tab in the AntiSpam submenu enables you to define action profiles.
Antispam action profiles define one or more things that the FortiMail unit should do if the antispam profile determines that an email is spam.
For example, you might have configured an antispam action profile named quar_and_tag_profile, which both tags the subject line and quarantines email detected to be spam. In general, all antispam profiles using quar_and_tag_profile will therefore both quarantine and tag spam. However, you have decided that email that does not pass the dictionary scan is always spam and should be rejected so that it does not consume quarantine disk space. Therefore, for the antispam profiles that apply a dictionary scan, you would override the action profile’s default action by configuring and selecting a second action profile, named rejection_profile, which rejects such email.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of antispam action profiles, go to Profile > AntiSpam > Action.
312
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 182: Viewing the list of antispam action profiles
Profile Name
Domain
Direction
The name of the profile.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
Either Incoming for a profile that can be used by an incoming antispam profile, or Outgoing for a profile that can be used by an outgoing antispam profile. For
.
To configure an antispam action profile
1 Go to Profile > AntiSpam > Action.
2 Either click New to add a profile, or double-click an existing profile that you want to modify.
3 Configure the following:
Figure 183: Configuring an antispam action profile
Tag email’s subject line Enable and enter the text that will appear in the subject line of the email, such as “[spam]”, in the With value field. The FortiMail unit will prepend this text to the subject line of spam before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
313
Configuring antispam profiles and antispam action profiles
314
Profile
Insert new header Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes, including a spam mailbox, based on text appearing in various parts of email messages, including the message header.
For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Custom-Header: Detected as spam by profile 22.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as these are forbidden by RFC 2822 .
Deliver to alternate host Enable to route the email to a specific SMTP server or relay, then type the fully qualified domain name (FQDN) or IP address of the destination.
Note: If you enable this setting, for all email that matches the
profile, the FortiMail unit will use this destination and ignore Relay
server name and Use this domain’s SMTP server to deliver the
BCC
Reject
Discard
Quarantine
Enable to send a blind carbon copy (BCC) of the email.
Configure BCC recipient email addresses by entering each one and clicking Create in the BCC area.
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
Enable to redirect spam to the per-recipient quarantine. For more
information, see “Managing the personal quarantines” on page 63
.
This option is available only for incoming profiles.
Send quarantine report
Enable this option before the FortiMail unit can send out quarantine reports according to the report schedule. For more information, see
“Configuring global quarantine report settings” on page 380
and
“Configuring email quarantines & quarantine reports” on page 379 .
Note: When sending out a quarantine report to an email recipient, the FortiMail unit checks the recipients in the recipient-based policy list from top to bottom and takes the action defined in the cation profile used by the recipient’s first policy. For example, if recipient user1@example has two policies:
• The first policy uses an non-scanning antispam profile for sender pattern *@example2.com.
• The second policy uses a more strict antispam profile for all other senders (sender pattern *@*).
In this case, if you do not enable the Send a quarantine report option for the first policy, while enabling the option for the second policy, [email protected] will not get quarantine reports because the FortiMail unit takes actions according to the action profile used in the first matching policy.
Therefore, if the recipient has more than one policies, you must use the same antispam action profile to avoid the above problem.
Email release
Web release
Enable to allow email users to remotely release email from the quarantine by sending email to quarantine control account email
addresses. For more information, see “Configuring the quarantine control accounts” on page 389 .
Enable to allow email users to remotely release email from the quarantine by selecting the Release link in a quarantine report. For more information, see
“About the HTML formatted quarantine report” on page 384 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring antivirus profiles
White list sender of released messages
Enable to, when an email user releases an email from the quarantine, automatically add the sender email address of the quarantined email to the email user’s personal white list if the option is also enabled in the email user’s preferences. For more
information, see “Configuring the personal black lists & white lists” on page 396
.
Email users’ preferences can be configured from both the
Preferences tab of FortiMail webmail and from the web-based manager. For more information, see
“Configuring users’ preferences” on page 243 .
Delete messages after
Enter the number of days you want to keep the quarantined email.
Enter a small enough value that will prevent the size of the quarantine from exceeding the available disk space. If you enter 0 to prevent automatic deletion of quarantined files, you must periodically manually remove old files.
Quarantine to review
Rewrite recipient email address
Enable to redirect spam to the system quarantine. For more
information, see “Managing the system quarantine” on page 69 .
Enable to change the recipient address of any email message detected as spam.
Configure rewrites separately for the local-part (the portion of the email address before the '@' symbol, typically a user name) and the domain part (the portion of the email address after the '@' symbol). For each part, select either:
• None: No change.
• Prefix: Prepend the part with text that you have entered in the
With field.
• Suffix: Append the part with the text you have entered in the
With field.
• Replace: Substitute the part with the text you have entered in the With field.
4 Click Create.
To apply an antispam action profile, select it in one or more antispam profiles. For
details, see “Configuring antispam profiles” on page 297 .
Configuring antivirus profiles
The AntiVirus tab enables you to create antivirus profiles that you can select in a policy in order to scan email for viruses.
You can view a list of the virus signatures currently being used by antivirus profiles to detect viruses. For more information, see
“Viewing information about the FortiGuard
Antivirus signatures database” on page 317 .
If the FortiMail unit detects a virus, it replaces the infected file with a replacement message that notifies the email user the infected file has been removed. You can customize replacement messages. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206 .
Note: Actions in antivirus profiles can be overridden in antispam profiles. For details, see
“Treat messages with viruses as spam” on page 299 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of antivirus profiles, go to Profile > AntiVirus > AntiVirus.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
315
Configuring antivirus profiles
Figure 184: Viewing the list of antivirus profiles
Profile Name
Domain Name
The name of the profile.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
To configure an antivirus profile
1 Go to Profile > AntiVirus > AntiVirus.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 Click the arrow s to expand each section, then configure the following:
Figure 185: Configuring an antivirus profile
Profile
316
Domain
Profile name
Select
Type the name of the antivirus profile.
Virus scanning
Heuristic scanning
Enable to perform antivirus scanning.
Enable to use heuristics when performing antivirus scanning.
This option is disabled by default to reduce false positives.
Replace suspicious attachment
Indicates that the FortiMail unit will replace attachments with a replacement message if the heuristic antivirus scan determines that they have virus-like qualities, and suspects that they may be infected. You can customize replacement
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring antivirus profiles
Reject
Discard
Enable to reject email suspected to be infected, and reply to the SMTP client with SMTP reply code 550.
Enable to accept email suspected to be infected, but then delete it instead of delivering the email, without notifying the SMTP client.
Actions
Replace virus body
Reject
Discard
Indicates that the FortiMail unit will replace infected attachments with a replacement message. You can customize replacement messages. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206
.
This option cannot be disabled, but does not apply if you also enable Reject or Discard.
Enable to reject infected email and reply to the
SMTP client with SMTP reply code 550.
Enable to accept infected email, but then delete it instead of delivering the email, without notifying the
SMTP client.
4 Click Create.
To configure an antivirus profile by duplicating an existing profile
1 Go to Profile > AntiVirus > AntiVirus.
2 Click the row corresponding to the profile whose settings you want to duplicate when creating the new profile, then click Clone.
3 Enter a name for the new profile.
4 Click OK.
The new profile appears in the list of profiles. Changes to this new profile do not affect the original profile from which it was created.
Viewing information about the FortiGuard Antivirus signatures database
The Virus Database tab displays the FortiGuard Antivirus database version number and the total number of signatures it contains.
Signatures are used by antivirus scans in antivirus profiles to identify viruses based upon known qualities.
FortiMail units can update their virus signatures by downloading them directly from the
FortiGuard Distribution Network (FDN). For more information, see
“Configuring FortiGuard updates & FortiGuard Antispam queries” on page 110
.
To view the list of virus files, go to Profile > AntiVirus > Virus Database.
Figure 186: Viewing the list of virus signatures
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
317
Configuring content profiles and content action profiles Profile
Configuring content profiles and content action profiles
The Content submenu enables you to configure content profiles for incoming and outgoing content-based scanning.
This topic includes:
•
•
Configuring content action profiles
Configuring content profiles
The Content tab enables you to create content profiles, which you can use to match email based upon its subject line, message body, and attachments.
Unlike antispam profiles, which deal primarily with spam, content profiles match any other type of email.
Content profiles can be used to apply content-based encryption to email. They can also be used to restrict prohibited content, such as words or phrases, file names, and file attachments that are not permitted by your network usage policy. As such, content profiles can be used both for email that you want to protect, and for email that you want to prevent.
Content profile options vary by whether the profile matches incoming or outgoing email.
and “Incoming vs. outgoing SMTP connections” on page 231
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of incoming content profiles, go to Profile > Content > Content.
Figure 187: Viewing the list of content profiles
318
Profile Name The name of the profile.
Domain Name
Direction
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
Either Incoming for a profile that can be used by an incoming policy, or
Outgoing for a profile that can be used by an outgoing policy. For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259
.
(Green dot in column heading.)
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring content profiles and content action profiles
To configure a content profile
1 Go to Profile > Content > Content.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
Figure 188: Configuring a content profile
3 In Domain, select either the entire FortiMail unit (System) or name of a protected domain.
4 In Profile name, enter the name of the profile.
5 In Direction, select e it her Incoming for a profile that can be used by an incoming policy, or Outgoing for a profile that can be used by an outgoing policy. For definitions of outgoing and incoming email, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
.
7 Click the arrow to expand Attachment Filtering, and configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
319
Configuring content profiles and content action profiles
Figure 189: Attachment Filtering
Profile
320
Block or
Pass
Enable
Name
Create
Delete
Select either Block (that is, apply the content action profile selected in the Action section) or Pass (that is, bypass the content action profile) from the drop-down menu, if a file attachment matches the file name patterns whose check boxes you mark.
If an attachment matches a pattern whose check box you did not mark, the FortiMail unit will perform the opposite action of whatever you selected, either Block or Pass.
For example, if you select Block and mark the check box for *.exe, files whose names end in .exe will be blocked. All other file names will pass attachment filtering, but will still be subject to any other filters or antispam scans that you have configured.
Conversely, if you select Pass and mark the check box for *.doc, all file names other than those ending in .doc will be blocked.
Mark the check boxes of file name or file extension patterns that you want to Block or Pass.
The attachment filtering pattern, which describes a file name or file name extension that can be filtered, such as *.exe for all files with the executable file name extension.
Enter the file name, file extension, or a pattern containing wild cards, then click this button to add it to the list, and mark or un-mark its check box.
Mark the check box of an attachment filtering pattern, then click this button to remove it from the list.
8 Click the arrow to expand File Type Filtering.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 190: File Type Filtering
Configuring content profiles and content action profiles
Select either Block (that is, apply the content action profile selected in the Action section) or Pass (that is, bypass the content action profile) from the drop-down menu, then in the check box column, mark the check boxes of the MIME file types or subtypes that you want to block or pass. File types that you have not marked will receive the action opposite of your Block/Pass selection.
Note: For the document/encrypted file type, you can use an action profile to overwrite the default action profile used by the content profile. For example, if you want to redirect encrypted email to a third party box (such as a PGP Universal Server) for decryption, You can:
1 Create a content action profile and enable the Send to alternate host option in the action profile. Enter the PGP server as the alternate host. For details about how create a content action profile, see
“Configuring content action profiles” on page 326 .
2 Select to block the document/encrypted file type. “Block” means to apply an action profile.
3 Select the action profile for the document/encrypted file type. This action profile will
overwrite the action profile you select for the entire content profile.
Note: Unlike other attachment types, archives may receive an action other than your
Block/Pass selection, depending on your configuration of options for that MIME file type.
For details, see the Scan Conditionsoptions Check Archive Content, Max Level of
Compression, Block on Failure to Decompress and Block Password Protected Archive.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
321
Configuring content profiles and content action profiles Profile
For example, to allow email that contains audio content pass the attachment file type filter, and block all other file types, you would select Pass and then mark the audio check box.
Passed file types will pass attachment file type filtering only, and will still be subject to any other content filters or antispam scans that you have configured.
application/other includes all file types not specifically described by the other options.
document/encrypted includes PGP- or S/MIME-encrypted email.
Caution: Encrypted email content cannot be scanned for spam, viruses, or banned content.
Note: Alternatively, you can reject PGP- or S/MIME-encrypted email through a session profile. For details, see “Reject SMIME encrypted messages” on page 291 .
9 Click the arrow to expand Other Setting, and configure the following:
Figure 191: Other Setting
322
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring content profiles and content action profiles
Remove hidden HTML content
Enable to detect hypertext markup language (HTML) tags and, if found:
• apply the action profile
• add X-FEAS-ATTACHMENT-FILTER: Contains HTML tags. to the message headers
This option can be used to mitigate potentially harmful HTML content such as corrupted images or files, or phishing URLs that have been specially crafted for a targeted attack, and therefore not yet identified by the FortiGuard Antispam service.
Depending on the action profile, for example, you could warn email users by tagging email that contains potentially dangerous HTML content, or, if you have removed the HTML tags, allow users to safely read the email to decide whether or not it is legitimate first, without automatically displaying and executing potentially dangerous scripts, images, or other files. (Automatic display of HTML content is a risk on some email clients.)
Caution: Unless you also select Replace in the content action profile,
HTML will not be removed, and the email will not be converted to plain text. Instead, the FortiMail unit will only apply whichever other action profile “block” action you have selected.
To actually remove HTML tags, you must also select Replace.
If you select Replace, all HTML tags will be removed, except for the minimum required by the HTML document type definition (DTD):
• <html>
• <head>
• <body>
Stripped body text will be surrounded by <pre> tags, which is typically rendered in a monospace font, causing the appearance to mimic plain text.
For linked files, which are hosted on an external web site for subsequent download rather than directly attached to the email, the
FortiMail unit will download and attach the file to the email before removing the <img> or <embed> tag. In this way, while the format is converted to plain text, attachments and linked files which may be relevant to the content are still preserved.
For example, in an email that is a mixture of HTML and plain text
(Content-Type: multipart/alternative), and if the action profile’s “block” action is Replace, the FortiMail unit would remove hyperlink, font, and other HTML tags in the sections labeled with
Content-Type: text/html. Linked images would be converted to attachments. (The MIME Content-Type: text/html label itself, however, would not be modified.)
Block email without any attachment
Enable to apply the block action configured in the content action profile if an email does not have any attachments.
10 Click the arrow to expand Scan Conditions, and configure the following:
Figure 192: Scan Conditions
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
323
Configuring content profiles and content action profiles Profile
Check Archive
Content
Max Level of
Compression
Block on Failure to
Decompress
Block Password
Protected Archive
Check Embedded
Component
Bypass scan on
SMTP authentication
Enable to, instead of blocking/passing based solely upon the application/archive MIME type, determine which action to perform by:
• blocking password protected archives if you have selected Block
Password Protected Archive
• blocking archives that could not be successfully decompressed if you have selected Block on Failure to Decompress
• passing/blocking by comparing the depth of nested archives with the nesting depth threshold configured in Max Level of Compression
By default, archives with less than 10 levels of compression will be blocked if they cannot be successfully decompressed or are passwordprotected.
Depending on the nesting depth threshold and the attachment’s depth of nested archives, the FortiMail unit may also consider the file types of files within the archive when determining which action to perform. For details, see “Max Level of Compression” on page 324 .
If disabled, the FortiMail unit will perform the Block/Pass action solely based upon whether an email contains an archive. It will disregard the depth of nesting, password protection, successful decompression, and the file types of contents within the archive.
Enter the nesting depth threshold. Depending upon each attached archive’s depth of archives nested within the archive, the FortiMail unit will use one of the following methods to determine whether it should block or pass the email.
• Max Level of Compression is 0, or attachment’s depth of
nesting equals or is less than Max Level of Compression: If the attachment contains a file that matches one of the other MIME file types, perform the action configured for that file type, either block or pass.
• Attachment’s depth of nesting is greater than Max Level of
Compression: Apply the block action, unless you have deselected the check box for Max Level of Compression, in which case it will pass the MIME file type content filter. Block actions are specified in the content action profile.
The value in text field is always considered if Check Archive
Content is enabled. The check box only has an effect if the threshold is exceeded.
This option appears only if Check Archive Content is enabled.
Enable to apply the block action configured in the content action profile if an attached archive cannot be successfully decompressed, such as if the compression algorithm is unknown, and therefore cannot be decompressed in order to scan its contents.
This option appears only if Check Archive Content is enabled.
Enable to apply the block action configured in the content action profile if an attached archive is password-protected, and therefore cannot be decompressed in order to scan its contents.
This option appears only if Check Archive Content is enabled.
Documents, similar to an archive, can sometimes contain video, graphics, sounds, and other files that are used by the document. By embedding the required file within itself instead of linking to such files externally, a document becomes more portable. However, it also means that documents can be used to hide infected files that are the real attack vector.
Enable to, for application/document MIME types such as
Microsoft Office, Microsoft Visio, and OpenOffice.org documents, scan files that are encapsulated within the document itself. The FortiMail unit will scan only for MIME types that are enabled in File Type Filtering.
Enable to omit content profile scanning if the SMTP session is authenticated.
324
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring content profiles and content action profiles
Defer messages larger than
Enter the file size limit over which the FortiMail unit will defer processing large email messages.
.
This option is available only if Direction is Incoming.
11 Click the arrow to expand Content Monitor and Filtering, then configure the following:
Figure 193: Content Monitor and Filtering
(Check box in column heading.)
Enable
Dictionary Type
Dictionary Group
Dictionary Profile
Minimum Score
Action
Create
Move Up
Move Down
To select all content monitor profiles, mark the check box in the column heading.
To select an individual content monitor profile, mark the check box in the row corresponding to it.
Enable to use the dictionary profile to inspect email for matching email and perform the configured action.
Select whether to detect content based upon a dictionary profile
(Profile), or a group of dictionary profiles (Group). Depending on your
selection, also configure either Dictionary Group or Dictionary Profile.
Select the dictionary profile group that this monitor profile will use.
The FortiMail unit will compare content in the subject line and message body of the email message with words and patterns in the dictionary profile. If it locates matching content, the FortiMail unit will perform the
actions configured for this monitor profile in the Action column.
For information on dictionary profiles, see
“Configuring dictionary profiles” on page 367 .
Select the dictionary profile that this monitor profile will use.
The FortiMail unit will compare content in the subject line and message body of the email message with words and patterns in the dictionary profile. If it locates matching content, the FortiMail unit will perform the
actions configured for this monitor profile in the Action column.
For information on dictionary profiles, see
“Configuring dictionary profiles” on page 367 .
Enter the number of times that an email must match the content monitor
profile before it will receive the action configured in Action.
The action that the FortiMail unit will perform if the content of the email message matches words or patterns from the dictionary profile.
Click to add a monitor profile, which selects the dictionary profile that will be used to determine matching email messages, and the actions that will be performed if a match is found.
Mark its check box to select a content monitor profile, then click this button to move it up in the list of content monitor profiles.
Content monitor profiles are evaluated for a match in order of their appearance in this list. Usually, content monitor profiles should be ordered from most specific to most general, and from accepting or quarantining to rejecting.
Mark its check box to select a content monitor profile, then click this button to move it down in the list of content monitor profiles.
Content monitor profiles are evaluated for a match in order of their appearance in this list. Usually, content monitor profiles should be ordered from most specific to most general, and from accepting or quarantining to rejecting.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
325
Configuring content profiles and content action profiles Profile
Delete Mark its check box to select a content monitor profile, then click this button to remove it.
Note: Deletion does not take effect immediately; it occurs when you save the content profile.
12 Click Create.
To configure a profile by duplicating an existing profile
1 Go to Profile > Content > Content.
2 Click the row corresponding to the profile whose settings you want to duplicate when creating the new profile, then click Clone.
3 Enter a name for the new profile.
4 Click OK.
The new profile appears in the list of profiles. Changes to this new profile do not affect the original profile from which it was created.
Configuring content action profiles
The Action tab in the Content submenu enables you to define content action profiles.
Content action profiles can be used to apply content-based encryption.
Alternatively, content action profiles can define one or more things that the FortiMail unit should do if the content profile determines that an email contains prohibited words or phrases, file names, or file types.
For example, you might have configured most content profiles to match prohibited content, and therefore to use a content action profile named quar_profile which quarantines email to the system quarantine for review.
However, you have decided that email that does not pass the dictionary scan named financial_terms is always prohibited, and should be rejected so that it does not require manual review. To do this, you would first configure a second action profile, named rejection_profile, which rejects email. You would then override quar_profile specifically for the dictionary-based content scan in each profile by selecting rejection_profile for content that matches financial_terms.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of content action profiles, go to Profile >Content > Action.
Figure 194: Viewing the list of content action profiles
326
Profile Name
Domain
The name of the profile.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring content profiles and content action profiles
Direction Either Incoming for a profile that can be used by an incoming antispam profile, or Outgoing for a profile that can be used by an outgoing antispam profile. For
.
(Green dot in column heading.)
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
To configure an content action profile
1 Go to Profile > Content > Action.
2 Either click New to add a profile, or double-click an existing profile that you want to modify.
3 Configure the following:
Figure 195: Configuring an content action profile
Tag email’s subject line Enable and enter the text that will appear in the subject line of the email, such as “[PROHIBITED-CONTENT]”, in the With value field.
The FortiMail unit will prepend this text to the subject line of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes based on text appearing in various parts of email messages, including the subject line. For details, see the documentation for your email client.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
327
Configuring content profiles and content action profiles
328
Profile
Insert new header Enable and enter the message header key in the field, and the values in the With value field. The FortiMail unit will add this text to the message header of the email before forwarding it to the recipient.
Many email clients can sort incoming email messages into separate mailboxes based on text appearing in various parts of email messages, including the message header. For details, see the documentation for your email client.
Message header lines are composed of two parts: a key and a value, which are separated by a colon. For example, you might enter:
X-Content-Filter: Contains banned word.
If you enter a header line that does not include a colon, the
FortiMail unit will automatically append a colon, causing the entire text that you enter to be the key.
Note: Do not enter spaces in the key portion of the header line, as these are forbidden by RFC 2822 .
Deliver to alternate host Enable to route the email to a specific SMTP server or relay, then type the fully qualified domain name (FQDN) or IP address of the destination.
Note: If you enable this setting, for all email that matches the
profile, the FortiMail unit will use this destination and ignore Relay
server name and Use this domain’s SMTP server to deliver the
BCC
Treat as spam
Enable to send a blind carbon copy (BCC) of the email.
Configure BCC recipient email addresses by entering each one and clicking Create in the BCC area.
Enable to perform the Actions selected in the antispam profile of the policy that matches the email. For more information, see
“Configuring antispam action profiles” on page 312
.
Reject
Discard
Replace
Quarantine
Quarantine to review
Rewrite recipient email address
Encrypt with profile
Enable to reject the email and reply to the SMTP client with SMTP reply code 550.
Enable to accept the email, but then delete it instead of delivering the email, without notifying the SMTP client.
Enable to replace the email’s contents with a replacement
message, and, if you have enabled Remove hidden HTML content,
Enable to redirect the email to the per-recipient quarantine. For more information, see
“Managing the personal quarantines” on page 63
.
This option is available only for incoming profiles.
Enable to redirect the email to the system quarantine. For more
information, see “Managing the system quarantine” on page 69 .
Enable to change the recipient address of any email that matches the content profile.
Configure rewrites separately for the local-part (the portion of the email address before the '@' symbol, typically a user name) and the domain part (the portion of the email address after the '@' symbol). For each part, select either:
• None: No change.
• Prefix: Prepend the part with text that you have entered in the
With field.
• Suffix: Append the part with the text you have entered in the
With field.
• Replace: Substitute the part with the text you have entered in the With field.
Enable to apply an encryption profile, then select which encryption profile to use. For details, see
“Configuring encryption profiles” on page 372 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring resource profiles
4 Click Create.
To apply an antispam action profile, select it in one or more antispam profiles. For
details, see “Configuring antispam profiles” on page 297 .
Configuring resource profiles
The Resource tab enables you to create resource profiles, which configure miscellaneous aspects of local email user accounts when the FortiMail unit is operating in server mode, such as disk space quota.
Note: This submenu appears only if the FortiMail unit is operating in server mode.
For more information on settings that can be applied to email user accounts, see
“Configuring and managing local user accounts” on page 241
and
“Configuring users’ preferences” on page 243
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of resource profiles, go to Profile > Resource > Resource.
Figure 196: Viewing the list of resource profiles
Profile Name
Domain Name
The name of the profile.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
To configure a resource profile
1 Go to Profile > Resource > Resource.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 Configure the following:
Figure 197: Configuring a resource profile
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
329
Configuring authentication profiles Profile
Domain
Profile name
Disk quota (MB)
Select either the entire FortiMail unit (System) or name of a protected domain.
For more information, see
“About administrator account permissions & domains” on page 144 .
Enter the name of the profile.
Enter the maximum amount of FortiMail webmail disk space that you will allow to be consumed, or enter 0 to allow unlimited use.
Auto delete emails after
Enter the number of days after which the FortiMail unit will automatically delete email that is locally hosted.
User account status Mark the check box to e nable email user accounts using this resource profile.
Webmail access Mark the check box to enable email users’ access to FortiMail webmail.
4 Click OK.
To apply the resource profile, you must select it in a policy. For details, see
“Controlling email based upon the recipient” on page 272
and “Controlling email based upon IP addresses” on page 278
.
Configuring authentication profiles
The Authentication submenu enables you to configure the FortiMail unit to connect to an external SMTP server in order to authenticate email users.
FortiMail units support the following authentication methods:
• SMTP
• IMAP
• POP3
• RADIUS
• LDAP
Note: When the FortiMail unit is operating in server mode, only local and RADIUS authentication are available.
Note: LDAP profiles can configure many features other than authentication, and are not
located in the Authentication menu. For information on LDAP profiles, see “Configuring
In addition to authenticating email users for SMTP connections, SMTP profiles can be used to authenticate email users making webmail (HTTP or HTTPS) or POP3 connections
Depending on the mode in which your FortiMail unit is operating, you may be able to apply authentication profiles through incoming recipient-based policies, IP-based policies, and
“Controlling email based upon IP addresses” on page 278
, and
“Configuring and managing local user accounts” on page 241
.
For the general procedure of how to enable and configure authentication, see
“How to enable & configure authentication of email users” on page 332
.
To be able to access this part of the web-based manager, your administrator account’s:
330
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring authentication profiles
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of authentication profiles, go to Profile > Authentication.
Figure 198: Viewing the list of authentication profiles
Auth type
(drop-down list)
Profile Name
Auth Type
(column heading)
Domain Name
To filter the list of authentication profiles, either select which protocol to display, or select ALL to display all authentication profiles, regardless of their protocol.
The name of the profile.
The protocol used to connect to the authentication server, either SMTP,
POP3, IMAP, or RADIUS.
This column does not appear if the FortiMail unit is operating in server mode, which can only use RADIUS authentication profiles.
The entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144
.
To configure an authentication profile
1 Go to Profile > Authentication. The name of the tab, either Authentication or RADIUS, varies by whether or not the FortiMail unit is operating in server mode.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 Configure the following:
Figure 199: Configuring an authentication profile
Domain Select the entire FortiMail unit (System) or name of a protected domain.
For more information, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
331
Configuring authentication profiles Profile
Authentication type Select the protocol used to connect to the authentication server, either SMTP, POP3, IMAP, or RADIUS.
This drop-down list does not appear if the FortiMail unit is operating in server mode, which can only use RADIUS authentication profiles.
Profile name
Server name/IP
Server port
Server secret
Enter the name of the profile.
Names of existing profiles cannot be changed. Instead, delete the profile, then recreate it.
Enter the fully qualified domain name (FQDN) or IP address of a server that will be queried to authenticate email users if they authenticate to send email, or when they are accessing their personal quarantine.
Enter the port number on which the authentication server listens.
The default value varies by the protocol. You must change this value if the server is configured to listen on a different port number, including if the server requires use of SSL.
For example, the standard port number for SMTP is 25. However, for SMTP with SSL, the default port number is 465. Similarly,
IMAP is 143, while IMAP with SSL is 993; POP3 is 110, while
POP3 with SSL is 995; and RADIUS is 1812.
Enter the secret required by the RADIUS server. It must be identical to the secret that is configured on the RADIUS server.
This field appears only for RADIUS authentication profiles.
Server requires domain
Enable i f the authentication server requires that email users authenticate using their full email address (such as [email protected]) and not just the user name (such as user1).
Secure authentication Enable i f you want to use secure authentication to encrypt the passwords of email users when communicating with the server, and the server supports it.
This option is not available for RADIUS authentication profiles.
SSL
TLS
Enable i f you want to use secure socket layers (SSL) to encrypt communications between the FortiMail unit, and this server and the server supports it.
This option is not available for RADIUS authentication profiles.
Enable i f you want to use transport layer security (TLS) to authenticate and encrypt communications between the
FortiMail unit and this server, and the server supports it.
This option is not available for RADIUS authentication profiles.
4 Click Create.
To apply the authentication profile, you must select it in a policy. You may also need to
How to enable & configure authentication of email users
In general, to enable and configure email user authentication, you should complete the following:
1 If you want to require authentication for SMTP connections received by the FortiMail unit, examine the access control rules whose sender patterns match your email users to ensure that authentication is required (Authenticated) rather than optional (Any).
Additionally, verify that no access control rule exists that allows unauthenticated
connections. For details, see “Configuring access control rules” on page 262 .
332
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
2 For secure (SSL or TLS) authentication:
• Upload a local certificate. For details, see “Managing local certificates” on page 190 .
• Enable SMTP over SSL/TLS. For details, see
“Configuring the host name, port numbers, relay, mail queue, & DSN” on page 199 .
• If you want to configure TLS, create a TLS profile, and select it in the access control rules. For details, see
“Configuring TLS profiles” on page 370
and “Configuring access control rules” on page 262 .
• If the email user will use a personal certificate to log in to webmail or their perrecipient quarantine, define the certificate authority (CA) and the valid certificate for
that user. If OCSP is enabled, you must also configure a remote certificate
revocation authority. For details, see “Configuring PKI authentication” on page 248
,
“Managing certificate authority certificates” on page 195
, and “Managing OCSP server certificates” on page 197
.
3 If authentication will occur by querying an external authentication server rather than email user accounts locally defined on the FortiMail unit, configure the appropriate profile type, either:
• LDAP (see
“Configuring LDAP profiles” on page 333
)
• RADIUS (see
“Configuring authentication profiles” on page 330 )
4 For server mode, configure the email users and type their password, or select an LDAP
“Configuring resource profiles” on page 329 .
5 For gateway mode or transparent mode, select the authentication profile in the IPbased policy or in the incoming recipient-based that matches that email user and
“Controlling email based upon the recipient” on page 272
and “Controlling email based upon IP addresses” on page 278
.
For server mode, select the resource profile in the incoming recipient-based policy, and if users authenticate using an LDAP profile, select the LDAP profile. For details, see
“Controlling email based upon the recipient” on page 272 .
Configuring LDAP profiles
The LDAP submenu enables you to configure LDAP profiles which can query LDAP servers for authentication, email address mappings, and more.
Caution: Before using an LDAP profile, verify each LDAP query and connectivity with your
LDAP server. When LDAP queries do not match with the server’s schema and/or contents, unintended mail processing behaviors can result, including bypassing antivirus scans. For
.
LDAP profiles each contain one or more queries that retrieve specific configuration data, such as user groups, from an LDAP server. The LDAP profile list indicates which queries you have enabled in each LDAP profile.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
333
Configuring LDAP profiles Profile
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of LDAP profiles, go to Profile > LDAP > LDAP.
Figure 200: Viewing the list of LDAP profiles
334
Profile Name
Server
Port
Group
Auth
Alias
Routing
AS/AV
Address Map
Webmail
The name of the profile.
The domain name or IP address of the LDAP server.
The listening port of the LDAP server.
Indicates whether or not Group Query Options is enabled.
Indicates whether or not User Authentication Options is enabled.
Indicates whether or not User Alias Options is enabled.
Indicates whether or not Mail Routing Options is enabled.
Indicates whether or not AS/AV On/Off Options is enabled.
Indicates whether or not Address Mapping Options is enabled.
Indicates whether or not Enable webmail password change is enabled in this profile.
Indicates whether or not query result caching is enabled.
Cache
You can add an LDAP profile to define a set of queries that the FortiMail can use with an
LDAP server. You might create more than one LDAP profile if, for example, you have more than one LDAP server, or you want to configure multiple, separate query sets for the same
LDAP server.
After you have created an LDAP profile, LDAP profile options will appear in other areas of the FortiMail unit’s configuration. These options enable you to select the LDAP profile where you might otherwise create a reference to a configuration item stored locally on the
FortiMail unit itself. These other configuration areas will only allow you to select applicable
LDAP profiles — that is, those LDAP profiles in which you have enabled the query required by that feature. For example, if a feature requires a definition of user groups, you will only be able to select from those LDAP profiles where Group Query Options are enabled.
To configure an LDAP profile
1 Go to Profile > LDAP > LDAP.
2 Click New to add a profile, or click to select a profile that you want to modify, then click
Edit.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 201: Configuring an LDAP profile
Configuring LDAP profiles
Profile name
Server name/IP
Port
Fallback server name/IP
Port
Use secure connection
Enter the name of the LDAP profile.
This field is read-only if you are editing an existing LDAP profile.
Enter the fully qualified domain name (FQDN) or IP address of the LDAP server.
Enter the port number where the LDAP server listens.
The default port number varies by your selection in Use
secure connection: port 389 is typically used for non-secure
connections, and port 636 is typically used for SSL-secured
(LDAPS) connections.
Optional. Enter the fully qualified domain name (FQDN) or IP address of an alternate LDAP server that the FortiMail unit can query if the primary LDAP server is unreachable.
Enter the port number where the fallback LDAP server listens.
The default port number varies by your selection in Use
secure connection: port 389 is typically used for non-secure
connections, and port 636 is typically used for SSL-secured
(LDAPS) connections.
Select whether or not to connect to the LDAP server(s) using an encrypted connection.
• none: Use a non-secure connection.
• SSL: Use an SSL-secured (LDAPS) connection.
Note: If your FortiMail unit is deployed in server mode, and
you want to enable Enable webmail password change using
an LDAP server that uses a Microsoft ActiveDirectory-style schema, you must select SSL. ActiveDirectory servers require a secure connection for queries that change user passwords.
4 Click the arrow to expand User Query Options, and configure the query to retrieve the distinguished names (DN) of user objects by their email addresses.
For more information on recipient address verification by LDAP query, see “Recipient
Address Verification” on page 217
. For more information on automatically removing quarantine mailboxes for recipients that do not currently exist in the protected domain, see
“Automatic Removal of Invalid Quarantine Accounts” on page 219
. For more information on verifying unknown domains and forming domain associations by LDAP query, see
“Perform LDAP domain verification for unknown domains” on page 205
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
335
Configuring LDAP profiles
Figure 202: User Query Options
Profile
Schema
Base DN
Bind DN
Bind password
Browse
If your LDAP directory’s user objects use a common schema style:
• InetOrgPerson
• InetLocalMailRecipient
• MS Active Directory
• Lotus Domino select the schema style. This automatically configures the query string to match that schema style.
If your LDAP server uses any other schema style, select User
Defined, then manually configure the query string.
Enter the distinguished name (DN) of the part of the LDAP directory tree within which the FortiMail will search for user objects, such as ou=People,dc=example,dc=com.
User objects should be child nodes of this location.
Enter the bind DN, such as cn=FortiMailA,dc=example,dc=com, of an LDAP user
account with permissions to query the Base DN.
This field may be optional if your LDAP server does not require the FortiMail unit to authenticate when performing queries, and if you have enabled Allow unauthenticated bind. For details, see “Allow unauthenticated bind” on page 346 .
Enter the password of the Bind DN.
Click to browse the LDAP directory from the location that you
specified in Base DN, or, if you have not yet entered a
Base DN, beginning from the root of the LDAP directory tree.
Browsing the LDAP tree can be useful if you need to locate
locate it.
Before using Browse, first configure Server name/IP, Port,
Use secure connection, Bind DN, Bind password, and
Protocol version, then click Create or OK. These fields provide
minimum information required to establish the directory browsing connection.
336
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
LDAP user query
Scope
Derefer
Enter an LDAP query filter that selects a set of user objects from the LDAP directory.
The query filter string filters the result set, and should be based upon any attributes that are common to all user objects but also exclude non-user objects.
For example, if user objects in your directory have two distinguishing characteristics, their objectClass and mail attributes, the query filter might be:
(& (objectClass=inetOrgPerson) (mail=$m)) where $m is the FortiMail variable for a user's email address.
If the email address ($m) as it appears in the message header is different from the user’s email address as it appears in the
LDAP directory, such as when you have enabled recipient tagging, a query for the user by the email address ($m) may fail. In this case, you can modify the query filter to subtract prepended or appended text from the user name portion of the email address before performing the LDAP query. For example, to subtract -spam from the end of the user name portion of the recipient email address, you could use the query filter:
(& (objectClass=inetOrgPerson) (mail=$m$
{-spam})) where ${-spam} is the FortiMail variable for the tag to remove before performing the query. Similarly, to subtract spam- from the beginning of the user name portion of the recipient email address, you could use the query filter:
(& (objectClass=inetOrgPerson) (mail=$m$
{^spam-})) where ${^spam-} is the FortiMail variable for the tag to remove before performing the query.
For some schemas, such as Microsoft ActiveDirectory-style schemas, this query will retrieve both the user’s primary email address and the user’s alias email addresses. If your schema style is different, you may want to also configure User Alias
Options to resolve aliases. For details, see step
.
This option is preconfigured and read-only if you have
selected from Schema any schema style other than User
Defined.
For details on query syntax, refer to any standard LDAP query filter reference manual.
Select which level of depth to query, starting from Base DN.
• One level: Query only the one level directly below the
Base DN in the LDAP directory tree.
•
Subtree: Query recursively all levels below the Base DN in
the LDAP directory tree.
Select the method to use, if any, when dereferencing attributes whose values are references.
• Never: Do not dereference.
• Always: Always dereference.
• Search: Dereference only when searching.
• Find: Dereference only when finding the base search object.
5 If you want to define a group membership query, enable Group Query Options, click the arrow to expand its options, and configure the query.
For more information on determining user group membership by LDAP query, see
“Controlling email based upon the recipient” on page 272 or
“Controlling email based upon IP addresses” on page 278 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
337
Configuring LDAP profiles
Figure 203: Group Query Options
Profile
338
Use LDAP tree node as group
Enable to use objects within the Base DN of User Query Options
as if they were members of a user group object.
For example, your LDAP directory might not contain user group objects. In that sense, groups do not really exist in the LDAP directory. However, you could mimic a group’s presence by enabling this option to treat all users that are child objects of the
Base DN in User Query Options as if they were members of
such a group.
Group membership attribute Enter the name of the attribute, such as memberOf or gidNumber, whose value is the group number or DN of a group to which the user belongs.
This attribute must be present in user objects.
Whether the value must use common name, group number, or
DN syntax varies by your LDAP server schema. For example, if your user objects use both inetOrgPerson and posixAccount schema, user objects have the attribute gidNumber, whose value must be an integer that is the group
ID number, such as 10000.
Use group name with base
DN as group DN
Enable to specify the base distinguished name (DN) portion of the group’s full distinguished name (DN) in the LDAP profile. By specifying the group’s base DN and the name of its group name attribute in the LDAP profile, you will only need to supply the group name value when configuring each feature that uses this query.
For example, you might find it more convenient in each recipient-based policy to type only the group name, admins, rather than typing the full DN, cn=admins,ou=Groups,dc=example,dc=com. In this case,
you could enable this option, then configure Group base DN
(ou=Groups,dc=example,dc=com) and Group name
attribute (cn). When performing the query, the FortiMail unit
would assemble the full DN by inserting the common name that
you configured in the recipient-based policy between the Group
name attribute and the Group base DN configured in the LDAP
profile.
Note: Enabling this option is appropriate only if your LDAP server’s schema specifies that the group membership attribute’s value must use DN syntax. It is not appropriate if this value uses another type of syntax, such as a number or common name.
For example, if your user objects use both inetOrgPerson and posixAccount schema, user objects have the attribute gidNumber, whose value must be an integer that is the group
ID number, such as 10000. Because a group ID number does not use DN syntax, you would not enable this option.
Group base DN Enter the base DN portion of the group’s full DN, such as ou=Groups,dc=example,dc=com.
This option is available only if Use group name with base DN as
group DN is enabled.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Group name attribute
Look up group owner
Group owner attribute
Group owner address attribute
Enter the name of the attribute, such as cn, whose value is the group name of a group to which the user belongs.
This option is available only if Use group name with base DN as
group DN is enabled.
Enable to query the group object by its distinguished name (DN) to retrieve the DN of the group owner, which is a user that will receive that group’s quarantine reports. Using that user’s DN, the FortiMail unit will then perform a second query to retrieve that user’s email address, where the quarantine report will be sent.
For more information on sending quarantine reports to the group owner, see
“Quarantine Report Setting” on page 222
and
“Managing the personal quarantines” on page 63
.
Enter the name of the attribute, such as groupOwner, whose value is the distinguished name of a user object. You can configure the FortiMail unit to allow that user to be responsible for handling the group’s quarantine report.
If Look up group owner is enabled, this attribute must be present
in group objects.
Enter the name of the attribute, such as mail, whose value is the group owner’s email address.
If Look up group owner is enabled, this attribute must be present
in user objects.
6 If you want to define a user authentication query, enable User Authentication Options, click the arrow to expand its options, and configure the query.
.
Figure 204: User Authentication Options
Try UPN or mail address as bind DN
Try common name with base
DN as bind DN
Select to form the user’s bind DN by prepending the user name portion of the email address ($u) to the User Principle
Name (UPN, such as example.com).
By default, the FortiMail unit will use the mail domain as the
UPN. If you want to use a UPN other than the mail domain, enter that UPN in the field named Alternative UPN suffix. This can be useful if users authenticate with a domain other than the mail server’s principal domain name.
Select to form the user’s bind DN by prepending a common name to the base DN. Also enter the name of the user objects’ common name attribute, such as cn or uid.
This option is preconfigured and read-only if, in User Query
Options, you have selected from Schema any schema style
other than User Defined.
Search user and try bind DN Select to form the user’s bind DN by using the DN retrieved for that user by User Query Options.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
339
Configuring LDAP profiles Profile
7 If you want to define a user alias query, enable User Alias Options, click the arrow to expand its options, and configure the query.
Resolving aliases to real email addresses enables the FortiMail unit to send a single quarantine report and maintain a single quarantine mailbox at each user’s primary email account, rather than sending separate quarantine reports and maintaining separate quarantine mailboxes for each alias email address. For FortiMail units operating in server mode, this means that users need only log in to their primary account in order to manage their spam quarantine, rather than logging in to each alias account individually.
Figure 205: User Alias Options
340
Schema If your LDAP directory’s user alias objects use a common schema style:
• NisMailAlias
• MS Active Directory
• Lotus Domino select the schema style. This automatically configures the query string to match that schema style.
If your LDAP server uses any other schema style, select User
Defined, then manually configure the query string.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Base DN
Bind DN
Bind Password
Alias member attribute
Enter the distinguished name (DN) of the part of the LDAP directory tree within which the FortiMail will search for either alias or user objects.
User or alias objects should be child nodes of this location.
Whether you should specify the base DN of either user objects
or alias objects varies by your LDAP schema style. Schema
may resolve alias email addresses directly or indirectly (using references).
• Direct resolution: Alias objects directly contain one or more email address attributes, such as mail or rfc822MailMember, whose values are user email addresses such as [email protected], and that resolves the alias. The Base DN, such as ou=Aliases,dc=example,dc=com, should contain alias objects.
• Indirect resolution: Alias objects do not directly contain an email address attribute that can resolve the alias; instead, in the style of LDAP group-like objects, the alias objects contain only references to user objects that are
“members” of the alias “group.” User objects’ email address attribute values, such as [email protected], actually resolve the alias. Alias objects refer to user objects by possessing one or more “member” attributes whose value is the DN of a user object, such as uid=user,ou=People,dc=example,dc=com. The
FortiMail unit performs a first query to retrieve the distinguished names of “member” user objects, then performs a second query using those distinguished names to retrieve email addresses from each user object. The
Base DN, such as ou=People,dc=example,dc=com, should contain user objects.
Enter the bind DN, such as cn=FortiMailA,dc=example,dc=com, of an LDAP user account with permissions to query the Base DN.
This field may be optional if your LDAP server does not require the FortiMail unit to authenticate when performing queries, and if you have enabled Allow unauthenticated bind. For details, see “Allow unauthenticated bind” on page 346 .
Enter the password of the Bind DN.
Enter the name of the attribute, such as mail or rfc822MailMember, whose value is an email address to which the email alias resolves, such as [email protected].
This attribute must be present in either alias or user objects, as determined by your schema and whether it resolves aliases directly or indirectly. For more information, see “Base DN” on page 341 .
This option is preconfigured and read-only if, in User Alias
Options, you have selected from Schema any schema style
other than User Defined.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
341
Configuring LDAP profiles
Alias member query
Profile
Enter an LDAP query filter that selects a set of either user or email alias objects, whichever object class contains the
attribute you configured in Alias member attribute, from the
LDAP directory.
The query filter string filters the result set, and should be based upon any attributes that are common to all user/alias objects but also exclude non-user/alias objects.
For example, if user objects in your directory have two distinguishing characteristics, their objectClass and mail attributes, the query filter might be:
(& (objectClass=alias) (mail=$m)) where $m is the FortiMail variable for a user's email address.
If the email address ($m) as it appears in the message header is different from the alias email address as it appears in the
LDAP directory, such as when you have enabled recipient tagging, a query for the alias by the email address ($m) may fail. In this case, you can modify the query filter to subtract prepended or appended text from the user name portion of the email address before performing the LDAP query. For example, to subtract -spam from the end of the user name portion of the recipient email address, you could use the query filter:
(& (objectClass=alias) (mail=$m${-spam})) where ${-spam} is the FortiMail variable for the tag to remove before performing the query. Similarly, to subtract spam- from the beginning of the user name portion of the recipient email address, you could use the query filter:
(& (objectClass=alias) (mail=$m${^spam-})) where ${^spam-} is the FortiMail variable for the tag to remove before performing the query.
Whether you should configure this query filter to retrieve user or alias objects depends on whether your schema resolves email addresses directly or indirectly (using references).For more information on direct vs. indirect alias resolution, see
“Base DN” on page 341 .
If alias objects in your schema provide direct resolution, configure this query string to retrieve alias objects. Depending on your schema style, you may be able to do this either using the user name portion of the alias email address ($u), or the entire email address ($m). For example, for the email aliases [email protected] and [email protected], if your
LDAP directory contains alias objects distinguished by cn: finance and cn: admin, respectively, this query string could be cn=$u.
If alias objects in your schema provide indirect resolution, configure this query string to retrieve user objects by their distinguished name, such as distinguishedName=$b or
objects, and configure Group Member Attribute to be the name of the alias object attribute, such as member, whose value is the distinguished name of a user object.
For more information on required object types and their attributes, see
“Preparing your LDAP schema for FortiMail
This option is preconfigured and read-only if, in User Alias
Options, you have selected from Schema any schema style
other than User Defined.
For details on query syntax, refer to any standard LDAP query filter reference manual.
342
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
User group expansion In advance
Group member attribute
Group member query
Scope
Enable if your LDAP schema resolves email aliases indirectly.
For more information on direct vs. indirect resolution, see
“Base DN” on page 341 .
When this option is disabled, alias resolution occurs using
one query. The FortiMail unit queries the LDAP directory using the Base DN and the Alias member query, and then uses the value of each Alias Member Attribute to resolve the alias.
When this option is enabled, alias resolution occurs using two queries:
1 The FortiMail unit first performs a preliminary query using
query.
2 The FortiMail unit performs a second query using the distinguished names from the preliminary query (instead of the
Base DN) and the Alias member query, and then uses the
value of each Alias member attribute to resolve the alias.
The two-query approach is appropriate if, in your schema, alias objects are structured like group objects and contain references in the form of distinguished names of member user objects, rather than directly containing email addresses to which the alias resolves. In this case, the FortiMail unit must first “expand” the alias object into its constituent user objects before it can resolve the alias email address.
This option is preconfigured and read-only if, in User Alias
Options, you have selected from Schema any schema style
other than User Defined.
Enter the name of the attribute, such as member, whose value is the DN of a user object.
This attribute must be present in alias objects only if they do
not contain an email address attribute specified in Alias
This option is preconfigured and read-only if, in User Alias
Options, you have selected from Schema any schema style
other than User Defined. If you have selected User Defined,
this option is available only if User group expansion In
Enter an LDAP query filter that selects a set of alias objects, represented as a group of member objects in the LDAP directory.
The query filter string filters the result set, and should be based upon any attributes that are common to all alias objects but also exclude non-alias objects.
For example, if alias objects in your directory have two distinguishing characteristics, their objectClass and proxyAddresses attributes, the query filter might be:
(&(objectClass=group)
(proxyAddresses=smtp:$m)) where $m is the FortiMail variable for an email address.
This option is preconfigured and read-only if, in User Alias
Options, you have selected from Schema any schema style
other than User Defined. If you have selected User Defined,
this option is available only if User group expansion In
For details on query syntax, refer to any standard LDAP query filter reference manual.
Select which level of depth to query, starting from Base DN.
• One level: Query only the one level directly below the
Base DN in the LDAP directory tree.
• Subtree: Query recursively all levels below the Base DN in the LDAP directory tree.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
343
Configuring LDAP profiles Profile
Derefer
Max alias expansion level
Select the method to use, if any, when dereferencing attributes whose values are references.
• Never: Do not dereference.
• Always: Always dereference.
• Search: Dereference only when searching.
• Find: Dereference only when finding the base search object.
Enter the maximum number of alias nesting levels that aliases the FortiMail unit will expand.
8 If you want to define a mail routing query, enable Mail Routing Options, click the arrow to expand its options, and configure the query.
Note: The Mail Routing Options query occurs after recipient tagging processing. If you have enabled recipient tagging, the Mail Routing Options query will then be based on the tagged recipient address. If the tagged email address does not exist for the user in the
LDAP directory, you may prefer to transform the recipient address by using the User Alias
Options query.
For more information on routing email by LDAP query, see
“Mail routing LDAP profile” on page 219 .
Figure 206: Mail Routing Options
344
Mail host attribute Enter the name of the attribute, such as mailHost, whose value is the fully qualified domain name (FQDN) or IP address of the email server that stores email for the user’s email account.
This attribute must be present in user objects.
Mail routing address attribute Enter the name of the attribute, such as mailRoutingAddress, whose value is the email address of a deliverable user on the email server, also known as the mail host.
For example, a user may have many aliases and external email addresses that are not necessarily known to the email server. These addresses would all map to a real email account
(mail routing address) on the email server (mail host) where the user’s email is actually stored.
A user’s recipient email address located in the envelope or header portion of each email will be rewritten to this address.
This attribute must be present in user objects.
9 If you want to define an antispam and antivirus processing option query, enable AS/AV
On/Off Options, click the arrow to expand its options, and configure the query.
Note: If the AS/AV On/Off Options query fails, the FortiMail unit will instead use the antispam and antivirus processing settings defined in the profile for that policy.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Figure 207: AS/AV On/Off Options
AntiSpam on/off attribute
AntiVirus on/off attribute
Enter the name of the attribute, such as antispam, whose value indicates whether or not to perform antispam processing for that user. Multiple value syntaxes are permissible. For details, see “LDAP directory requirements for each FortiMail
LDAP profile query” on page 350 .
This attribute must be present in user objects.
Enter the name of the attribute, such as antivirus, whose value indicates whether or not to perform antivirus processing for that user. Multiple value syntaxes are permissible. For details, see “LDAP directory requirements for each FortiMail
LDAP profile query” on page 350 .
This attribute must be present in user objects.
10 Click the arrow to expand Address Mapping Options.
Mappings usually should not translate an email address into one that belongs to an unprotected domain. However, unlike locally defined address mappings, this restriction is not enforced for mappings defined on an LDAP server. For more information on the behavior of address mappings, see
“Configuring address mappings” on page 255 .
After configuring a profile with this query, you must select it in order for the FortiMail
unit to use it. For details, see “LDAP user alias / address mapping profile” on page 219 .
Alternatively, you can configure email address mappings on the FortiMail unit itself. For
details, see “Configuring address mappings” on page 255
.
Figure 208: Address Mapping Options
Internal address attribute
External address attribute
Enter the name of the LDAP attribute, such as internalAddress, whose value is an email address in the same or another protected domain.
This email address will be rewritten into the value of the external address attribute according to the match conditions and effects described in
Table 29, “Match evaluation and rewrite behavior for email address mappings,” on page 256
.
The name of this attribute may vary by the schema of your
LDAP directory.
Enter the name of the attribute, such as externalAddress, whose value is an email address in the same or another protected domain.
This email address will be rewritten into the value of the internal address attribute according to the match conditions and effects described in
Table 29, “Match evaluation and rewrite behavior for email address mappings,” on page 256
.
The name of this attribute may vary by the schema of your
LDAP directory.
11 Click the arrow to expand Advanced Options.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
345
Configuring LDAP profiles
Figure 209: Advanced Options
Profile
346
Timeout
Protocol version Select the LDAP protocol version used by the LDAP server.
Allow unauthenticated bind Enable to perform queries in this profile without supplying a bind DN and password for the directory search.
Many LDAP servers require LDAP queries to be authenticated using a bind DN and password. However, if your LDAP server does not require the FortiMail unit to authenticate before performing queries, you may enable this option.
Enable cache Enable to cache LDAP query results.
Caching LDAP queries can introduce a delay between when you update LDAP directory information and when the FortiMail unit begins using that new information, but also has the benefit of reducing the amount of LDAP network traffic associated with frequent queries for information that does not change frequently.
If this option is enabled but queries are not being cached, inspect the value of TTL. Entering a TTL value of 0 effectively disables caching.
TTL Enter the amount of time, in minutes, that the FortiMail unit will cache query results. After the TTL has elapsed, cached results expire, and any subsequent request for that information causes the FortiMail unit to query the LDAP server, refreshing the cache.
The default TTL value is 1440 minutes (one day). The maximum value is 10080 minutes (one week). Entering a value of 0 effectively disables caching.
This option is applicable only if Enable cache is enabled.
Enable webmail password change
Password schema
Enter the maximum amount of time in seconds that the
FortiMail unit will wait for query responses from the LDAP server.
Enable if you want to allow FortiMail webmail users to change their password.
Select your LDAP server’s user schema style, either Openldap or Active Directory.
12 Click Create.
The LDAP profile appears in the LDAP profile list. To apply it, select the profile in features that support LDAP queries, such as protected domains and policies.
Before using the LDAP profile in other areas of the configuration, verify the configuration of each query that you have enabled in the LDAP profile. Incorrect query configuration can result in unexpected mail processing behavior. For information on testing queries, see
“Testing LDAP profile queries” on page 355
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Preparing your LDAP schema for FortiMail LDAP profiles
FortiMail units can be configured to consult an LDAP server for many things that you might otherwise normally have to configure on the FortiMail unit itself, such as user authentication, group membership, mail routing, and other features. Especially if you have a large amount of users and groups already defined on an LDAP directory, you may find it more convenient to query those existing definitions than to recreate the definition of those same users locally on the FortiMail unit. To accomplish this, you would configure an LDAP profile, then select that LDAP profile in other areas of the configuration that should use its
LDAP queries.
LDAP profiles require compatible LDAP server directory schema and contents. Your LDAP server configuration may already be compatible. However, if your LDAP server configuration does not contain required information in a schema acceptable to LDAP profile queries, you may be required to modify either or both your LDAP profile and LDAP directory schema.
Caution: Verify your LDAP server’s configuration for each query type that you enable and configure. For example, if you enable mail routing queries, verify connectivity and that each user object in the LDAP directory includes the attributes and values required by mail routing. Failure to verify enabled queries can result in unexpected mail processing behavior.
Using common schema styles
Your LDAP server schema may require no modification if:
• your LDAP server already contains all information required by the LDAP profile queries you want to enable
• your LDAP server uses a common schema style, and a matching predefined LDAP query configuration exists for that schema style
If both of those conditions are true, your LDAP profile configuration may also be very minimal. Some queries in LDAP profiles contain schema options that automatically configure the query to match common schema styles such as IBM Lotus Domino,
Microsoft ActiveDirectory (AD), and OpenLDAP. If you will only enable those queries that have schema options, it may be sufficient to select your schema style for each query.
For example, your LDAP server might use an OpenLDAP-style schema, where two types of user object classes exist, but both already have mail and userPassword attributes.
Your FortiMail unit is in gateway mode, and you want to use LDAP queries to use users’ email addresses to query for authentication. In this scenario, it may be sufficient to:
1 In the LDAP profile, enter the domain name or IP address of the LDAP server.
2 Configure the LDAP profile queries:
• In User Query Options, select from Schema which OpenLDAP schema your user
objects follow: either InetOrgPerson or InetLocalMailRecipient. Also enter the
Base DN, Base DN, and Bind password to authenticate queries by the FortiMail unit
and to specify which part of the directory tree to search.
• In User Authentication Options, enable the query with the option to Search user and
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
347
Configuring LDAP profiles
Figure 210: Example LDAP profile configuration for user email address and authentication queries to an OpenLDAP-style directory
Profile
348
3 Configure mail domains and policies to use the LDAP profile to authenticate users and perform recipient verification.
Using other schema styles
If your LDAP server’s schema is not one of the predefined common schema styles, or if you want to enable queries that require information that does not currently exist in your directory, you may need to adapt either or both your LDAP server and LDAP profile query configuration.
Note: Before modifying your LDAP directory, verify that changes will be compatible with other applications using the directory. You may prefer to modify the LDAP profile query and/or add new attributes than to modify existing structures that are used by other applications, in order to reduce the likelihood of disruption to other applications. For instructions on modifying schema or setting attribute values, consult the documentation for your specific LDAP server.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
The primary goal when modifying your LDAP directory is to provide, in some way that can be retrieved by LDAP profile queries, the information required by FortiMail features which can use LDAP profiles. Depending on the LDAP profile queries that you enable, you may need to add to your LDAP directory:
• user objects
• user group objects
• email alias objects
Keep in mind that for some schema styles, such as that of Microsoft ActiveDirectory, user group objects may also play a double role as both user group objects and email alias objects. For the purpose of FortiMail LDAP queries, email alias objects can be any object that can be used to expand email aliases into deliverable email addresses, which are sometimes called distribution lists.
For each of those object types, you may also need to add required attributes in a syntax compatible with the FortiMail features that uses those attributes.
At a minimum, your LDAP directory must have user objects that each contain an email address attribute, and the value of that email address attribute must use full email address syntax (e.g. mail: [email protected]). This attribute is required by User Query
Options, a query which is required in every LDAP profile.
Many other aspects of LDAP profiles are flexible enough to query for the required information in more than one way. It may be sufficient to modify the query strings and other fields in the LDAP profile to match your individual LDAP directory.
For example, the purpose of the User Query Options is to find the distinguished name
(DN) of user objects by their email addresses, represented by the FortiMail variable $m.
Often user objects can be distinguished by the fact that they are the only records that contain the attribute-value pair objectClass: User. If the class of user name objects in your LDAP directory is not objectClass: User but instead objectClass: inetOrgPerson, you could either modify:
• the LDAP profile’s user query to request user objects as they are denoted on your particular server, using objectClass=inetOrgPerson; for example, you might modify the user query from:
(&(objectClass=User)(mail=$m)) to be:
(&(objectClass=inetOrgPerson)(mail=$m))
• the LDAP server’s schema to match the queries’ expected structure, where user objects are defined by objectClass=User
Alternatively, perhaps there are too many user objects, and you prefer to instead retrieve only those user objects belonging to a specific group number. In this case, you might modify the query string from:
(&(objectClass=User)(mail=$m)) to be:
(&(objectClass=User)(gidNumber=102)(mail=$m))
You can use any attribute-value pairs to filter the query result set, as long as they are unique and common to all objects in your intended result set.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
349
Configuring LDAP profiles Profile
For example, most directories do not contain an antivirus processing switch attribute for each user. However, FortiMail units can perform antivirus processing, which can be switched off or on depending on the results from an LDAP query. The FortiMail unit expects the query to return a value that may use Boolean syntax (TRUE or FALSE) that reflects whether or not, respectively, to perform antivirus processing. In this case, you would add to user objects in your LDAP directory an antivirus attribute whose value is a
Boolean value.
The following table indicates expected object types, attribute names, and value syntax, as well as query results, for each LDAP profile query. Attributes listed should be present, but their names may vary by schema. Attributes that do not have a default name require that you configure them in both your LDAP profile and your LDAP directory’s schema.
Table 32: LDAP directory requirements for each FortiMail LDAP profile query
Object type
User Query Options
User Alias Options
Email alias object classes such as nisMailAlias, or user objects from
depending on whether your schema resolves email aliases directly or indirectly, respectively. For details, see
“Base DN” on page 341 .
Attribute
User object classes such as inetOrgPerson, inetLocalMailRec ipient, User, dominoPerson.
Group Query Options
gidNumber or memberOf
A user’s email address.
Query compares the email address to the value of this attribute to find the matching user, and retrieve that user’s distinguished name (DN), which is the basis for most other
LDAP profile queries.
User group object classes such as group or groupOfNames. groupOwner
User Authentication Options
Varies by schema.
Typically is either a group number or the distinguished name (DN) of the group.
A user’s email address.
A user object’s
DN.
userPassword Any.
Query retrieves the group name for
any user defined by User Query
Query uses the DN retrieved from groupOwner to retrieve the email address of the user specified by that
DN.
Query retrieves the DN of a user object from the group defined in gidNumber or memberOf.
Query verifies user identity by binding with the user password for
any user defined by User Query
rfc822MailMe mber (for alias objects) or mail (for user objects)
Value
Either the user name portion of an email address
(e.g. user; for alias objects), or the entire email address (e.g. user@example.
com; for user objects).
Query result
Query expands an alias to one or more user email addresses.
If the alias is resolved directly, this query retrieves the email addresses from the alias object itself. If the alias is resolved indirectly, this query first queries the alias object for member attributes, then uses the
DN of each member in a second query to retrieve the email addresses of those user objects.
For details, see “Base DN” on page 341 .
350
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Table 32: LDAP directory requirements for each FortiMail LDAP profile query
User group object classes such as group or groupOfNames.
User groups are not inherently associated with email aliases, but for some schemas, such as Microsoft
ActiveDirectory, group objects play the role of email alias objects, and are used to indirectly resolve email aliases. For details, see
“Base DN” on page 341 .
member
Mail Routing Options
mailHost
A user object’s
DN, or the DN of another alias object.
Query retrieves the DN of a user object that is a member of the group.
This attribute is required only if aliases resolve to user email addresses indirectly. For details, see “Base DN” on page 341 .
mailRoutingA ddress
A fully qualified domain name
(FQDN) or IP address.
A user’s email address for a user account whose email is physically stored on mailHost.
Query retrieves the fully qualified domain name (FQDN) or IP address of the mail server — sometimes also called the mail host — that stores email for any user defined by
Query retrieves the email address for a real account physically stored on mailHost for any user defined
AS/AV On/Off Options
No default attribute name.
No default attribute name.
Varies by schema.
May be:
• TRUE, YES, 1,
ENABLE or
ENABLED (on)
• FALSE, NO, 0,
DISABLE, or
DISABLED, or any other value not associated with “on” (off)
Varies by schema.
May be:
• TRUE, YES, 1,
ENABLE or
ENABLED (on)
• FALSE, NO, 0,
DISABLE, or
DISABLED, or any other value not associated with “on” (off)
Query retrieves whether or not to perform antivirus processing for
any user defined by User Query
Query retrieves whether or not to perform antispam processing for
any user defined by User Query
Address Mapping Options
No default attribute name.
No default attribute name.
A user’s internal email address.
A user’s external email address.
Query retrieves the user’s internal email address
Query retrieves the user’s external email address.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
351
Configuring LDAP profiles Profile
Table 32: LDAP directory requirements for each FortiMail LDAP profile query
Enable webmail password change
userPassword Any.
Query, upon successful bind using the existing password, changes the password for any user defined by
Each LDAP profile query filter string may indicate expected value syntax by the FortiMail variables used in the query filter string.
• $m: the query filter expects the attribute’s value to be a full email address
• $u: the query filter expects the attribute’s value to be a user name
• $b: the query filter expects the attribute’s value to be a bind DN
The following example illustrates a matching LDAP directory and LDAP profile. Labels indicate the part of the LDAP profile that is configured to match the directory schema.
352
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 211: Example compatible LDAP directory and LDAP profile
Configuring LDAP profiles
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
353
Configuring LDAP profiles Profile
354
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
Testing LDAP profile queries
After you have created an LDAP profile, you should test each enabled query in the LDAP profile to verify that the FortiMail unit can connect to the LDAP server, that the LDAP directory contains the required attributes and values, and that the query configuration is correct.
When testing a query in an LDAP profile, you may encounter error messages that indicate failure of the query and how to fix the problem.
Table 33: Possible failure messages from LDAP query tests
Failure Message
Empty input
Failed to bind with bind DN and password
Meaning & Solution
The query cannot be performed until you provide the information required by the query.
The FortiMail unit successfully connected to the LDAP server, but could not authenticate in order to perform the query. If the server permits anonymous
queries, the Bind DN and Bind password you specified in User Query
Optionsshould be blank, and Allow unauthenticated bind should be enabled.
Otherwise, you must enter a valid bind DN and its password.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
355
Configuring LDAP profiles Profile
Table 33: Possible failure messages from LDAP query tests
Unable to found user DN that matches mail address
Unable to find
LDAP group for user
Failed to bind
Unable to find mail alias
The FortiMail unit successfully connected to the LDAP server, and, if configured, bound, but could not find a user whose email address attribute matched that value. The user may not exist on the LDAP server in the
Base DN and using the query filter you specified in User Query Options, or
the value of the user’s email address attribute does not match the value that you supplied in Mail address.
The FortiMail unit successfully located a user with that email address, but their group membership attribute did not match your supplied value. The group membership attribute you specified in Group Query Options may not exist, or the value of the group membership attribute may not match the value that you supplied in Group DN. If the value does not match, verify that you have supplied the Group DN according to the syntax expected by both your LDAP server and your configuration of Group Query Options.
The FortiMail unit successfully located a user with that email address, but the user’s bind failed and the FortiMail unit was unable to authenticate the user. Binding may fail if the value of the user’s password attribute does not match the value that you supplied in Old password. If this error message appears when testing Change Password, it also implies that the query failed to change the password.
The FortiMail unit was unable to find the email alias. The email address alias may not exist on the LDAP server in the Base DN and using the query filter you specified in User Alias Options, or the value of the alias’ email address attribute does not match the value that you supplied in Mail
address.
To verify User Query Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose User Query Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select User.
Figure 212: LDAP Query Test: User
356
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record.
To verify Group Query Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose Group Query Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query. Fields displayed in the window vary by whether or not Use group name with base DN as group DN is enabled in Group Query Options.
4 From Select query type, select Group.
Figure 213: LDAP Query Test: Group ( Use group name with base DN as group DN is disabled)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
357
Configuring LDAP profiles Profile
Figure 214: LDAP Query Test: Group ( Use group name with base DN as group DN is enabled)
358
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 Either the Group DN or Group Name field appears. If Group DN appears, enter the value of the user’s group membership attribute. If Group Name appears, enter only the group name portion of the value of the user’s group membership attribute.
For example, a Group DN entry with valid syntax could be either:
• 10000
• admins
• cn=admins,ou=People,dc=example,dc=com but a Group Name entry with valid syntax would be admins.
Valid syntax varies by your LDAP server’s schema and by whether Use group name
with base DN as group DN is enabled, but is identical to what you should enter when using this LDAP profile and entering the group name elsewhere in the FortiMail configuration, such as for a recipient-based policy.
7 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record and find the group to which the user belongs.
To verify Group Query Options’ group owner
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose Group Query Options’ group owner query you want to test.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring LDAP profiles
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query. Fields displayed in the window vary by whether or not Use group name with base DN as group DN is enabled in Group Query Options.
4 From Select query type, select Group Owner.
Figure 215: LDAP Query Test: Group Owner ( Use group name with base DN as group
DN is disabled)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
359
Configuring LDAP profiles Profile
Figure 216: LDAP Query Test: Group Owner ( Use group name with base DN as group
DN is enabled)
360
5 Either the Group DN or Group Name field appears. If Group DN appears, enter the distinguished name of the group object. If Group Name appears, enter only the group name portion of the distinguished name of the group object.
For example, a Group DN entry with valid syntax would be cn=admins,ou=People,dc=example,dc=com, but a Group Name entry with valid syntax would be admins.
Valid syntax varies by your LDAP server’s schema and by whether Use group name
with base DN as group DN is enabled, but is identical to what you should enter when using this LDAP profile and entering the group name elsewhere in the FortiMail configuration, such as for a recipient-based policy.
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the group record and find the group owner and their email address.
To verify User Authentication Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose User Authentication Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select Authentication.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 217: LDAP Query Test: Authentication
Configuring LDAP profiles
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 In Password, enter the current password for that user.
7 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record, or binding to authenticate the user.
To verify User Alias Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose User Alias Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select Alias.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
361
Configuring LDAP profiles
Figure 218: LDAP Query Test: Alias
Profile
5 In Mail address, enter the email address alias of a user on the LDAP server, such as [email protected].
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the alias record, or binding to authenticate the user.
To verify Mail Routing Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose Mail Routing Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select Mail Routing.
362
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 219: LDAP Query Test: Mail Routing
Configuring LDAP profiles
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record and find the mail host and mail routing address for that user.
To verify AS/AV On/Off Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose AS/AV On/Off Options (antispam and antivirus preference) query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select ASAV.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
363
Configuring LDAP profiles
Figure 220: LDAP Query Test: ASAV
Profile
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record and find the antispam and antivirus processing preferences for that user.
To verify Address Mapping Options
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose Address Mapping Options query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select Address Mapping.
364
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile
Figure 221: LDAP Query Test: Address Mapping
Configuring LDAP profiles
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
6 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record and find the internal and external email addresses for that user.
To verify the webmail password change query
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose webmail password change query you want to test.
3 Click Test LDAP Query.
A pop-up window appears allowing you to test the query.
4 From Select query type, select Change Password.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
365
Configuring LDAP profiles
Figure 222: LDAP Query Test: Change Password
Profile
366
5 In Mail address, enter the email address of a user on the LDAP server, such as [email protected].
Caution: Only use an email account whose password it is acceptable to change, and make note of the new password. Verifying the Webmail Password Options query configuration performs a real password change, and does not restore the previous password after the query has been verified.
6 In Password, enter the current password for that user.
7 In New Password, enter the new password for that user.
8 Click Test.
The FortiMail unit performs the query, and displays either success or failure for each operation in the query, such as the search to locate the user record, binding to authenticate the password change, and the password change operation itself.
Clearing the LDAP profile cache
You can clear the FortiMail unit’s cache of query results for any LDAP profile.
This may be useful after, for example, you have updated parts of your LDAP directory that are used by that LDAP profile, and you want the FortiMail unit to discard outdated cached query results and reflect changes to the LDAP directory. After the cache is emptied, any subsequent request for information from that LDAP profile causes the FortiMail unit to query the updated LDAP server, refreshing the cache.
To clear the LDAP query cache
1 Go to Profile > LDAP > LDAP.
2 Double-click the LDAP profile whose query cache you want to clear.
3 Click Test LDAP Query.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring dictionary profiles
4 From Select query type, select Clear Cache.
A warning appears at the bottom of the window, notifying you that the cache for this
LDAP profile will be cleared if you proceed. All queries will therefore be new again, resulting in decreased performance until the query results are again cached.
5 Click Ok.
The FortiMail unit empties cached LDAP query responses associated with that LDAP profile.
Configuring dictionary profiles
The Profiles tab enables you to configure dictionary profiles.
Unlike banned words, dictionary terms are UTF-8 encoded, and may include characters other than US-ASCII characters, such as é or ñ.
Dictionary profiles can be grouped or used individually by antispam or content profiles to detect spam, banned content, or content that requires encryption to be applied. For more information on content profiles and antispam profiles, see
“Configuring antispam profiles and antispam action profiles” on page 297 and
“Configuring content profiles and content action profiles” on page 318 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of dictionary profiles, go to Profile > Dictionary > Dictionary.
Figure 223: Viewing the list of dictionary profiles
To view the patterns defined in a dictionary profile, double click the profile name or select the profile and then click Edit.
Figure 224: viewing the patterns in a dictionary profile
To configure a dictionary profile
1 Go to Profile > Dictionary > Dictionary.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
367
Configuring dictionary profiles
2 Either click New to add a profile, or double-click on a profile to modify it.
3 In Name, type the name of the profile.
4 Click New to add a new pattern entry or double click an entry to modify it.
A popup window appears, allowing you to configure the following:
Figure 225: Configuring a dictionary profile
Profile
368
Pattern
Pattern Type
Type a word or phrase that you want the dictionary to match, expressed either verbatim, with wild cards, or as a regular expression.
Regular expressions do not require slash ( / ) boundaries. For example, enter: v[i1]agr?a
Matches are case insensitive and can occur over multiple lines as if the word were on a single line. (That is, Perl-style match modifier options i and s are in effect.)
The FortiMail unit will convert the encoding and character set into
UTF-8, the same encoding in which dictionary patterns are stored, before evaluating an email for a match with the pattern. Because of this, your pattern must match the UTF-8 string, not the originally encoded string. For example, if the original encoded string is:
=?iso-8859-1?B?U2UgdHJhdGEgZGVsIHNwYW0uCg==?= the pattern must match:
Se trata del spam.
Entering the pattern *iso-8859-1* would not match.
Select either:
•
Wildcard: Pattern is verbatim or uses only simple wild cards (? or
*).
•
Regex: Pattern is a Perl-style regular expression.
Pattern Weight Enter a number by which an email’s dictionary match score will be incremented for each word or phrase it contains that matches this pattern.
The dictionary match score may be used by content monitor profiles to determine whether or not to apply the content action. For more information, see
“Minimum dictionary score” on page 308
.
Pattern Max Weight Enter the maximum by which matches of this pattern can contribute to an email’s dictionary match score.
This option applies only if Enable Pattern Max Weight Limit is enabled.
Enable Pattern Max
Weight Limit
Search Header
Enable if the pattern must not be able to increase an email’s dictionary match score more than the amount configured in Pattern Max Weight.
Enable to match occurrences of the pattern when it is located in an email’s message headers, including the subject line.
The FortiMail unit uses the full header string, including the header name and value, to match the pattern. Therefore, when you define the pattern, you can specify both the header name and value. For example, such a pattern entry as from: .*@example.com.* will block all the email messages with the From header as [email protected].
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring dictionary profiles
Search Body Enable to match occurrences of the pattern when it is located in an email’s message body.
5 Click OK.
6 After the pattern entry is created, you can edit or delete it by selecting it and then
clicking the Edit or Delete icon.
To apply a dictionary, in an antispam profile or content profile, either select it individually or select a dictionary group that contains it. For more information, see
“Configuring dictionary groups” on page 369 ,
“Configuring antispam profiles” on page 297
, and “Configuring content profiles” on page 318
.
Configuring dictionary groups
The Group tab enables you to create groups of dictionary profiles.
Dictionary groups can be useful when you want to use multiple dictionary profiles during the same scan.
For example, you might have several dictionaries of prohibited words — one for each language — that you want to use to enforce your network usage policy. Rather than combining the dictionaries or creating multiple policies and multiple content profiles to apply each dictionary profile separately, you could simply group the dictionaries, then select that group in the content monitor profile.
Before you can create a dictionary group, you must first create one or more dictionary profiles. For more information about dictionary profiles, see
“Configuring dictionary profiles” on page 367 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of dictionary groups, go to Profile > Dictionary > Group.
Figure 226: Viewing the list of dictionary groups
Group Name The name of the dictionary group or dictionary group item.
To configure a dictionary group
1 Go to Profile > Dictionary > Group.
2 Either click New to add a profile, or double-click to select a profile that you want to
modify.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
369
Configuring security profiles
Figure 227: Configuring a dictionary group
Profile
3 In Group name, enter the name of the dictionary group.
4 In the Available dictionaries area, select one or more dictionaries that you want to include in the dictionary group, then click Add.
The dictionaries move to the Members area.
5 Click Create.
To apply a dictionary group, select it instead of a dictionary profile when configuring an antispam profile or content profile. For details, see
“Configuring antispam profiles” on page 297
and “Configuring content profiles” on page 318 .
Configuring security profiles
The Security submenu enables you to create transport layer security (TLS) profiles, encryption profiles, and certificate bindings.
This topic includes:
•
•
Configuring encryption profiles
•
Configuring certificate bindings
Configuring TLS profiles
The TLS tab enables you to create TLS profiles, which contain settings for TLS-secured connections.
TLS profiles, unlike other types of profiles, are applied through access control rules and message delivery rules, not policies. For more information, see
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of TLS profiles, go to Profile > Security > TLS.
370
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring security profiles
Figure 228: Viewing the list of TLS profiles
Profile Name
TLS Level
Action On Failure
The name of the profile.
The security level of the TLS connection.
• None: Disables TLS. Requests for a TLS connection will be ignored.
• Preferred: Allow a simple TLS connection, but do not require it.
Data is not encrypted, nor is the identity of the server validated with a certificate.
• Encrypt: Requires a basic TLS connection. Failure to negotiate a TLS connection results in the connection being rejected according to the Action on failure setting.
• Secure: Requires a certificate-authenticated TLS connection.
CA certificates must be installed on the FortiMail unit before they can be used for secure TLS connections. For information on
installing CA certificates, see “Managing certificate authority certificates” on page 195 .
Indicates the action the FortiMail unit takes when a TLS connection cannot be established, either:
• Temporarily Fail: Reply to the SMTP client with a code indicating temporary failure.
• Fail: Reject the email and reply to the SMTP client with SMTP reply code 550.
This option does not apply and will be empty for profiles whose TLS
Level is Preferred.
To configure a TLS profile
1 Go to Profile > Security > TLS.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 In Profile name, enter the name of the profile.
4 From TLS level, select the security level of the TLS profile:
• None: Disables TLS. Requests for a TLS connection will be ignored.
• Preferred: Allows a simple TLS connection, but does not require it. Data is not encrypted, nor is the identity of the server validated with a certificate.
• Encrypt: Requires a basic TLS connection. Failure to negotiate a TLS connection
results in the connection being rejected according to the Action on failure setting.
• Secure: Requires a certificate-authenticated TLS connection. CA certificates must be installed on the FortiMail unit before they can be used for secure TLS connections.
The availability of other options varies by your selection in TLS level.
5 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
371
Configuring security profiles
Figure 229: Configuring a TLS profile
Profile
372
Action on failure
Check CA issuer
CA issuer
Lookup CA
Check certificate subject
Certificate subject
Check encryption strength
Select whether to fail or temporarily fail if a TLS connection with the parameters described in the TLS profile cannot be established.
This option does not appear if TLS level is Preferred.
Enable and enter a string on the CA issuer field. The
FortiMail unit will compare the string in the CA issuer field
with the field with that same name in the installed CA certificates.
This option appears only if TLS level is Secure.
Select the type of match required when the FortiMail unit compares the string in the CA Issuer field and the same field in the installed CA certificates. For more information on
CA certificates, see
“Managing certificate authority certificates” on page 195
.
Check CA issuer must be enabled for CA issuer to have
any effect.
This option appears only if TLS level is Secure.
To populate the CA issuer field with text from a CA
certificate’s CA Issuer, select the name of a CA certificate that you have uploaded to the FortiMail unit.
Enable and enter a string in the Certificate subject field. The
FortiMail unit will compare the string in the Certificate
subject field with the field with that same name in the
installed CA certificates.
This option appears only if TLS level is Secure.
Select the type of match required when the FortiMail unit
compares the string in the Certificate subject and the same
field in the installed CA certificates.
Check certificate subject must be enabled for Certificate
This option appears only if TLS level is Secure.
Enable to require a minimum level of encryption strength.
Also configure Minimum encryption strength.
This option appears only if TLS level is Encrypt or Secure.
Enter the bit size of the encryption key. Greater key size results in stronger encryption, but requires more processing resources.
Minimum encryption strength
6 Click OK.
Configuring encryption profiles
The Encryption tab enables you to create encryption profiles, which contain encryption settings for secure MIME (S/MIME).
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring security profiles
Encryption profiles, unlike other types of profiles, are applied through either message delivery rules or content action profiles, not policies. For more information, see
“Configuring delivery rules” on page 269
and
“Configuring content action profiles” on page 326
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of encryption profiles, go to Profile > Security > Encryption.
Figure 230: Viewing the list of encryption profiles
Profile Name
Encryption Algorithm
Action On Failure
(Green dot in column heading.)
The name of the profile.
The encryption algorithm that will be used with the sender’s private key in order to encrypt the email.
Indicates the action the FortiMail unit takes when identity-based encryption cannot be used, either:
• Drop and send DSN: Send a delivery status notification (DSN) email to the sender’s email address, indicating that the email is permanently undeliverable.
• Send plain message: Deliver the email without encryption.
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
To configure an encryption profile
1 Go to Profile > Security > Encryption.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 In Profile name, enter the name of the profile.
4 From Encryption algorithm, select the encryption algorithm and bit size that will be used with the sender’s private key in order to encrypt email.
5 From Action on failure, select the action the FortiMail unit takes when encryption cannot be used.
• Drop and send DSN: Send a delivery status notification (DSN) email to the sender’s email address, indicating that the email is permanently undeliverable.
• Send plain message: Deliver the email without encryption.
6 Click Create.
To apply the encryption profile, you must select it in a delivery rule. For details, see
“Configuring delivery rules” on page 269
.
Before encryption will work, you must also create at least one internal address
certificate binding. For details, see “Configuring certificate bindings” on page 373
.
Configuring certificate bindings
The Certificate Binding tab enables you to create certificate binding profiles, which establish the relationship between an email address and the certificate that:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
373
Configuring security profiles Profile
• proves an individual’s identity
• provides their keys for use with encryption profiles
This relationship and that information can then be used for secure MIME (S/MIME) per
RFC 2634 .
How certificate bindings are used varies by whether an email is incoming or outgoing.
• Incoming: The FortiMail unit compares the sender’s identity with the list of certificate bindings to determine if it has a key that can decrypt the email. If it has a matching public key, it will decrypt the email before delivering it. If it does not, it forwards the stillencrypted email to the recipient.
• Outgoing: If you have selected an encryption profile in the message delivery rule that applies to the session, the FortiMail unit compares the sender’s identity with the list of certificate bindings to determine if it has a certificate and private key. If it has a matching private key, it will encrypt the email using the algorithm specified in the
encryption profile (see “Configuring encryption profiles” on page 372
). If it does not, it performs the failure action indicated in the encryption profile.
The FortiMail unit does not check whether or not an outgoing email is already encrypted.
Email clients can apply their own additional layer of S/MIME encryption if they want to do so, such as if they require non-repudiation, before they submit an email for delivery through the FortiMail unit.
The destination of an S/MIME email can be another FortiMail unit, for gateway-to-gateway
S/MIME, but it could alternatively be any email gateway or server, as long as either:
• the destination’s MTA or mail server
• the recipient’s MUA supports S/MIME and possesses the sender’s certificate and public key, which is necessary to decrypt the email. Otherwise, the recipient will not be able to read the email.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see
“About administrator account permissions & domains” on page 144 .
To view the list of certificate binding profiles, go to Profile > Security > Certificate Binding.
Figure 231: Viewing the list of certificate binding profiles
374
Profile ID
Address Pattern
Type
Identity
Public Key
The name of the profile.
The email address or domain associated with the identity represented by the personal or server certificate.
Indicates whether the key(s) and certificate will be used for validating the signature of and decrypting incoming email (External), or to sign and encrypt outgoing email (Internal).
The identity, often a first and last name, included in the common name (CN) field of the Subject line of the personal or server certificate.
The public key associated with the identity, used for decrypting and validating the signature of an email from that identity.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring security profiles
Private Key
Valid From
Valid To
Status
(Green dot in column heading.)
The private key associated with the identity, used to encrypt and sign email from that identity.
The beginning date of the period of time during which the certificate and its keys are valid for use by signing and encryption.
The end date of the certificate’s period of validity. After this date and time, the certificate expires, although the keys may be retained for the purpose of decrypting and reading email that was signed and encrypted previously.
Indicates whether the certificate is currently not yet valid, valid, or expired, depending on the current system time and the certificate’s validity period. For information on configuring the time, see
“Configuring the time & date” on page 133 .
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
To configure a certificate binding
Before any personal certificate that you upload will be valid for use, you must upload the certificate of its signing certificate authority (CA). For details, see
“Managing certificate authority certificates” on page 195 .
1 Go to Profile > Security > Certificate Binding.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 In Address Pattern, enter the email address or email domain that you want to use the certificate in this binding.
For example, you might bind a personal certificate for User One to their email address, [email protected].
4 From Type, select whether the key(s) and certificate will be used for validating the signature of and decrypting incoming email (External), or to sign and encrypt outgoing email (Internal).
Valid certificate import formats vary by this selection.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
375
Configuring IP pools Profile
5 For internal address bindings, from Choose import type, select one of the following ways to either import and bind a personal certificate, or to bind an existing server certificate:
• Import PKCS12 file: Upload and bind a personal certificate-and-key file that uses the public key cryptography standard #12 (PKCS #12), stored in a passwordprotected file format (.p12).
• Import PEM files: Upload and bind a pair of personal certificates and public and private keys that use privacy-enhanced email (PEM), a password-protected file format (.pem).
• Choose from local certifiat: Bind a server certificate that you have previously uploaded to the FortiMail unit. For details, see
“Managing local certificates” on page 190
.
Depending on your selection in Choose import type, either upload the personal certificate files and enter their password, or select the name of a local certificate from
Choose local certificate list.
If a certificate import does not succeed and event logging is enabled, to determine the cause of the failure, you can examine the event log messages. Log messages may indicate errors such as an unsupported password-based encryption (PBE) algorithm:
PKCS12 Import: err=0x6074079: digital envelope routines /
EVP_PBE_CipherInit / unknown pbe algorithm
Note: For best results, use 3DES with SHA1. RC2 is not supported.
6 For external address bindings, upload and bind a privacy-enhanced email (PEM) file that contains a personal or server certificate and its public key.
7 Click Create.
Certificate bindings will be used automatically as needed for matching message delivery rules in which you have selected an encryption profile. For details, see
“Configuring encryption profiles” on page 372
and
“Configuring delivery rules” on page 269 .
Configuring IP pools
The IP Pool Lists tab displays the list of IP pool profiles.
IP pools define a range of IP addresses, and can be used in multiple ways:
• To define destination IP addresses of multiple protected SMTP servers if you want to
load balance incoming email between them (see “Relay type” on page 215
)
• To define source IP addresses used by the FortiMail unit if you want outgoing email to originate from a range of IP addresses (see
“Source IP pool” on page 220 )
Each email that the FortiMail unit sends will use the next IP address in the range. When the last IP address in the range is used, the next email will use the first IP address.
IP pool profiles can also be used to define source IP addresses through IP-based policies, although the IP pool profile selected in a protected domain will override the one selected in
the IP-based policy, unless Take precedence over recipient based policy match is enabled
in the IP-based policy. For more information, see “IP pool” on page 282
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
376
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Profile Configuring IP pools
• access profile must have Read or Read-Write permission to the Policy category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of IP pool profiles, go to Profile > IP Pool > IP Pool.
Figure 232: Viewing the list of IP pools
Name
IP Ranges
The name of the profile.
The first and last IP address in each contiguous range included in the profile.
To configure an IP pool
1 Go to Profile > IP Pool > IP Pool.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
Figure 233: Configuring an IP pool
•
3 In Pool name, enter a name for this IP pool.
The name must contain only alphanumeric characters and spaces. Hyphens ( - ) and underscores ( _ ) are not allowed.
4 In Start IP, enter the IP address that begins the range of IP addresses that will be used for this IP pool.
5 In Range, enter the total number of IP addresses in the contiguous range of the IP pool, including that of the Start IP.
For example, if Start IP is 10.0.0.3 and Range is 5, the IP pool will contain the IP addresses 10.0.03, 10.0.0.4, 10.0.0.5, 10.0.0.6, and 10.0.0.7.
6 If you want to include additional ranges of IP addresses in this IP pool, click New, then repeat steps
and
for each additional range of addresses you add.
If you want to remove a range of IP addresses from this IP pool, click the range, then click Delete.
7 Click Create.
To apply the IP pool, select it in a protected domain or IP-based policy. For details, see
, “Source IP pool” on page 220
, and/or “IP pool” on page 282 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
377
Configuring IP pools Profile
378
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam
The AntiSpam menu enables you to configure antispam settings that are system-wide or otherwise not configured individually for each antispam profile.
Several antispam features require that you first configure system-wide, per-domain, or per-user settings in the AntiSpam menu before you can use the feature in an antispam
This topic includes:
•
Configuring email quarantines & quarantine reports
•
Configuring the black lists & white lists
•
•
Configuring bounce verification & tagging
•
Configuring endpoint reputation
•
Training & maintaining the Bayesian databases
Configuring email quarantines & quarantine reports
The Quarantine submenu enables you to configure the quarantines, and to configure system-wide settings for quarantine reports.
Using the email quarantine feature involves the following steps:
• First, enable email quarantine when you configure antispam action profiles (see
“Configuring antispam action profiles” on page 312
) and content action profiles (see
“Configuring content action profiles” on page 326 ).
• Configure the system quarantine administrator account who can manage the system quarantine. See
“Configuring the system quarantine administrator account & disk quota” on page 387
.
• Configure the quarantine control accounts, so that email users can send email to the accounts to release or delete email quarantines. See
“Configuring the quarantine control accounts” on page 389 .
• Configure system-wide quarantine report settings, so that the FortiMail unit can send reports to inform email users of the mail quarantines. Then the users can decide if they want to release or delete the quarantined emails. See
“Configuring global quarantine report settings” on page 380 .
• Configure domain-wide quarantine report settings for specific domains. See
“Quarantine Report Setting” on page 222
.
• View and manage personal quarantines and system quarantines. See
“Managing the quarantines” on page 63 .
• As the FortiMail administrator, you may also need to instruct end users about how to
access their email quarantines. See “Accessing the personal quarantine & webmail” on page 480 .
This section include the following topics:
•
Configuring global quarantine report settings
•
Configuring the system quarantine administrator account & disk quota
•
Configuring the quarantine control accounts
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
379
Configuring email quarantines & quarantine reports AntiSpam
Configuring global quarantine report settings
The Quarantine Report tab enables you to configure various system-wide aspects of the quarantine report, including the schedule for when the FortiMail unit will send quarantine reports.
Note: For the quarantine report schedule to take effect, you must enable the quarantine
“Configuring email quarantines & quarantine reports” on page 379 .
FortiMail units send quarantine reports to notify email users when email has been quarantined to their per-recipient quarantine. If no email messages have been quarantined to the per-recipient quarantine folder in the period since the previous quarantine report, the FortiMail unit will not send a quarantine report.
In addition to the system-wide quarantine report settings, you can also configure some quarantine report settings individually for each protected domain, including whether the
FortiMail unit will send either or both plain text and HTML format quarantine reports. For
more information about domain-wide quarantine report settings, see “Quarantine Report
Caution: If you change the system-wide quarantine report schedule, it will clear any quarantine report schedules for protected domains, requiring you to re-configure all perdomain quarantine report schedules.
For information on the contents of the plain text and HTML format quarantine report, see
“About the plain text formatted quarantine report” on page 382
and
“About the HTML formatted quarantine report” on page 384 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Quarantine category.
For details, see “About administrator account permissions & domains” on page 144 .
To configure the global quarantine report settings, go to AntiSpam > Quarantine >
Quarantine Report.
380
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 234: Configuring the quarantine report
Schedule
These Hours
These Days
Webmail Access
Setting
Time Limited
Access Without
Authentication
Expiry Period
Using HTTPS
Select the hours of the day during which you want the
FortiMail unit to generate quarantine reports.
Select the days of the week during which you want the
FortiMail unit to generate quarantine reports.
Enable to, when an email user clicks a web access link in their quarantine report, allow email users to access their per-recipient quarantine without having to log in. Also configure Expiry Period.
Disable to require that email users enter their user name and password.
Enter the period of time after the quarantine report is generated during which the email user can access the per-recipient quarantine without authenticating.
This option is available only if Time Limited Access
Without Authentication is enabled.
Enable to redirect HTTP requests for FortiMail webmail and per-recipient quarantines to secure access using
HTTPS.
Note: For this option to function properly, you must also enable both HTTP and HTTPS access protocols on the network interface to which the email user is connecting.
For more information, see
“Editing network interfaces” on page 123
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
381
Configuring email quarantines & quarantine reports AntiSpam
Web release host name/IP
Enter a host name for the FortiMail unit that will be used for web release links in quarantine reports. If this field is left blank:
• If the FortiMail unit is operating in gateway mode or server mode, web release and delete links in the quarantine report will use the fully qualified domain name (FQDN) of the FortiMail unit. For more
information, see “Configuring the host name, port numbers, relay, mail queue, & DSN” on page 199 .
• If the FortiMail unit is operating in transparent mode, web release and delete links in the quarantine report will use the FortiMail unit’s management IP address.
For more information, see
“About the management IP” on page 122
.
Configuring an alternate host name for web release and delete links can be useful if the local domain name or management IP of the FortiMail unit is not resolvable from everywhere that email users will use their quarantine reports. In that case, you can override the web release link to use a globally resolvable host name or IP address.
Quarantine
Report Recipient
Setting
Domain
Send to Individual
Recipients
Send to LDAP
Group Owner
The name of a protected domain.
For more information on protected domains, see
“Configuring protected domains” on page 211
.
Enable to send quarantine reports to each recipient address in the protected domain.
Send to Other
Recipient
Enable to send quarantine reports to the email addresses of group owners, then select the name of an LDAP profile
in which you have enabled and configured Group Query
Options. For more information, see “Configuring LDAP profiles” on page 333
.
Enabled to send quarantine reports to an email address other than the recipients or group owners, then enter the email address.
About the plain text formatted quarantine report
Plain text quarantine reports:
• notify email users about email messages that have been quarantined to their perrecipient quarantine
• explain how to delete one or all quarantined email messages
• explain how to release individual email messages
For plain text quarantine reports, you can only release email from the per-recipient quarantine by using the email release method. For more information on how to release
Note: The contents of quarantine reports are customizable. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206 .
382
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 235: Sample plain text quarantine report
Table 34: Sample plain text quarantine report
Message header of quarantine report
Quarantined email #1
Quarantined email #2
Report content
Subject: Quarantine Summary: [ 3 message(s) quarantined from Thu, 04 Sep 2008 11:00:00 to Thu, 04
Sep 2008 12:00:00 ]
From: [email protected]
Date: Thu, 04 Sep 2008 12:00:00
Date: Thu, 04 Sep 2008 11:52:51
Subject: [SPAM] information leak
From: User 1 <[email protected]>
Message-Id:
MTIyMDU0MzU3MS43NDJfNTk5ODcuRm9ydGlNYWlsLTQwMCwjRiNTI zYzMyNFLFU4OjIsUw==
Date: Thu, 04 Sep 2008 11:51:10
Subject: [SPAM] curious?
From: User 1 <[email protected]>
Message-Id:
MTIyMDU0MzQ3MC43NDFfOTA0MjcxLkZvcnRpTWFpbC00MDAsI0YjU yM2MjUjRSxVNzoyLA==
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
383
Configuring email quarantines & quarantine reports AntiSpam
Table 34: Sample plain text quarantine report
Quarantined email #3
Date: Thu, 04 Sep 2008 11:48:50
Subject: [SPAM] Buy now!!!! lowest prices
From: User 1 <[email protected]>
Message-Id:
MTIyMDU0MzMzMC43NDBfNjkwMTUwLkZvcnRpTWFpbC00MDAsI0YjU yM2NDIjRSxVNToyLA==
Actions: Instructions for deleting or releasing quarantined email o) Release a message: Send an email to <[email protected]> with subject line set to
"[email protected]:Message-Id".
o) Delete a message: Send an email to <[email protected]> with subject line set to
"[email protected]:Message-Id".
o) Delete all messages: Send an email to <[email protected]> with subject line set to
"delete_all:[email protected]:e4d46814:ac146004:05737 c7c111d68d0111d68d0111d68d0".
About the HTML formatted quarantine report
HTML quarantine reports:
• notify email users about email messages that have been quarantined to their perrecipient quarantine
• contain links to delete one or all quarantined email messages (see Figure 236 on page 385 )
• contain links to release individual email messages (see Figure 236 on page 385 )
From an HTML format quarantine report, you can release or delete messages by using either web or email release methods. For more information on how to release email from
Web release and delete links in an HTML formatted quarantine report may link to either the management IP address, local domain name, or an alternative host name for the
FortiMail unit. For more information, see “Web release host name/IP” on page 382 .
Note: The contents of quarantine reports are customizable. For more information, see
“Customizing replacement messages & quarantine report contents” on page 206 .
384
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Figure 236: Sample HTML quarantine report
Web release and web delete links
Email release and email delete links
Table 35: Sample HTML quarantine report
Message header of quarantine report
Quarantined email #1
Quarantined email #2
Report content
Subject: Quarantine Summary: [ 3 message(s) quarantined from Thu, 04 Sep 2008 11:00:00 to Thu, 04
Sep 2008 12:00:00 ]
From: [email protected]
Date: Thu, 04 Sep 2008 12:00:00
Date: Thu, 04 Sep 2008 11:52:51
From: User 1 <[email protected]>
Subject: [SPAM] information leak
Web Actions: Release Delete
Email Actions: Release Delete
Date: Thu, 04 Sep 2008 11:51:10
From: User 1 <[email protected]>
Subject: [SPAM] curious?
Web Actions: Release Delete
Email Actions: Release Delete
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
385
Configuring email quarantines & quarantine reports AntiSpam
Table 35: Sample HTML quarantine report
Quarantined email #3
Instructions for deleting or releasing quarantined email
Date: Thu, 04 Sep 2008 11:48:50
From: User 1 <[email protected]>
Subject: [SPAM] Buy now!!!! lowest prices
Web Actions: Release Delete
Email Actions: Release Delete
Web Actions:
Click on Release link to send a http(s) request to have the message sent to your inbox.
Click on Delete link to send a http(s) request to delete the message from your quarantine.
Click Here to send a http(s) request to Delete all
messages from your quarantine.
Email Actions:
Click on Release link to send an email to have the message sent to your inbox.
Click on Delete link to send an email to delete the message from your qurantine.
Click here to send an email to Delete all messages from your quarantine.
Other:
To view your entire quarantine inbox or manage your preferences, Click Here
Releasing and deleting email from the per-recipient quarantine using quarantine reports
Quarantine reports enable recipients to remotely monitor and delete or release email messages in the per-recipient quarantine folders.
Depending on whether the quarantine report is sent and viewed in plain text or HTML format, a quarantine report recipient may be able to use either or both web release and email release methods to release or delete email from a per-recipient quarantine.
• Web release: To release or delete an email from the per-recipient quarantine, the recipient must click the Release or Delete web action link which sends an HTTP or
HTTPS request to the FortiMail unit. Available for HTML format quarantine reports only.
Figure 237: Releasing an email from the per-recipient quarantine using web release
386
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
• Email release: To release or delete an email from the per-recipient quarantine, the recipient must either:
• Click the Release or Delete email action link which creates a new email message containing all required information, then send it to the quarantine control account of the FortiMail unit. Available for HTML format quarantine reports only.
• Manually send an email message to the quarantine control account of the FortiMail unit. The To: address must be the quarantine control email address, such as [email protected] or [email protected]. The subject line must contain both the recipient email address and Message-Id: of the quarantined email, separated by a colon (:), such as: [email protected]:MTIyMDU0MDk1Ni43NDRfMTk2ODU0LkZvcnRpTWFpbC0
0MDAsI0YjUyM2NjUjRQ==
Figure 238: Releasing an email from the per-recipient quarantine using email release
Release quarantine control account
Subject line containing email address of original recipient and
Message-Id:, separated by a colon (:)
.
Web release links may be configured to expire after a period of time, and may or may not require the recipient to log in to the FortiMail unit. For more information, see
“Configuring global quarantine report settings” on page 380
.
For more information on the differences between plain text and HTML format quarantine
reports, see “About the plain text formatted quarantine report” on page 382
and
HTML formatted quarantine report” on page 384 .
Configuring the system quarantine administrator account & disk quota
The System Quarantine Setting tab enables you to configure system quarantine quota and rotation. It also enables you to configure a system quarantine administrator account exclusively for the purpose of managing the system-wide quarantine, which cannot be managed by individual email users through their quarantine reports.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
387
Configuring email quarantines & quarantine reports AntiSpam
Like other FortiMail administrators, the system quarantine administrator can log in to the web-based manager. However, he or she has access only to the system quarantine. In this way, you can assign the periodic review of the system quarantine to someone else without allowing that person full administrative access to all FortiMail unit settings.
Note: The system quarantine administrator can also view the system quarantine using a
POP3 or IMAP email client. To do this, configure the email client with the IP address of the
FortiMail unit as the POP3 or IMAP server, using the system quarantine administrator account name and password.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Quarantine category.
For details, see “About administrator account permissions & domains” on page 144 .
To configure the system quarantine administrator or to configure system quarantine quotas, go to AntiSpam > Quarantine > System Quarantine Setting.
Figure 239: Configuring the system quarantine account and quota
388
Account Name and
Password
Enter the user name of the system quarantine administrator account. This is the same user name that this person will use to log in to the web-based manager in order to manage the system quarantine.
Enter the password for the system quarantine administrator account.
Password
Forward To Enter an email address to which the FortiMail unit will forward a copy of each email that is quarantined to the system quarantine.
Mailbox rotation size Enter the maximum size of the current system quarantine mailbox (Inbox).
When the mailbox reaches this size, the FortiMail unit renames the current mailbox based upon its creation date and rename date, and creates a new
Inbox mailbox.
Alternatively or additionally configure Mailbox rotation time.
For more information, see
.
Mailbox rotation time Enter the maximum amount of time that the current system quarantine mailbox (Inbox) will be used. When the mailbox reaches this size, the
FortiMail unit renames the current mailbox based upon its creation date and rename date, and creates a new Inbox mailbox.
Alternatively or additionally configure Mailbox rotation size.
For more information, see
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Disk Quota Enter the maximum amount of disk space the system quarantine will be permitted to use, including rotated folders.
Maximum configurable disk quota depends on the amount of available disk space.
Quarantine options when disk quota is full
Select the action that the FortiMail unit will take when the system quarantine has consumed its disk quota, either:
• Overwrite: Discard the oldest email messages in the system quarantine in order to use the disk space to quarantine new email messages.
• Do not quarantine: Discard and do not quarantine new email messages.
Access Address Book Click to add, delete, back up, or restore email addresses in the address book of the system quarantine administrator account.
Email addresses in this address book can be convenient when a system quarantine administrator wants to forward quarantined email messages.
For more information, see
“To display, release, delete, or forward an email in the system quarantine” on page 71 .
Configuring the quarantine control accounts
The Control Account tab enables you to configure quarantine control email addresses.
Email users can remotely release or delete email messages in their per-recipient quarantine by sending email to quarantine control email addresses.
For example, if Release User is release-ctrl and the local domain name of the
FortiMail unit is example.com, an email user could release an email message from their per-recipient quarantine by sending an email to [email protected] more information on releasing and deleting quarantined items through email, see
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Quarantine category.
For details, see “About administrator account permissions & domains” on page 144 .
To configure the quarantine release and delete email addresses, go to AntiSpam >
Quarantine > Control Account.
Figure 240: Configuring the quarantine control accounts
Release User
Delete User
Enter the user name portion (also known as the local-part), such as release-ctrl, of the email address on the FortiMail unit that will receive quarantine release commands.
Note: If you have more than one FortiMail unit, this must be unique on each
FortiMail unit.
Enter the user name portion (also known as the local-part), such as delete-ctrl, of the email address on the FortiMail unit that will receive quarantine delete commands.
Note: If you have more than one FortiMail unit, this must be unique on each
FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
389
Configuring the black lists & white lists AntiSpam
Configuring the black lists & white lists
The Black/White List submenu enables you to reject, discard, or allow email messages based upon email addresses, domain names, and IP addresses. It also enables you to back up and restore the black lists and white lists.
Multiple types of black lists and white lists exist: system-wide, per-domain, per-user, and per-session profile. There are several places in the web-based manager where you can configure these black lists and white lists.
• For system-wide, per-domain, and per-user black lists and white lists, go to
AntiSpam > Black/White List. For details, see
“Configuring the global black list & white list” on page 392
,
“Configuring the per-domain black lists & white lists” on page 394 ,
and
“Configuring the personal black lists & white lists” on page 396
.
• For per-user black lists and white lists, you can alternatively go to User > User >
User Preferences. For details, see
“Configuring users’ preferences” on page 243
.
• For session profile black lists and white lists, go to Profile > Session > Session and modify the session profile. For details, see
“Configuring session profiles” on page 285 .
Note: In addition to FortiMail administrators being able to configure per-user black lists and white lists, email users can configure their own per-user black list and white list by going to the Preferences tab in FortiMail webmail. For more information, see the online help for
FortiMail webmail.
The order in which black lists and white lists are executed can affect which black list and white list entries take effect. For example, if a black list entry and a white list entry conflict, the black list or white list that executes first has precedence and prevents the other from taking effect. For more information on order of execution, see
“Order of execution of black lists & white lists” on page 390 .
All black and white list entries are listed in alphabetical order.
For information on the maximum number of black lists and white lists, see “Appendix B:
Maximum Values Matrix” on page 487
.
This topic includes:
•
Order of execution of black lists & white lists
•
About black list & white list address formats
•
Configuring the global black list & white list
•
Configuring the per-domain black lists & white lists
•
Configuring the personal black lists & white lists
•
Configuring the blacklist action
Order of execution of black lists & white lists
As one of the first steps to detect spam, FortiMail units evaluate whether an email message matches a black list or white list entry.
Generally, white lists are take precedence over black lists. If the same entry appears in both a white list and black list, the entry will be whitelisted. Similarly, system-wide lists generally take precedence over per-domain lists, while per-domain lists take precedence over per-user lists.
Table 36 displays the sequence in which the FortiMail unit evaluates email messages for matches with black list and white list entries. If the FortiMail unit finds a match, the
FortiMail unit does not look for any additional matches, and cancels any remaining antispam scans.
390
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring the black lists & white lists
Table 36: Black and white list order of operations
8
9
10
6
7
4
5
2
3
Order List
1 System white list
System black list
Domain white list
Domain black list
Session recipient white list
Session recipient black list
Session sender white list
Session sender black list
User white list
User black list
Examines
Sender
Sender
Sender
Sender
Recipient
Recipient
Sender
Sender
Sender
Sender
Action taken if match is found
Accept message
Invoke black list action
Accept message
Invoke black list action
Accept message for matching recipients
Invoke black list action
Accept message for all recipients
Invoke black list action
Accept message for this recipient
Discard message
If the sender is being examined for a match, email addresses and domain names in list are compared to the sender address in the message envelope (MAIL FROM:); IP addresses are compared to the IP address of the SMTP client delivering the email, also known as the last hop address.
If the recipient is being examined for a match, email addresses and domain names in the list are compared to the recipient address. An IP address in a recipient white or black list is not a valid entry, because IP addresses are not used.
System-wide, per-domain, and per-user black lists and white lists are executed before any policy match. In contrast, per-session profile black lists and white lists require that the traffic first match a policy. When configuring a session profile (see
session profile. Session profiles are selected in IP-based policies, and as a result, persession profile black lists and white lists are not applied until the traffic matches an IPbased policy.
.
About black list & white list address formats
Acceptable input for black list and white list entries may vary by the type of the black list or white list, but may be:
• all or part of an IP address
• all or part of a domain names
• all or part of an email address
Domain name portions (e.g. example.com) and user name portions (e.g. user1) may use wild cards (? and *).
Table 37: Examples of valid black list/white list entries
Example
172.168.1
example.com
Description of match
Email from the IP addresses 172.168.1.0/24
Email from any sender at example.com, such as [email protected], or from any IP address to which the domain name example.com resolves
Email from the sender [email protected]
Email from any sender ending in “ser1” at example.com
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
391
Configuring the black lists & white lists AntiSpam
Table 37: Examples of valid black list/white list entries
Example
*@example.com
user1@ex?mple.com
user1@*.com
The following formats are not valid:
• 172.16.1.0
• 172.16.1.0/24
• @spam. example.com
Description of match
Email from any sender at example.com
Email from the sender user1 in domains such as example.com, exemple.com, or exumple.com
Email from the sender user1 at any .com domain
Configuring the global black list & white list
The System tab enables you to configure system-wide black lists and white lists to block or allow email by sender. It also enables you to back up and restore the system-wide black list and white list.
Note: You can alternatively back up all system-wide, per-domain, and per-user black lists
and white lists together. For details, see “Backup and restore” on page 97
.
Note: Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance, but can also cause false positives and false negatives if not used carefully. For example, a white list entry of *.edu would allow all email from the
.edu top level domain to bypass the FortiMail unit's other antispam scans.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Black/White List category.
For details, see “About administrator account permissions & domains” on page 144 .
Note: Domain administrators can access the global black list and global white list, and therefore could affect domains other than their own. If you do not want to permit this, do not provide Read-Write permission to the Black/White List category in domain administrators’ access profile.
To view the global black list or white list, go to AntiSpam > Black/White List > System.
Figure 241: Accessing the system-wide black list or white list
392
To add an entry to the system-wide black list or white list
1 Go to AntiSpam > Black/White List > System.
2 To block email by sender, click Black List.
To allow email by sender, click White List.
3 In the field to the left of the Add button, type the email address, domain name, or IP
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam
Figure 242: Configuring the system-wide black list
Configuring the black lists & white lists
Figure 243: Configuring the system-wide white list
4 Click Add.
The entry appears in the text area below the Add button.
To delete an entry from the system-wide black list or white list
1 Go to AntiSpam > Black/White List > System.
2 Click either Black List or White List.
3 In the text area below the Add button, select the entry that you want to remove.
4 Click Remove Selected.
To back up the system-wide black list or white list
1 Go to AntiSpam > Black/White List > System.
2 Click either Black List or White List.
3 Click Backup.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
393
Configuring the black lists & white lists AntiSpam
4 If your web browser prompts you for a location, select the folder where you want to save the file.
To restore the system-wide black list or white list
Caution: Back up the black list and white list before beginning this procedure. Restoring the black list and white list overwrites any existing black list or white list.
1 Go to AntiSpam > Black/White List > System.
2 Click either Black List or White List.
3 Click Browse, locate and select the file that you want to restore, then click OK.
4 Click Restore.
Configuring the per-domain black lists & white lists
The Domain tab enables you to configure white lists and black lists that are specific to a protected domain in order to block or allow email by sender. It also enables you to back up and restore the per-domain black lists and white lists.
Note: You can alternatively back up all system-wide, per-domain, and per-user black lists
and white lists together. For details, see “Backup and restore” on page 97
.
Note: Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance, but can also cause false positives and false negatives if not used carefully. For example, a white list entry of *.edu would allow all email from the
.edu top level domain to bypass the FortiMail unit's other antispam scans.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Black/White List category.
For details, see “About administrator account permissions & domains” on page 144 .
To view per-domain black lists or white lists, go to AntiSpam > Black/White List > Domain.
Figure 244: Accessing the per-domain black lists and white lists
394
Domain
Black List
White List
The name of the protected domain to which the black list and white list belong.
For more information on protected domains, see “Configuring protected domains” on page 211 .
Click to display, modify, back up, or restore the black list for the protected domain.
Click to display, modify, back up, or restore the white list for the protected domain.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring the black lists & white lists
To add an entry to a per-domain black list or white list
1 Go to AntiSpam > Black/White List > Domain.
2 To block email by sender, in the row corresponding to the protected domain whose black list you want to modify, click Black List.
To allow email by sender, in the row corresponding to the protected domain whose white list you want to modify, click White List.
3 In the field to the left of the Add button, type the email address, domain name, or IP
Figure 245: Configuring a per-domain black list
Figure 246: Configuring a per-domain white list
4 Click Add.
The entry appears in the text area below the Add button.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
395
Configuring the black lists & white lists AntiSpam
To delete an entry from a per-domain black list or white list
1 Go to AntiSpam > Black/White List > Domain.
2 In the row corresponding to the protected domain whose black list or white list you want to modify, click either Black List or White List.
3 In the text area below the Add button, select the entry that you want to remove.
4 Click Remove Selected.
To back up a per-domain black list or white list
1 Go to AntiSpam > Black/White List > Domain.
2 In the row corresponding to the protected domain whose black list or white list you want to back up, click either Black List or White List.
3 Click Backup.
4 If your web browser prompts you for a location, select the folder where you want to save the file.
To restore a per-domain black list or white list
Caution: Back up the black list and white list before beginning this procedure. Restoring the black list and white list overwrites any existing black list or white list.
1 Go to AntiSpam > Black/White List > Domain.
2 In the row corresponding to the protected domain whose black list or white list you want to restore, click either Black List or White List.
3 Click Browse, locate and select the file that you want to restore, then click OK.
4 Click Restore.
Configuring the personal black lists & white lists
AntiSpam > Black/White List > Personal enables you to add or modify email users’ personal black or white lists in order to block or allow email by sender. It also enables you to back up and restore the per-user black lists and white lists.
Note: In addition to FortiMail administrators configuring per-user black lists and white lists, email users can configure their own per-user black list and white list by going to the
Preferences tab in FortiMail webmail. For more information, see the online help for FortiMail webmail.
Note: Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance, but can also cause false positives and false negatives if not used carefully. For example, a white list entry of *.edu would allow all email from the
.edu top level domain to bypass the FortiMail unit's other antispam scans.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Black/White List category.
For details, see “About administrator account permissions & domains” on page 144 .
To view personal black lists or white lists, go to AntiSpam > Black/White List > Personal.
396
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring the black lists & white lists
Figure 247: Accessing the personal black lists and white lists
Search User
Domain
User Name
The name of the protected domain to which the black list and white list belong.
For more information on protected domains, see “Configuring protected domains” on page 211 .
Enter the user name of the email user, such as user1, then click Search
User.
Search User Click to display black list or white list options for the email user that you specified in User Name, or, if the email user does not exist, to create the email user before displaying those options.
Add outgoing email addresses to White list
Click On to automatically add the recipient email addresses of outgoing email messages from this email user to his or her per-user white list. For more information on directionality, see
“Incoming vs. outgoing recipient-based policies” on page 259 .
Black/White Lists Click Black to display, modify, back up, or restore the black list for this email user.
Click White to display, modify, back up, or restore the white list for this email user.
To add an entry to a per-user black list or white list
1 Go to AntiSpam > Black/White List > Personal.
2 From Domain, select the name of the protected domain to which the email user belongs.
3 In User Name, type the user name of the email user whose per-user black list or white list you want to modify.
4 Click Search User.
If the email user exists, options appear allowing you to configure his or her per-user black list and white list.
If the email user does not exist, a dialog appears, asking you if you want to create one and proceed. Click OK.
5 To block email by sender, click Black List.
To allow email by sender, click White List.
6 In the field to the left of the Add button, type the email address, domain name, or IP
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
397
Configuring the black lists & white lists
Figure 248: Configuring a personal black list
AntiSpam
Figure 249: Configuring a personal white list
398
7 Click Add.
The entry appears in the text area below the Add button.
Note: If you add the user’s email address to the same user’s personal white list, the
FortiMail unit will ignore this entry. This is a precautious measure taken to guard against spammers from sending spam in disguise of that user’s email address as the sender address.
To delete an entry from a per-user black list or white list
1 Go to AntiSpam > Black/White List > Personal.
2 From Domain, select the name of the protected domain to which the email user belongs.
3 In User Name, type the user name of the email user whose per-user black list or white list you want to modify.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring the black lists & white lists
4 Click Search User.
If the email user exists, options appear allowing you to configure his or her per-user black list and white list.
If the email user does not exist, a dialog appears, asking you if you want to create one and proceed. Click OK.
5 Click either Black List or White List.
6 In the text area below the Add button, select the entry that you want to remove.
7 Click Remove Selected.
To back up a per-user black list or white list
1 Go to AntiSpam > Black/White List > Personal.
2 From Domain, select the name of the protected domain to which the email user belongs.
3 In User Name, type the user name of the email user whose per-user black list or white list you want to back up.
4 Click Search User.
If the email user exists, options appear allowing you to back up his or her per-user black list and white list.
5 Click either Black List or White List.
6 Click Backup.
7 If your web browser prompts you for a location, select the folder where you want to save the file.
Note: You can alternatively back up all system-wide, per-domain, and per-user black lists
and white lists together. For details, see “Backup and restore” on page 97
.
To restore a per-user black list or white list
Caution: Back up the black list and white list before beginning this procedure. Restoring the black list and white list overwrites any existing black list or white list.
1 Go to AntiSpam > Black/White List > Personal.
2 From Domain, select the name of the protected domain to which the email user belongs.
3 In User Name, type the user name of the email user whose per-user black list or white list you want to restore.
4 Click Search User.
If the email user exists, options appear allowing you to restore his or her per-user black list and white list.
5 Click either Black List or White List.
6 Click Browse, locate and select the file that you want to restore, then click OK.
7 Click Restore.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
399
Configuring greylisting AntiSpam
Configuring the blacklist action
The Blacklist Action tab enables you to configure the action to take if an email message arrives from a blacklisted domain name, email address, or IP address.
The FortiMail unit will apply this action to email matching system-wide, per-domain, and per-session profile black lists.
Note: For the personal level black lists, the only option is to discard. For more information,
see “Configuring the personal black lists & white lists” on page 396 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Black/White List category.
For details, see “About administrator account permissions & domains” on page 144 .
Note: Domain administrators can configure the blacklist action, and therefore could affect domains other than their own. If you do not want to permit this, do not provide Read-Write permission to the Black/White List category in domain administrators’ access profile.
To configure black list actions, go to AntiSpam > Black/White List > Blacklist Action.
Figure 250: Configuring the blacklist action
• Reject: Reject delivery of the email and respond to the SMTP client with SMTP reply code
550 (Relaying denied).
• Discard: Accept the email, but silently delete it and do not deliver it. Do not inform the SMTP client.
• Use AntiSpam Profile Setting: Use the actions configured in the antispam profile that you selected in the policy that matches the email message. For more information on actions, see
“Configuring antispam action profiles” on page 312
.
Configuring greylisting
The Greylist submenu enables you to configure greylisting and to view greylist-exempt senders.
This topic includes:
•
•
Manually exempting senders from greylisting
•
Configuring the grey list TTL & initial delay
400
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring greylisting
About greylisting
Greylist scanning blocks spam based on the behavior of the sending server, rather than the content of the messages. When receiving an email from an unknown server, the
FortiMail unit will temporarily reject the message. If the mail is legitimate, the originating server will try to send it again later ( RFC 2821 ), at which time the FortiMail unit will accept it. Spammers will typically abandon further delivery attempts in order to maximize spam throughput.
Advantages of greylisting include:
• Greylisting is low-maintenance, and does not require you to manually maintain IP address lists, black lists or white lists, or word lists. The FortiMail unit automatically obtains and maintains the required information.
• Spam blocked by greylisting never undergoes other antispam scans. This can save significant amounts of processing and storage resources. For this reason, enabling greylisting can improve FortiMail performance.
• Even if a spammer adapts to greylisting by retrying to send spam, the greylist delay period can allow time for FortiGuard Antispam and DNSBL servers to discover and blacklist the spam source. By the time that the spammer finally succeeds in sending the email, other antispam scans are more likely to recognize it as spam.
Figure 251: Overview of the greylist scan
Start
Continue processing the message
End greylist routine
Reset TTL of matching greylist entry
Yes
Did the client authenticate?
No
Yes
Does the message match an exempt rule?
No
Yes
Does the message match an autoexempt record?
No
Yes
Does the message match a greylist entry?
No
Remove the greylist record
No
Does the sender retry before the initial expiry period elapses?
Yes
No
Does the sender retry before the greylisting period elapses?
Yes
Reject message with a temporary fail
Create a greylist entry
Set greylist entry expiry to TTL
Is the message detected as spam?
No
Yes
Does the message contain a virus?
No
Yes
Does the message match an autoexempt record?
Yes
No
Continue processing the message
End greylist routine
Yes
Is the sender or recipient whitelisted?
No
Create a greylist entry
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
401
Configuring greylisting
402
AntiSpam
Note: Greylisting is omitted if the matching access control rule’s Action is RELAY. For more
information on antispam features’ order of execution, see “Order of execution” on page 24 .
When an SMTP client first attempts to deliver an email message through the FortiMail unit, the greylist scanner examines the email message’s combination of:
• sender email address in the message envelope (MAIL FROM:)
• recipient email address in the message envelope (RCPT TO:)
• IP address of the SMTP client
The greylist scanner then compares the combination of those attributes to manual and automatic greylist entries. The greylist scanner evaluates the email for matches in the following order:
1 Manual greylist entries, also known as exemptions (see “Manual greylist entries” on page 404 )
2 Consolidated automatic greylist entries, also known as autoexempt entries (see
“Automatic greylist entries” on page 403
)
3 Individual automatic greylist entries, also known as greylist entries
and
“Automatic greylist entries” on page 403
.
According to the match results, the greylist scanner performs one of the following.
• If a matching entry exists, the FortiMail unit continues with other configured antispam scans, and will accept the email if no other antispam scan determines that the email is spam. For automatic greylist entry matches, each subsequent email that is accepted also extends the expiry date of the automatic greylist entry according to the configured time to live (TTL). (Automatic greylist entries are discarded if no additional matching email messages are received by the expiry date.)
• If no matching entry exists, the FortiMail unit creates a pending individual automatic
replies to the SMTP client with a temporary failure code. During the greylist delay period after the initial delivery attempt, the FortiMail unit continues to reply to delivery attempts with a temporarily failure code. To confirm the pending automatic greylist entry and successfully send the email message, the SMTP client must retry delivery during the greylist window: after the delay period, but before the expiry of the pending entry.
Subsequent email messages matching a greylist entry are accepted by the greylist scanner without being subject to the greylisting delay.
. For information on configuring the greylisting delay, window,
and entry expiry/TTL, see “Configuring the grey list TTL & initial delay” on page 404
.
Matching greylist entries
When an SMTP client tries to deliver an email message to the FortiMail unit, the greylist scanner inspects three email message attributes:
• the sender email address in the message envelope (MAIL FROM:)
• the recipient email address in the message envelope (RCPT TO:)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring greylisting
• the IP address of the SMTP client
It compares the combination of these attributes to those of greylist entries, searching for a matching entry.
While the email addresses in the message envelope must match exactly, IP address of the
SMTP client is less specific match: any IP address on the /24 network will match.
For example, if an email server at 192.168.1.99 is known to the greylist scanner, its greylist entry contains the IP address 192.168.1.0 where 0 indicates that any value will match the last octet, and that any IP address starting with 192.168.1 will match that entry.
This greylist IP address matching mechanism restricts the number of IP addresses which can match the greylist entry while also minimizing potential issues with email server farms.
Some large organizations use many email servers with IP addresses in the same class C subnet. If the first attempt to deliver email receives a temporary failure response, the second attempt may come from an email server with a different IP address. If an exact match were required, the greylist scanner would treat the second delivery attempt as a new delivery attempt unrelated to the first. Depending on the configuration of the email servers, the email message might never be delivered properly. Approximate IP address matching often prevents this problem.
For very large email server farms that require greater than a /24 subnet, you can manually
create greylist exemptions. For more information, see “Manual greylist entries” on page 404
.
Automatic greylist entries
The automatic greylisting process automatically creates, confirms pending entries, and expires automatic greylist entries, reducing the need for manual greylist entries. The automatic greylisting process can create three types of automatic greylist entries:
• pending (see “Viewing the pending & individual automatic greylist entries” on page 73 )
• individual (see
“Viewing the pending & individual automatic greylist entries” on page 73 )
• consolidated (see “Viewing the consolidated automatic greylist exemptions” on page 75 )
Pending entries are created upon the initial delivery attempt, and track the email messages whose delivery attempts are currently experiencing the greylist delay period.
They are converted to confirmed individual entries if a delivery attempt occurs after the greylist delay period, during the greylist window.
The automatic greylisting process can reduce the number of individual automatic greylist entries by consolidating similar entries after they have been confirmed during the greylisting window. Consolidation improves performance and greatly reduces the possibility of overflowing the maximum number of greylist entries.
Consolidated automatic greylist entries include only:
• the domain name portion of the sender email address
• the IP address of the SMTP client
They do not include the recipient email address, or the user name portion of the sender email address. By containing only the domain name portion and not the entire sender email address, a consolidated entry can match all senders from a single domain, rather than each sender having and matching their own individual automatic greylist entry.
Similarly, by not containing the recipient email address, any recipient can share the same greylist entry. Because consolidated entries have broader match sets, they less likely to reach the time to live (TTL) than an individual automatic greylist entry.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
403
Configuring greylisting
404
AntiSpam
For example, example.com and example.org each have 100 employees. The two organizations work together and employees of each company exchange email with many of their counterparts in the other company. If each example.com employee corresponds with 20 people from example.org, the FortiMail unit used by example.com will have 2000 greylist entries for the email received from example.org alone. By consolidating, these
2000 greylist entries are replaced by a single entry.
Not all individual automatic greylist entries can be consolidated. Because consolidated entries have fewer message attributes, more email messages may match each entry, some of which could contain different recipient email addresses and sender user names than those of the originally greylisted email messages. To prevent spam from being able to take advantage of the broader match sets, requirements for creation of consolidated entries are more strict than those of individual automatic greylist entries. FortiMail units will create a consolidated entry only if the email:
• does not match any manual greylist entry (exemption)
• passes the automatic greylisting process
• passes all configured antispam scans
• passes all configured antivirus scans
• passes all configured content scans
• does not match any white lists
If an email message fails to meet the above requirements, the FortiMail unit instead maintains the individual automatic greylist entry.
Note: If an email message matches a manual greylist entry, it is not subject to automatic greylisting and the FortiMail unit will not create an entry in the greylist or autoexempt list.
After a greylist entry is consolidated, both the consolidated entry and the original greylist entry will coexist for the length of the greylist TTL. Because email messages are compared to the autoexempt list before the greylist, subsequent matching email will reset only the expiry date of the autoexempt list entry, but not the expiry date of the original greylist entry. Eventually, the original greylist entry expires, leaving the automatic greylist entry.
Manual greylist entries
In some cases, you may want to manually configure some greylist entries. Manual greylist entries are exempt from the automatic greylisting process, and are therefore not subject to the greylist delay period and confirmation.
For example, a manual greylist entry can be useful when email messages are sent from an email server farm whose network is larger than /24. For very large email server farms, if a different email server attempts the delivery retry each time, the greylist scanner could perceive each retry as a first attempt, and automatic greylist entries could expire before the same email server retries delivery of the same email. To prevent this problem, you can manually create an exemption using common elements of the host names of the email servers.
.
Configuring the grey list TTL & initial delay
The Settings tab enables you to configure time intervals used during the automatic greylisting process.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring greylisting
For more information on the automatic greylisting process, see
“About greylisting” on page 401
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To configure greylisting intervals, go to AntiSpam > Greylist > Settings.
Figure 252: Configuring the greylisting TTL and initial delay
TTL Enter the time to live (TTL) that determines the maximum amount of time that unused automatic greylist entries will be retained.
Expiration dates of automatic greylist entries are determined by adding the
TTL to the date and time of the previous matching delivery attempt. Each time an email message matches the entry, the life of the entry is prolonged; in this way, entries that are in active use do not expire.
If the TTL elapses without an email message matching the automatic greylist entry, the entry expires and the greylist scanner removes the entry.
For more information on automatic greylist entries, see
“Viewing the greylist statuses” on page 73
.
The value must be between 1 and 60 days. The default value is 10 days.
Greylisting period Enter the length of the greylist delay period.
For the initial delivery attempt, if no manual greylist entry (exemption) matches the email message, the FortiMail unit creates a pending automatic greylist entry, and replies with a temporary failure code. During the greylist delay period after this initial delivery attempt, the FortiMail unit continues to reply to additional delivery attempts with a temporary failure code.
After the greylist delay period elapses and before the pending entry expires
(during the greylist window), any additional delivery attempts will confirm the entry and convert it to an individual automatic greylist entry. The greylist scanner will then allow delivery of subsequent matching email messages. For more information on pending and individual automatic greylist entries, see
“Viewing the pending & individual automatic greylist entries” on page 73 .
The value must be between 1 and 120 minutes. The default value is
20 minutes.
Note: You can use the CLI to change the default 4 hour greylist window. For more information, see the CLI command set as greylist initial_expiry_period in the
FortiMail CLI Reference .
Manually exempting senders from greylisting
The Exempt tab displays manual greylist entries, which exempt email messages from the automatic greylisting process and its associated greylist delay period.
Note: Greylisting is omitted if the matching access control rule’s Action is RELAY. For more
information on antispam features’ order of execution, see “Order of execution” on page 24 .
For more information on the automatic greylisting process, see
“About greylisting” on page 401
. For more information on manual greylist entries, see “Manual greylist entries” on page 404
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
405
Configuring greylisting AntiSpam
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of manual greylist entries, go to AntiSpam > Greylist > Exempt.
Figure 253: Viewing the list of manual greylist exemptions
#
Sender Pattern
The index number of the entry in the list.
The rule sequence is not important to the way the greylist exempt list works.
The pattern that defines a matching sender email address in the message envelope (MAIL FROM:).
The prefix to the pattern indicates whether or not the Regular expression option is enabled for the entry.
• R/: Regular expressions are enabled.
• -/: Regular expressions are not enabled, but the pattern may use wild cards (* or ?).
Recipient Pattern
Sender IP/Netmask The IP address and netmask that defines SMTP clients that match this entry.
0.0.0.0/0 matches all SMTP client IP addresses.
Reverse DNS
Pattern
The pattern that defines a matching recipient address in the message envelope (RCPT TO:).
The prefix to the pattern indicates whether or not the Regular expression option is enabled for the entry.
• R/: Regular expressions are enabled.
• -/: Regular expressions are not enabled, but the pattern may use wild cards (* or ?).
The pattern that defines a matching result when the FortiMail unit performs the reverse DNS lookup of the IP address of the SMTP client.
The prefix to the pattern indicates whether or not the Regular expression option is enabled for the entry.
• R/: Regular expressions are enabled.
• -/: Regular expressions are not enabled, but the pattern may use wild cards (* or ?).
To configure a manual greylist entry
1 Go to AntiSpam > Greylist > Exempt.
2 Click New to add an entry, or click to select an entry that you want to modify, then click
Edit.
3 Configure the following:
406
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam
Figure 254: Configuring a greylist exemption
Configuring greylisting
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
407
Configuring greylisting
408
AntiSpam
Sender pattern
Regular expression
Recipient pattern
Regular expression
Sender IP/Netmask
Reverse DNS pattern
Regular expression
Enter the pattern that defines a matching sender email address in the message envelope (MAIL FROM:). To match any sender email address, enter either *, or, if Regular expression is enabled, .*.
You can create a pattern that matches multiple addresses either by:
• including wild card characters (* or ?). An asterisk (*) matches one or more characters; a question mark (?) matches any single character.
• using regular expressions. You must also enable the Regular
expression option.
For example, entering the pattern ??@*.com will match messages sent by any sender with a two-letter user name from any “.com” domain.
Mark this check box if you have entered a pattern using regular
expression syntax. For more information, see “Using regular expressions” on page 31
.
Enter the pattern that defines a matching recipient address in the message envelope (RCPT TO:). To match any recipient email address, enter either *, or, if Regular expression is enabled, .*.
You can create a pattern that matches multiple addresses either by:
• including wild card characters (* or ?). An asterisk (*) matches one or more characters; a question mark (?) matches any single character.
• using regular expressions. You must also enable the Regular expression option.
For example, entering the pattern *@example.??? will match email sent to any recipient at example.com, example.net, example.org, or any other “example” top level domain.
Mark this check box if you have entered a pattern using regular
expression syntax. For more information, see “Using regular expressions” on page 31
.
Enter the IP address and netmask that defines SMTP clients that match this entry.
To match any SMTP client IP address, enter 0.0.0.0/0.
You can create a pattern that matches multiple addresses by entering any bit mask other than /32.
For example, entering 10.10.10.10/24 would match the 24-bit subnet of IP addresses starting with 10.10.10, and would appear in the list of manual greylist entries as 10.10.10.0/24.
Enter the pattern that defines valid host names for the IP address of the SMTP client.
FortiMail units perform a reverse DNS lookup of the SMTP client’s
IP address to verify the self-reported host name that the SMTP client provided in its SMTP greeting (EHLO/HELO). The greylist scanner compares the host name resulting from the reverse DNS query with this pattern.
You can create a pattern that matches multiple addresses either by:
• including wild card characters (* or ?). An asterisk (*) matches one or more characters; a question mark (?) matches any single character.
• using regular expressions. You must also enable the Regular
expression option.
For example, entering the pattern mail*.com will match messages delivered by an SMTP client whose host name starts with “mail” and ending with “.com”.
Mark this check box if you have entered a pattern using regular
expression syntax. For more information, see “Using regular expressions” on page 31
.
No pattern can be left blank in a greylist exempt rule. To have the FortiMail unit ignore a pattern, enter an asterisk (*) in the pattern field. For example, if you enter an asterisk in the Recipient Pattern field and do not enable Regular Expression, the asterisk matches all recipient addresses. This eliminates the recipient pattern as an item used
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring bounce verification & tagging to determine if the rule matches an email message.
4 Click OK.
Example: Manual greylist entries (exemptions)
Example Corporation uses a FortiMail unit that is operating in gateway mode, and uses greylisting to reduce the quantity of spam they receive at their protected domain, example.com.
Example Corporation wants to exempt some email from the initial greylist delay period by creating manual greylist entries (exemptions to the automatic greylisting process) that match trusted combinations of SMTP client IP addresses and recipient email addresses.
The manual greylist entries used by Example Corporation are shown in Figure 255 .
Figure 255: A sample greylist exemption list
Rule 1
Example Corporation has a number of foreign offices. Email from these offices does not need to be greylisted.The IP addresses of email servers in the foreign offices vary, though their host names all begin with “mail” and end with “example.com”.
Rule 1 uses the recipient pattern and the reverse DNS pattern to exempt from the automatic greylisting process all email messages that are sent to recipients at example.com, and are being delivered by an email server with a host name beginning with
“mail” and ending with “example.com”.
Rule 2
Example Corporation works closely with a partner organization, Example Org, whose email domain is example.org. Email from the example.org email servers does not need to be greylisted. The IP addresses of email servers for example.org are within the
172.20.120.0/24 subnet, and have a host name of mail.example.org.
Rule 2 uses the recipient pattern, sender IP/ netmask, and reverse DNS pattern to exempt from the automatic greylisting process all email messages that are sent to recipients at example.com by any email server whose IP address is between 172.20.120.1 and
172.20.120.255 and whose host name is mail.example.org.
Configuring bounce verification & tagging
The Bounce Verification submenu enables you to configure bounce address tagging and verification.
Spammers sometimes fraudulently use others’ email addresses as the sender email address in the message envelope (MAIL FROM:) when delivering spam. When an email cannot be delivered, email servers often return a a delivery status notification (DSN) message, sometimes also known as a bounce message, to the sender email address located in the message envelope. While DSNs are normally useful in notifying email users when an email could not be delivered, in this case, it could result in delivery of a DSN to an email user who never actually sent the original message. Because the invalid bounce message is from a valid email server, it can be difficult to detect as invalid.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
409
Configuring bounce verification & tagging
410
AntiSpam
You can combat this problem with bounce address tagging and verification. If the FortiMail unit tags outgoing email, it can verify the tags of incoming bounce messages to guarantee that the bounce message is truly in reply to a previous outgoing email.
For a FortiMail unit to perform bounce address tagging, the following must be true:
• bounce verification is enabled
• a bounce address key must exist and be activated
• in the protected domain to which the sender belongs, the Bypass bounce verification
option is disabled (see
“Configuring protected domains” on page 211
)
The FortiMail unit will use the currently activated key to generate bounce address tags for all outgoing email. You can create multiple keys, but only one can be activated at any given time.
The activated private key is used, together with randomizing data, to generate the tag that is applied to the sender email address in the message envelope, also known as the bounce address, of all outgoing messages. The format of tagged sender email addresses is: [email protected]
where the sender email address is [email protected] and the prefix is the bounce address tag. The tag is different for every email message, and uniquely identifies the email message.
Note: Bounce address tagging is applied to the sender email address in the message envelope only; it is not applied to the sender email address in the message header.
If the email server for the recipient email domain cannot deliver the email, it will send a bounce message whose recipient is the tagged email address. When the bounce message arrives at the FortiMail unit, it will use the private keys to verify the bounce address tag. Incoming email is subject to bounce verification if all of the following is true:
• bounce verification is enabled
• at least one bounce address key exists
• in the protected domain to which the recipient belongs, the Bypass Bounce Verification option is disabled (see
“Configuring protected domains” on page 211
)
• in the session profile, the Bypass Bounce Verification check option is disabled (see
“Configuring session profiles” on page 285
)
• the sender email address (MAIL FROM:) in the message envelope is empty
Note: The sender email address is typically empty for bounce messages. The sender email address may also be empty for some types of spam that are not bounce messages.
Because the sender email addresses of those types of spam will not have a proper tag, similar to bounce message spam, these spam will fail the bounce verification process.
Email sent from email clients or webmail will not have an empty sender email address, and therefore will not be subject to the bounce verification process.
If the tag is successfully verified, the bounce verification scan removes the tag, restoring the recipient email address to one known by the protected domain, and allows the bounce message.
If the tag is not successfully verified, the bounce verification scan will perform the action
that you have configured for invalid bounce messages in Bounce verification action.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring bounce verification & tagging
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of bounce address keys or to configure bounce verification, go to
AntiSpam > Bounce Verification > Settings.
Figure 256: Configuring bounce tagging keys and other BATV settings
Delete
Key
Status
Last Used
Enable bounce verification
Bounce verification tag expires in
To remove a key, click to select it, then click Delete. This option does not appear if the Status of the key is Active.
Note: If you delete a key, any email with a tag generated when that key was active will fail bounce verification. After activating a new key, keep the previously active key until any tags generated with the old key expire.
The string of text that is the private key. This can be any arbitrary string of text, and will be used together with randomizing data to generate each bounce address tag.
Indicates which key is activated for use.
• Active: The key is activated.
• Inactive: The key is deactivated.
Only one of the keys may be activated at any given time. The activated key is the one that will be used to generate the bounce address tags for outgoing email. Both activated and deactivated keys will be used for bounce address tag verification of incoming email.
To activate or deactivate a key, double-click it and modify its Status.
The date and time when the key was generated or last used to verify the bounce address tag of an incoming email, whichever is later.
Mark this check box to enable verification of bounce address tags for all incoming email.
If you want to make exceptions for email that does not require bounce address tag verification, you can bypass bounce verification in protected domains and session profiles. For more information, see
“Configuring protected domains” on page 211 and
“Configuring session profiles” on page 285
.
Enter the number of days after creation when bounce message keys will expire and their resulting tags will fail verification.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
411
Configuring endpoint reputation AntiSpam
Keys will be automatically removed
The period of time after which unused, deactivated keys will be automatically removed.
The activated key will not be automatically removed.
Bounce verification action Select which action that a FortiMail unit will perform when an incoming email fails bounce address tagging verification, either:
• Reject: Reject delivery of the email and respond to the SMTP client with SMTP reply code 550 (Relaying denied).
• Discard: Accept the email, but silently delete it and do not deliver it. Do not inform the SMTP client.
• Use antiSpam profile setting: Use the actions configured in the antispam profile that you selected in the policy that matches the email message. For more information on actions, see
“Configuring antispam action profiles” on page 312
.
To configure a bounce address tagging and verification key
1 Go to AntiSpam > Bounce Verification > Settings.
2 Click New to add a key, or double-click to select a key that you want to modify.
3 Configure the following:
Figure 257: Configuring a bounce tagging and verification key
Key
Status
Enter the string of text that will be used together with randomizing data in order to generate each bounce address tag. Keys must not be identical.
This field is cannot be modified after a key is created. Instead, you must create a new key. If you are certain that no email has used a key, and therefore no bounce messages can exist which would require tag verification, you can safely delete that key.
Select the activation status of the key.
• Active: The key will be activated, and used to generate bounce address tags for outgoing messages. If any other key is currently activated, it will be deactivated when this new key is saved and activated.
• Inactive: The key will be deactivated. You can activate the key at a later time.
Only one of the keys may be activated at any given time.The activated key is the one that will be used to generate tags for outgoing messages. Both activated and deactivated keys will be used for bounce address tag verification of incoming email.
4 Click Create.
Configuring endpoint reputation
The Endpoint Reputation submenu enables you to manually blacklist carrier end points, to exempt them from automatic blacklisting due to their reputation score, and to view the list of automatically blacklisted carrier end points.
This topic includes:
•
•
Manually blacklisting endpoints
•
Exempting endpoints from endpoint reputation
412
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring endpoint reputation
•
Configuring the endpoint reputation score window
About endpoint reputation
A carrier end point is any device on the periphery of a carrier’s or Internet service provider’s (ISP) network. It could be, for example, a subscriber’s GSM cellular phone, wireless PDA, or computer using DSL service.
Figure 258: Carrier end points
Modem / DSL / Cable
Mobile Phone
Computer
Remote Laptop
Internet
Protected Server
VPN
Remote Laptop
Unlike MTAs, computers in homes and small offices and mobile devices such as laptops and cellular phones that send email may not have a static IP address. Cellular phones’ IP addresses especially may change very frequently. After a device leaves the network or changes its IP address, its dynamic IP address may be reused by another device.
Because of this, a sender reputation score that is directly associated with an SMTP client’s
IP address may not function well. A device sending spam could start again with a clean sender reputation score simply by rejoining the network to get another IP address, and an innocent device could be accidentally blacklisted when it receives an IP address that was previously used by a spammer.
To control spam from SMTP clients with dynamic IP addresses, you may be able to use the endpoint reputation score method instead.
The endpoint reputation score method does not directly use the IP address as the SMTP client’s unique identifier. Instead, it uses the subscriber ID, login ID, MSISDN, or other identifier. (An MSISDN is the number associated with a mobile device, such as a SIM card on a cellular phone network.) The IP address is only temporarily associated with this identifier while the device is joined to the network.
When a device joins the network of its service provider, such as a cellular phone carrier or
DSL provider, it may use a protocol such as PPPoE or PPPoA which supports authentication. The network access server (NAS) queries the remote authentication dial-in user server (RADIUS) for authentication and access authorization. If successful, the
RADIUS server then creates a record which associates the device’s MSISDN, subscriber
ID, or other identifier with its current IP address.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
413
Configuring endpoint reputation
414
AntiSpam
The server, next acting as a RADIUS client, sends an accounting request with the mapping to the FortiMail unit. (The FortiMail unit acts as an auxiliary accounting server if the endpoint reputation daemon is enabled.) The FortiMail unit then stores the mappings, and uses them for the endpoint reputation feature.
When the device leaves the network or changes its IP address, the RADIUS server acting as a client requests that the FortiMail unit stop accounting (that is, remove its local record of the IP-to-MSISDN/subscriber ID mapping). The FortiMail unit keeps the reputation score associated with the MSISDN or subscriber ID, which will be re-mapped to the new
IP address upon the next time that the mobile device joins the network.
The endpoint reputation feature can be used with traditional email, but it can also be used with MMS text messages.
The multimedia messaging service (MMS) protocol transmits graphics, animations, audio, and video between mobile phones. There are eight interfaces defined for the MMS standard, referred to as MM1 through MM8. MM3 uses SMTP to transmit text messages to and from mobile phones. Because it can be used to transmit content, spammers can also use MMS to send spam.
You can blacklist MSISDNs or subscriber IDs to reduce MMS and email spam.
In addition to manually blacklisting or exempting MSISDNs and subscriber IDs, you can configure automatic blacklisting based upon endpoint reputation score. If a carrier end point sends email or text messages that the FortiMail unit detects as spam, the endpoint reputation score increases. You can configure session profiles to log or block, for a period of time, email and text messages from carrier end points whose endpoint reputation score exceeds the threshold during the automatic blacklisting window. For information on enabling endpoint reputation scans in session profiles and configuring the score threshold and automatic blacklisting duration, see
“Configuring session profiles” on page 285
. For
.
General steps to use endpoint reputation
1 Enter the following CLI command to start the endpoint reputation daemon: config antispam setting set carrier-endpoint-status enable end
2 On the web-based manager, go to AntiSpam > Endpoint Reputation and configure the
settings described in “Manually blacklisting endpoints” on page 414 ,
“Exempting endpoints from endpoint reputation” on page 416
, and “Configuring the endpoint reputation score window” on page 418
.
3 Go to Profile > Session > Session. Mark the check box of the Enable Endpoint
Reputation option, then select either Reject or Monitor from Action. For details, see
“Configuring session profiles” on page 285
.
4 Go to Policy > Policies > IP Policies. Select the session profile in an IP-based policy.
For details, see
“Controlling email based upon IP addresses” on page 278
.
5 If you enable antispam, antivirus, and history logging, you can go to Monitor > Log to view endpoint reputation-related log messages. For details, see
“Configuring logging” on page 438 and
“Viewing log messages” on page 83 .
Manually blacklisting endpoints
The Blacklist tab enables you to manually blacklist carrier end points by subscriber ID,
MSISDN, or other identifier.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring endpoint reputation
MSISDN numbers or subscriber IDs listed on the black list will have their email or text messages blocked as long as their identifier appears on the black list.
Note: You can alternatively blacklist subscriber IDs or MSISDNs automatically, based upon
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the manual carrier endpoint black list, go to AntiSpam > Endpoint Reputation >
Blacklist.
Figure 259: Manually blacklisting an endpoint
Search Click to filter the displayed entries. For more information, see
“Filtering manual endpoint black list entries” on page 415 .
(No column heading.) The index number of the entry in the list.
Endpoint ID The mobile subscriber IDSN (MSISDN), subscriber ID, login ID, or other unique identifier for the carrier end point.
To add an endpoint to the manual black list
1 Go to AntiSpam > Endpoint Reputation > Blacklist.
2 Either click New to add an entry, or double-click to select an entry that you want to modify.
3 Configure the following:
Figure 260: Configuring a new blacklisted endpoint
Endpoint ID Type the MSISDN, subscriber ID, or other identifier for the carrier end point that you want to add to the list.
4 Click OK.
Filtering manual endpoint black list entries
You can filter manual endpoint blacklist entries that appear on the Blacklist tab based upon the MSISDN, subscriber ID, or other identifier of the sender.
To filter entries
1 Go to AntiSpam > Endpoint Reputation > Blacklist.
2 Click Search.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
415
Configuring endpoint reputation
3 Configure the following:
Figure 261: Filtering the manual endpoint black list entries
AntiSpam
416
Endpoint ID Enter the identifier of the carrier end point, such as the subscriber ID or
MSISDN, for the entry or entries that you want to display.
A blank field matches any value. Use an asterisk (*) to match multiple patterns, such as typing 46* to match 46701123456, 46701123457, and so forth. Regular expressions are not supported.
4 Click Search.
The Blacklist tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Blacklist tab to refresh its view.
Exempting endpoints from endpoint reputation
The Exempt tab enables you to manually exempt carrier end points (by MSISDN, subscriber ID, or other identifiers) from automatic blacklisting due to their endpoint reputation score.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of exempt MSISDNs, go to AntiSpam > Endpoint Reputation > Exempt.
Figure 262: Viewing the list of endpoint reputation exemptions
Search Click to filter the displayed entries. For more information, see
“Filtering manual endpoint reputation exempt entries” on page 417 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Configuring endpoint reputation
(No column heading.) The index number of the entry in the list.
Endpoint ID The mobile subscriber IDSN (MSISDN), subscriber ID, login ID, or other unique identifier for the carrier end point.
To configure an endpoint reputation exemption
1 Go to AntiSpam > Endpoint Reputation > Exempt.
2 Either click New to add an entry, or double-click to select an entry that you want to modify.
3 Configure the following:
Figure 263: Configuring an endpoint reputation exemption
Endpoint ID Type the MSISDN, subscriber ID, or other identifier for the carrier end point that you want to add to the list, then click Add. The entry appears in the MSISDN List area.
4 Click Create.
Filtering manual endpoint reputation exempt entries
You can filter endpoint reputation exemptions that appear on the Exempt tab based upon the MSISDN, subscriber ID, or other identifier of the carrier end point.
To filter entries
1 Go to AntiSpam > Endpoint Reputation > Exempt.
2 Click Search.
3 Configure the following.
Figure 264: Search MSISDN
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
417
Configuring endpoint reputation AntiSpam
Endpoint ID Enter the identifier of the carrier end point, such as the subscriber ID or
MSISDN, for the entry that you want to display.
A blank field matches any value. Use an asterisk (*) to match multiple patterns, such as typing 46* to match 46701123456, 46701123457, and so forth. Regular expressions are not supported.
4 Click Search.
The Exempt tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Exempt tab to refresh its view.
Configuring the endpoint reputation score window
The Settings tab enables you to configure the window size for calculating the reputation score for automatic endpoint reputation-based blacklisting.
In addition to manually blacklisting or exempting carrier end points based upon their
MSISDNs or subscriber IDs, you can configure automatic blacklisting based upon endpoint reputation score. If an MSISDN or subscriber ID sends email or text messages that the FortiMail unit detects as spam or infected, the endpoint reputation score increases. You can configure session profiles to log or block, for a period of time, email and text messages from carrier end points whose reputation score exceeds the threshold during the automatic blacklisting window. For information on enabling endpoint reputation scans in session profiles and configuring the score threshold and automatic blacklisting duration, see
“Configuring session profiles” on page 285
.
For more information on the role of the automatic blacklisting window in the endpoint
reputation scan, see “Configuring endpoint reputation” on page 412
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the automatic endpoint blacklisting window, go to AntiSpam >
Endpoint Reputation > Settings.
Figure 265: Configuring the endpoint reputation score window
Auto blacklist window size
Enter the amount of time previous, in minutes, whose score-increasing events will be used to calculate the current endpoint reputation score.
For example, if the window were 15, detections of spam or viruses 0-15 minutes ago would count towards the current score; detections of spam or viruses older than 15 minutes ago would not count towards the current score.
418
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
Training & maintaining the Bayesian databases
Bayesian scanning uses databases to determine if an email is spam. For Bayesian scanning to be effective, the databases must be trained with known-spam and knowngood email messages so the scanner can learn the differences between the two types of email. To maintain its effectiveness, false positives and false negatives must be sent to the
FortiMail unit so the Bayesian scanner can learn from its mistakes.
Caution: Be aware that, without ongoing training, Bayesian scanning will become significantly less effective over time and thus Fortinet does not recommend enabling the
Bayesian scanning feature.
The FortiMail Bayesian scanner uses three types of databases: personal, group, and global. Personal databases are associated with individual users, the group database applies to all users in a domain, and the global database applies to all users hosted on
.
AntiSpam > Bayesian enables you to manage the databases used to store statistical information for Bayesian antispam processing, and to configure the email addresses used for remote control and training of the Bayesian databases.
To use a Bayesian database, you must enable the Bayesian scan in the antispam profile.
For more information, see
“Configuring antispam profiles” on page 297
.
This topic includes:
•
•
Training the Bayesian databases
•
•
Backing up, batch training, & monitoring the Bayesian databases
•
Configuring the Bayesian training control accounts
•
Types of Bayesian databases
FortiMail units can have up to three types of Bayesian databases:
•
•
•
All types contain Bayesian statistical data that can be used by Bayesian scans to detect spam, and should be trained in order to be most accurate for detecting spam within their respective scopes. For more information on training each type of Bayesian database, see
“Training the Bayesian databases” on page 421 .
Only one Bayesian database is used by any individual Bayesian scan; which type will be used depends on the directionality of the email and your configuration of the FortiMail unit’s protected domains and antispam profiles. For information, see
“Use global bayesian database” on page 221
and “Use personal database” on page 305
.
Global
The global Bayesian database is a single database that contains Bayesian statistics that can be used to detect spam for any email user.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
419
Training & maintaining the Bayesian databases AntiSpam
If all spam sent to all protected domains has similar characteristics and you do not require your Bayesian scans to be tailored specifically to the email of a protected domain or email user, using the global database for all Bayesian scanning may be an ideal choice, because there is only one database to train and maintain.
For email that does not require use of the global database, if you want to use the global database, you must disable use of the per-domain and per-user Bayesian databases. For information on configuring protected domains to use the global Bayesian database, see
“Use global bayesian database” on page 221
. For information on disabling use of per-user
Bayesian databases by incoming antispam profiles, see
“Use personal database” on page 305
.
Group
Group Bayesian databases, also known as per-domain Bayesian databases, contain
Bayesian statistics that can be used to detect spam for email users in a specific protected domain. FortiMail units can have multiple group Bayesian databases: one for each protected domain.
If you require Bayesian scans to be tailored specifically to the email received by each protected domain, using per-domain Bayesian databases may provide greater accuracy and fewer false positives.
For example, medical terms are a common characteristic of many spam messages.
However, those terms may be a poor indicator of spam if the protected domain belongs to a hospital. In this case, you may want to train a separate, per-domain Bayesian database in which medical terms are not statistically likely to indicate spam.
If you want to use a per-domain database, you must disable use of the global and per-user
Bayesian databases. For information on disabling use of the global Bayesian database for
a protected domain, see “Use global bayesian database” on page 221 . For information on
.
User
User Bayesian databases, also known as personal or per-user Bayesian databases, contain Bayesian statistics that can be used to detect spam for individual email users or alias email addresses. FortiMail units can have multiple user Bayesian databases: one for each recipient email address.
Per-user Bayesian databases are separate for each email address on each protected domain. For example, if example.com and example.org are defined as protected domains, [email protected] and [email protected] will have separate per-user Bayesian databases, even if both email addresses belong to the same person.
If you require Bayesian scans to be tailored specifically to the email received by each email user, using per-user Bayesian databases may provide greater accuracy and fewer false positives.
For example, stock quotes are a common characteristic of many spam messages.
However, those terms may be a poor indicator of spam if the email user is a financial advisor. In this case, for that email user, you may want to train a separate, per-user
Bayesian database in which stock quotes are not statistically likely to indicate spam.
Note: For improved performance, consider using per-user Bayesian databases only when scanning email for email users whose notion of spam and non-spam email is significantly different than that of the other email users.
420
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
If you want to use a per-user database, you must enable the use of per-user Bayesian databases. For information on enabling use of per-user Bayesian databases by incoming antispam profiles, see
“Use personal database” on page 305
. Unlike global and perdomain Bayesian databases, for per-user Bayesian databases, you must also verify that the per-user Bayesian database has reached maturity. For more information, see
“Training the Bayesian databases” on page 421
.
Training the Bayesian databases
Bayesian scans analyze the words (or “tokens”) in an message header and message body of an email to determine the probability that it is spam. For every token, the FortiMail unit calculates the probability that the email is spam based upon the percentage of times that the word has previously been associated with spam or non-spam email. If a Bayesian database has not yet been trained, the Bayesian scan does not yet know the spam or nonspam association of many tokens, and does not have enough information to determine the statistical likelihood of an email being spam. By training a Bayesian database to recognize words that are and are not likely to be associated with spam, Bayesian scans become increasingly accurate.
However, spammers are constantly trying to invent new ways to defeat antispam filters. In one technique commonly used in attempt to avoid antispam filters, spammers alter words commonly identified as characteristic of spam, inserting symbols such as periods ( . ), or using nonstandard but human-readable spellings, such as substituting Â, Ç, Ë, or Í for A,
C, E or I. These altered words are technically different tokens to a Bayesian database, so mature Bayesian databases may require some ongoing training to recognize new spam tokens.
You generally will not want to enable Bayesian scans until you have performed initial training of your Bayesian databases, as using untrained Bayesian databases can increase your rate of spam false positives and false negatives. Unlike global and per-domain
Bayesian databases, however, per-user databases cannot be used until they are mature
— that is, until they have been sufficiently trained. A user Bayesian database is considered to be mature when it has been trained with a minimum of 100 spam messages and 200 non-spam messages. If you have enabled use of per-user Bayesian databases but a per-user database is not yet mature, the Bayesian scanner will instead use either the global or per-domain database, whichever is enabled for the protected domain. You can determine whether a per-user Bayesian database is mature by viewing the database training level summary. For more information, see
“Backing up, batch training, & monitoring the Bayesian databases” on page 424
.
To initially train the Bayesian databases
1 Train the global database by uploading mailbox (.mbox) files. For details, see
“Backing up, batch training, & monitoring the Bayesian databases” on page 424
.
By uploading mailbox files, you can provide initial training more rapidly than through the Bayesian control email addresses. Training the global database ensures that outgoing antispam profiles in which you have enabled Bayesian scanning, and incoming antispam profiles for protected domains that you have configured to use the global database, can recognize spam.
Note: If you have configured the FortiMail unit for email archiving, you can make mailbox
files from archived email and spam. For details, see “Managing archived email” on page 81 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
421
Training & maintaining the Bayesian databases
422
AntiSpam
You can leave the global database untrained if both these conditions are true:
• no outgoing antispam profile has Bayesian scanning enabled
• no protected domain is configured to use the global Bayesian database
2 Train the per-domain databases by uploading mailbox (.mbox) files. For details, see
“Backing up, batch training, & monitoring the Bayesian databases” on page 424 .
By uploading mailbox files, you can provide initial training more rapidly than through the Bayesian control email addresses. Training per-domain databases ensures that incoming antispam profiles for protected domains that you have configured to use the per-domain database can recognize spam.
You can leave a per-domain database untrained if either of these conditions are true:
• the protected domain is configured to use the global Bayesian database
• no incoming antispam profiles exist for the protected domain
3 If you have enabled incoming antispam profiles to train Bayesian databases when the
FortiMail unit receives training messages, and have selected those antispam profiles in recipient-based policies that match training messages, instruct FortiMail administrators and email users to forward sample spam and non-spam email to the Bayesian control email addresses. For more information, see
“Configuring the Bayesian training control accounts” on page 429 ,
“Accept training messages from users” on page 306 , and
“Training Bayesian databases” on page 479
.
Note: Before instructing email users to train the Bayesian databases, verify that you have enabled the FortiMail unit to accept training messages. If you have not enabled the “Accept training messages from users” option in the antispam profile for policies which match training messages, the training messages will be discarded without notification to the sender, and no training will occur.
FortiMail units apply training messages to either the global or per-domain Bayesian database, whichever is enabled for the sender’s protected domain. If per-user
Bayesian databases are enabled, training messages are also applied to the sender’s per-user Bayesian database.
Note: To more quickly train per-user databases to a mature state, you can also configure the FortiMail unit to use scan results from other antispam methods to train per-user
Bayesian databases. For more information, see “Use other techniques for auto training” on page 306
.
Example: Bayesian training
In this example, Company X has set up a FortiMail unit to protect its email server. With over 1,000 email users, Company X plans to enable Bayesian scanning for incoming email. You, the system administrator, have been asked to configure Bayesian scanning, perform initial training of the Bayesian databases, and configure Bayesian control email addresses for ongoing training.
The local domain name of the FortiMail unit itself is example.com.
Company X has email users in two existing protected domains:
• example.net
• example.org
Each of these protected domains receives email with slightly different terminology, which could be considered spam to the other protected domain, and so will use separate perdomain Bayesian databases. Email users prefer not to maintain their own personal
Bayesian databases, and so will instead together maintain the per-domain Bayesian databases.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
To facilitate initial training of each per-domain Bayesian database, you have used your email client software to collect samples of spam and non-spam email from each protected domain, and exported them into mailbox files:
• example-net-spam.mbox
• example-net-not-spam.mbox
• example-org-spam.mbox
• example-org-not-spam.mbox
After initial training, email users will use the default Bayesian control email addresses to perform any required ongoing training for each of their per-domain Bayesian databases.
To enable use of per-domain Bayesian databases
1 Go to Mail Settings > Domains > Domains.
2 In the row corresponding to example.net, click Edit.
3 Click the arrow to expand Advanced AS/AV Settings.
4 Disable the option Use Global Database.
5 Click OK.
Repeat the above steps for the protected domain example.org.
To perform initial training of each per-domain Bayesian database using mailbox files
1 Go to AntiSpam > Bayesian > User.
2 From Select a domain, select example.net.
3 In the Operations area, click Train group bayesian database with mbox files.
4 In Innocent Mailbox, click Browse and locate example-net-not-spam.mbox, then click
OK.
5 In Spam Mailbox, click Browse and locate example-net-spam.mbox, then click OK.
6 Click OK.
Repeat the above steps for the protected domain example.org and its sample
Bayesian database files.
To enable Bayesian scanning
1 Go to Profile > AntiSpam > Incoming.
2 In the row corresponding to an antispam profile that is selected in a policy that matches recipients in the protected domain example.net, click Edit.
3 Enable Bayesian scan.
4 Click the arrow to expand Bayesian scan.
5 Disable the option Use personal database.
6 Enable the option Accept training messages from users.
7 Click OK.
Repeat the above steps for all incoming antispam profiles that are selected in policies that match recipients in the protected domain example.org.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
423
Training & maintaining the Bayesian databases
424
AntiSpam
To perform ongoing training of each per-domain Bayesian database
Note: This procedure assumes the default Bayesian control email addresses. To configure the Bayesian control email addresses, go to AntiSpam > Bayesian > Control Account.
1 Notify email users that they can train the Bayesian database for their protected domain by sending them an email similar to the following:
All employees,
We have enabled a new email system feature that can be trained to recognize the differences between spam and legitimate email.
You can help to train this feature. This message describes how to train our email system.
If you have old email messages and spam...
• Forward the old spam to [email protected] from your company email account.
• Forward any old email messages that are not spam to [email protected] from your company email account.
If you receive any new spam, or if a legitimate email is mistakenly classified as spam...
• Forward spam that was not recognized to [email protected] from your company email account.
• Forward legitimate email that was incorrectly classified as spam to [email protected] from your company email account.
2 Notify other FortiMail administrators that they can train the per-domain Bayesian databases for those protected domains by forwarding email to the Bayesian control accounts, described in the previous step. To do so, they must configure their email client software with the following sender addresses:
For example, when forwarding a training message from the sender (From:) email address [email protected], the FortiMail unit will apply the training message to the per-domain Bayesian database of example.net.
Backing up, batch training, & monitoring the Bayesian databases
The User tab enables you to train, back up, restore, and reset the global, per-domain, and per-user Bayesian databases. It also enables you to view a summary of the number of email messages that have been used to train each Bayesian database.
Note: You can alternatively train Bayesian databases by forwarding spam and non-spam
email to Bayesian control email addresses. For more information, see “Training the
Bayesian databases” on page 421
.
Note: You can alternatively back up, restore, and reset all Bayesian databases at once. For
more information, see “Backup and restore” on page 97
.
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Policy category.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
Note: Domain administrators can access the global Bayesian database, and therefore could affect domains other than their own. If you do not want to permit this, do not provide
Read-Write permission to the Policy category in domain administrators’ access profile.
For details, see “About administrator account permissions & domains” on page 144 .
To individually train and manage Bayesian databases, go to AntiSpam > Bayesian > User.
Figure 266: Accessing the global Bayesian database
Figure 267: Accessing a per-domain or per-user Bayesian database
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
425
Training & maintaining the Bayesian databases AntiSpam
Select a domain
Global Bayesian or
Group User or
User
User
Summary
Operations
Select System to manage the global Bayesian database, or select a protected domain to manage its per-domain Bayesian database.
For information on creating domains, see “Configuring protected domains” on page 211
.
The global, per-domain, or per-user type of the Bayesian
database. For more information, see “Types of Bayesian databases” on page 419
.
For per-domain Bayesian databases, if you have configured the protected domain to use the global Bayesian database instead of its own per-domain Bayesian database, “This domain is using global bayesian.” appears. For more information, see
“Use global bayesian database” on page 221
.
Total numbers of email messages that the Bayesian database has learned as spam and not spam.
If the Summary values are “0” if the Bayesian database has not been trained.
Alert: User spam classification is not effective appears for per-user Bayesian databases if the per-user
Bayesian database has not yet reached maturity, and cannot yet be used. For more information on maturity of per-user Bayesian
databases, see “Training the Bayesian databases” on page 421
.
Click one of the links to train, restore, back up, or reset a
Bayesian database. For more information, see:
•
“To train a Bayesian database using mailbox files” on page 427
• “To back up a Bayesian database” on page 427
•
“To restore a Bayesian database” on page 428
• “To reset a Bayesian database” on page 429
These options do not appear for per-domain Bayesian databases if you have configured the protected domain to use the global
Bayesian database instead of its own per-domain Bayesian database.
Enter a user name and click OK to display the Summary and
Operation areas for a per-user Bayesian database.
This option is not available if Select a domain is System.
To view the training status of a Bayesian database
1 Go to AntiSpam > Bayesian > User.
2 Select the type of the Bayesian database whose training status you want to view.
• For the global Bayesian database, from Select a domain, select System.
• For a per-domain Bayesian database, from Select a domain, select the name of the protected domain, such as example.com.
• For a per-user Bayesian database, from Select a domain, select the name of the protected domain to which the email user belongs, then, in Username, type the user name portion of their email address, such as user1, and click OK.
The Summary area displays the total number of email messages that the Bayesian database has learned as spam or not spam. For per-user Bayesian databases, if the
FortiMail unit cannot currently use the database because it is not considered to be mature, the Summary area will also display Alert: User spam classification is not
effective. For more information on maturity of per-user Bayesian databases, see
“Training the Bayesian databases” on page 421
.
426
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
To train a Bayesian database using mailbox files
Uploading mailbox files trains a Bayesian database with many email messages at once, which is especially useful for initial training of the Bayesian database until it reaches maturity. Because this method appends to the Bayesian database rather than overwriting, you may also perform this procedure periodically with new samples of spam and non-spam email for batch maintenance training.
Note: If you have configured the FortiMail unit for email archiving, you can make mailbox
files from archived email and spam. For details, see “Managing archived email” on page 81 .
1 Go to AntiSpam > Bayesian > User.
2 Select the type of the Bayesian database that you want to train.
• For the global Bayesian database, from Select a domain, select System.
• For a per-domain Bayesian database, from Select a domain, select the name of the protected domain, such as example.com.
• For a per-user Bayesian database, from Select a domain, select the name of the protected domain to which the email user belongs, then, in User, type the user name portion of their email address, such as user1.
3 In the Operation area, click the link appropriate to the type that you selected in the previous step, either:
• Train global bayesian database with mbox files
• Train group bayesian database with mbox files
• Train user bayesian database with mbox files
A pop-up window appears enabling you to specify which mailbox files to upload.
4 In the Innocent Mailbox field, click Browse, then select a mailbox file containing email that is not spam.
5 In the Spam Mailbox field, click Browse, then select a mailbox file containing email that is spam.
6 Click OK.
Your management computer uploads the file to the FortiMail unit to train the database, and the pop-up window closes. Time required varies by the size of the file and the speed of your network connection. To update the training summary display in the
Summary area with the new number of learned spam and non-spam messages, refresh the page by selecting the tab.
To back up a Bayesian database
1 Go to AntiSpam > Bayesian > User.
2 Select the type of the Bayesian database that you want to train.
• For the global Bayesian database, from Select a domain, select System.
• For a per-domain Bayesian database, from Select a domain, select the name of the protected domain, such as example.com.
• For a per-user Bayesian database, from Select a domain, select the name of the protected domain to which the email user belongs, then, in User, type the user name portion of their email address, such as user1.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
427
Training & maintaining the Bayesian databases AntiSpam
3 In the Operation area, click the link appropriate to the type that you selected in the previous step, either:
• Backup global bayesian database
• Backup group bayesian database
• Backup user bayesian database
A pop-up window appears enabling you to download the database backup file.
4 Click Download user bayesian database file.
5 If your web browser prompts you, select a location in which to save the database backup file.
The Bayesian database backup file is downloaded to your management computer.
Time required varies by the size of the file and the speed of your network connection.
6 Click OK.
To restore a Bayesian database
Caution: Back up the Bayesian database before beginning this procedure. Restoring a
Bayesian database replaces all training data stored in the database. For more information on backing up Bayesian database files, see “To back up a Bayesian database” on page 427 or
“Backup and restore” on page 97 .
1 Go to AntiSpam > Bayesian > User.
2 Select the type of the Bayesian database that you want to train.
• For the global Bayesian database, from Select a domain, select System.
• For a per-domain Bayesian database, from Select a domain, select the name of the protected domain, such as example.com.
• For a per-user Bayesian database, from Select a domain, select the name of the protected domain to which the email user belongs, then, in User, type the user name portion of their email address, such as user1.
3 In the Operation area, click the link appropriate to the type that you selected in the previous step, either:
• Restore global bayesian database
• Restore group bayesian database
• Restore user bayesian database
A pop-up window appears enabling you to upload a database backup file.
4 Click Browse to locate and select the Bayesian database backup file, then click OK.
5 Click OK.
The Bayesian database backup file is uploaded from your management computer, and a success message appears. Time required varies by the size of the file and the speed of your network connection.
If a database operation error message appears, you can attempt to repair database errors. For more information, see
“Backup and restore” on page 97 .
6 Click OK.
428
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
AntiSpam Training & maintaining the Bayesian databases
To reset a Bayesian database
Caution: Back up the Bayesian database before beginning this procedure. Resetting a
Bayesian database deletes all training data stored in the database. For more information on backing up Bayesian database files, see “To back up a Bayesian database” on page 427 or
“Backup and restore” on page 97 .
1 Go to AntiSpam > Bayesian > User.
2 Select the type of the Bayesian database that you want to train.
• For the global Bayesian database, from Select a domain, select System.
• For a per-domain Bayesian database, from Select a domain, select the name of the protected domain, such as example.com.
• For a per-user Bayesian database, from Select a domain, select the name of the protected domain to which the email user belongs, then, in User, type the user name portion of their email address, such as user1.
3 In the Operation area, click the link appropriate to the type that you selected in the previous step, either:
• Reset global bayesian database
• Reset group bayesian database
• Reset user bayesian database
A pop-up window appears enabling you to reset the contents of the database.
4 Click OK.
A status message notifies you that the FortiMail unit has emptied the contents of the
Bayesian database.
Configuring the Bayesian training control accounts
The Control Account tab enables you to configure the email addresses used for remote training of the Bayesian databases.
To train the Bayesian databases through email, email users and FortiMail administrators forward spam and non-spam email (also called training messages) to the appropriate
Bayesian control email address. Bayesian control email addresses consist of the user name portion (also known as the local-part) of the email address configured on this tab and the local domain name of the FortiMail unit. For example, if the local domain name of the FortiMail unit is example.com, you might forward spam to [email protected].
If the FortiMail unit is configured to accept training messages, it will use the email to train one or more Bayesian databases. To accept a training message:
• The training message must match a recipient-based policy.
• The matching recipient-based policy must specify use of an antispam profile in which the “Accept training messages from users” option is enabled. For more information, see
“Accept training messages from users” on page 306 .
If either of these conditions are not met, the FortiMail unit will silently discard the training message without using them for training.
If these conditions are both met, the FortiMail unit accepts the training message and examines the user name portion and domain name portion of the sender address. Two factors determine which Bayesian database or databases will be trained:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
429
Training & maintaining the Bayesian databases AntiSpam
• whether the sender’s protected domain is configured to use the global or per-domain
Bayesian database (see “Use global bayesian database” on page 221
)
)
Depending on those factors, the FortiMail unit uses the training message to train either the global or per-domain Bayesian database, and may also train the per-user Bayesian database.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the Bayesian control email addresses, go to AntiSpam > Bayesian >
Control Account.
Figure 268: Configuring the Bayesian training control accounts
430
"is really spam" user name
Enter the user name portion of the email address, such as is-spam, to which email users will forward spam false negatives.Forwarding false negatives corrects the Bayesian database when it inaccurately classifies spam as being legitimate email.
"is not really spam" user name
Enter the user name portion of the email address, such as is-not-spam, to which email users will forward spam false positives.Forwarding false positives corrects the Bayesian database when it inaccurately classifies legitimate email as being spam.
"learn is spam" user name
Enter the user name portion of the email address, such as learn-is-spam, to which email users will forward spam that the Bayesian scanner has not previously scanned.
"learn is not spam" user name
Enter the user name portion of the email address, such as learn-is-not-spam, to which email users will forward spam that the
Bayesian scanner has not previously scanned.
training group Enter the user name portion of the email address, such as default-grp, that FortiMail administrators can use as their sender email address when forwarding email to the “learn is spam” email address or “learn is not spam” email address. Training messages sent from this sender email address will be used to train the global or per-domain Bayesian database (whichever is selected in the protected domain) but will not train any per-user Bayesian database.
In contrast, if a FortiMail administrator were to forward email using their own email address (rather than the training group email address) as the sender email address, and per-user Bayesian databases were enabled in the corresponding incoming antispam profile, the FortiMail unit would also apply the training message to their own per-user Bayesian database.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Email Archiving Configuring global email archive settings
Email Archiving
The Email Archiving menu enables you to enable and email archiving, and to manage and search archived email messages.
This topic includes:
•
Configuring global email archive settings
•
Configuring the email archiving policy
•
Configuring email archiving exemptions
Configuring global email archive settings
The Settings tab enables you to configure an email archive-specific administrator account, hard disk quota, and other assorted global settings for email archiving.
Before you can archive email, you need to set up and enable the email archiving account, as described below. The archived emails will be stored under the archiving account.
When email is archived, you can view and manage the archived email messages. For
more information, see “Managing archived email” on page 81 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
431
Configuring global email archive settings
Figure 269: Configuring email archiving settings
Email Archiving
432
To enable and configure the email archiving account
1 Go to Email Archiving > Settings > Archiving Settings.
2 In Account name and Password, enter an email archiving account name and password. The default value for both fields is archive.
3 In Forward to, if you require it, enter an email address to which the FortiMail unit will forward a copy of when it archives an email.
4 Enable Email archiving status.
5 Enter the Mailbox rotation size and Mailbox rotation time.
When the mailbox reaches either the rotation size or time specified, whichever comes first, the email archiving mailbox will be automatically renamed. The FortiMail unit will then generate a new mailbox file, where it will save the new email archives. You can still access all of the rotated mailboxes through search.
6 In Archiving options when disk quota is full, select either Overwrite, or Do not archive.
7 Select an archiving destination, either:
• Archive to local disk (the FortiMail unit’s local hard drive or a NAS server), or
• Archive to remote host (a remote FTP or SFTP storage server).
8 If you selected Archive to local disk, in Disk Quota, enter the disk space quota.
When email archives meet this quota, if a new email must be archived, the FortiMail unit will automatically remove the oldest email archive folder in order to make space for the new archive.
Note: If you have enabled mail data storage on a network attached storage (NAS) server,
Disk Quota is not applicable. For more information on NAS storage, see
“Selecting the mail data storage location” on page 208
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Email Archiving Configuring the email archiving policy
9 If you selected Archive to remote host, configure the following:
Protocol
IP address
User name
Password
Remote directory
Local cache quota
Select the protocol that the FortiMail unit will use to connect to the remote storage server, either SFTP or FTP.
Enter the IP address of the remote storage server.
Enter the user name of an account the FortiMail unit will use to access the remote storage server, such as fortimail.
Enter the password for the user name of the account on the remote storage server.
Enter the directory path on the remote storage server where the FortiMail unit will store archived email, such as /home/fortimail/email-archives.
Enter the quota for the size of the cache of email archives that the FortiMail unit will keep local copies of in order to improve the performance of email archive display and search.
Enter the disk space quota for the remote host to archive email.
Remote disk quota
10 Click Apply.
Configuring the email archiving policy
The Archiving Policy tab enables you to specify the types of email to archive. The criteria you specify are called policies.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the archiving policy list, go to Email Archiving > Policy > Archiving Policy.
Figure 270: Viewing the list of email archiving policies
Move
Status
Policy ID
Type
Pattern
Click a policy to select it, click Move, then select either:
• the direction in which to move the selected policy (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the policy’s new location by entering the ID of another policy
FortiMail units match the policies in sequence, from the top of the list downwards.
To enable an email archiving policy, mark its check box.
The identification numbers of the policy. IDs are generated by the FortiMail unit.
The policy type. The five types are pre-defined. See step
of
“To configure an email archiving policy” on page 434
.
The pattern that the FortiMail unit will use when evaluating email for a match with the policy.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
433
Configuring email archiving exemptions Email Archiving
To configure an email archiving policy
1 Go to Email Archiving > Policy > Archiving Policy.
2 Either click New to add an entry, or double-click to select an entry that you want to modify.
3 In Policy type, select one of the following:
• Sender Address: The FortiMail unit will check the sender email address for the specified pattern. Use an asterisk (*) as a wildcard when specifying a partial address.
• Recipient Address: The FortiMail unit will check the recipient email address for the specified pattern. Use an asterisk (*) as a wildcard when specifying a partial address.
• Keyword in Subject: The FortiMail unit will check the message subject line for the specified pattern.
• Keyword in Body: The FortiMail unit will check the message body for the specified pattern.
• Attachment File Name: The FortiMail unit will check the filenames of any message attachments for the specified pattern. Use an asterisk (*) as a wild card when specifying a partial address.
4 In Pattern, enter a pattern based on the selected policy type.
For example, if you select Sender Address as the policy type and enter
*@example.com as the pattern, the FortiMail unit archives all email from the example.com domain.
5 Enable Policy status.
6 Click Create.
Configuring email archiving exemptions
The Exempt Policy tab displays the list of email archiving exemptions.
After setting up email archiving policies, you can define further criteria to prevent the
FortiMail unit from archiving certain email.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the archiving exempt list, go to Email Archiving > Policy > Exempt Policy.
Figure 271: Viewing the list of email archiving exemptions
434
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Email Archiving Configuring email archiving exemptions
Move
Status
Policy ID
Type
Pattern
Click a policy to select it, click Move, then select either:
• the direction in which to move the selected policy (Up or Down), or
• After or Before, then in Move right after or Move right before indicate the policy’s new location by entering the ID of another policy
FortiMail units match the policies in sequence, from the top of the list downwards.
To enable an email archiving exemption policy, mark its check box.
The identification numbers of the policy. IDs are generated by the FortiMail unit.
The pattern that the FortiMail unit will use when evaluating email for a match with the policy.
To configure email archiving exemption policy
1 Go to Email Archiving > Policy > Exempt Policy.
2 Either click New to add an entry, or double-click to select an entry that you want to modify.
3 In Policy type, select one of the following:
• Sender Address: The FortiMail unit will check the sender email address for the specified pattern. Use an asterisk (*) as a wildcard when specifying a partial address.
• Recipient Address: The FortiMail unit will check the recipient email address for the specified pattern. Use an asterisk (*) as a wildcard when specifying a partial address.
• Spam Emails: The FortiMail unit will not archive any email it determines is spam.
The pattern field is ignored.
4 In Pattern, enter the policy pattern based on the selected policy type.
For example, if you select Sender Address as the policy type and enter
*@example.com as the pattern, the FortiMail unit will not archive any email from the example.com domain.
5 Enable Policy status.
6 Click Create.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
435
Configuring email archiving exemptions Email Archiving
436
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report About FortiMail logging
Log & Report
The Log & Report menu enables you to configure logging, reports, and alert email.
FortiMail units provides extensive logging capabilities for virus incidents, spam incidents and system events. Detailed log information and reports provide analysis of network activity to help you identify security issues and reduce network misuse and abuse.
This topic includes:
•
•
•
Configuring report profiles & generating reports
•
About FortiMail logging
FortiMail units can log many different email activities and traffic including:
• system-related events such as system restarts and HA activity
• virus detections
• spam filtering results
• POP3, SMTP, IMAP and webmail events
For more information about log types, see
You can select which severity level log messages must meet in order to be recorded. For
more information, see “Log message severity levels” on page 438 .
A FortiMail unit can save log messages to its hard disk, or to a remote location such as a
Syslog server or FortiAnalyzer™ unit. For more information, see “Configuring logging” on page 438
. It can also use log messages as the basis for reports. For more information,
see “Configuring report profiles & generating reports” on page 442 .
Log types
FortiMail units can record the following categories of log messages:
Table 38: Log types
Log file type
Event
Virus
Spam
History
Description
System and administration events, such as downloading a backup copy of the configuration
Detections of viruses, as well as antivirus subsystem-related events
Detections of spam, as well as antispam subsystem-related events such as when the FortiMail unit loads new FortiGuard Antispam heuristic rules
All email handled by the FortiMail unit’s build-in MTA or proxies, as well as whether that email that was successfully or unsuccessfully delivered
Caution: Avoid recording highly frequent log types such as traffic logs to the local hard disk for an extended period of time. Excessive logging frequency can cause undue wear on the hard disk and may cause premature failure.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
437
Configuring logging Log & Report
Log message severity levels
Each log message contains a field that indicates the severity level of the log message, such as pri=warning.
Table 39: Log severity levels
Levels
0 - Emergency
1 - Alert
2 - Critical
3 - Error
4 - Warning
5 - Notification
6 - Information
Description
The system has become unusable.
Immediate action is required.
Functionality is affected.
An error condition exists and functionality could be affected.
Functionality could be affected.
Information about normal events.
General information about system operations.
For each location where the FortiMail unit can store log files, you can define the severity threshold of the log messages that will be stored there: the FortiMail unit will store all log messages equal to or exceeding the severity level you select.
Caution: Avoid recording log messages using low severity thresholds such as Information or Notification to the local hard disk for an extended period of time. A low log severity threshold is one possible cause of frequent logging. Excessive logging frequency can cause undue wear on the hard disk and may cause premature failure.
For example, if you select Error, the FortiMail unit will store log messages whose severity level is Error, Critical, Alert, or Emergency.
Configuring logging
The Log Setting menu and its Log Setting tab enables you to configure which types of log messages that the FortiMail unit will record, and the location where it will store them.
When diagnosing problems or tracking actions that the FortiMail unit performs as it receives and processes traffic, you may find it useful to configure the FortiMail unit to record log messages.
You can configure the FortiMail unit to store log messages either or both locally (that is, in
RAM or to the hard disk) and remotely (that is, on a Syslog server or FortiAnalyzer unit).
Your choice of storage location may be affected by several factors, including the following.
• Rebooting the FortiMail unit clears logs stored in memory.
• Logging only locally may not satisfy your requirements for off-site log storage.
• Very frequent logging may cause undue wear when stored on the local hard drive. A low severity threshold is one possible cause of frequent logging. For more information
on severity levels, see “Log message severity levels” on page 438 .
• Very frequent logging, such as when the severity level is low, may rapidly consume all available log space when stored in memory. If the available space is consumed, and if the FortiMail unit is configured to do so, it may store any new log message by overwriting the oldest log message. For high traffic volumes, this may occur so rapidly that you cannot view old log messages before they are replaced. For more information
on severity levels, see “Log message severity levels” on page 438 .
• Usually, fewer log messages can be stored in memory. Logging to a Syslog server or
FortiAnalyzer™ unit may provide you with additional log storage space.
438
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring logging
For information on viewing locally stored log messages, see
“Viewing log messages” on page 83
.
This section includes the following topics:
•
•
Configuring logging to the hard disk
•
Configuring logging to a Syslog server or FortiAnalyzer unit
Choosing which events to log
For each log storage location, you can choose which log type and subcategories of log messages that the FortiMail unit will record in the Logging Policy Configuration section.
Event Log
Virus Log
Spam Log
History Log
Enable to log the following system events and administration activities.
Enable to log configuration changes. When configuration has changed
Admin login/logout event
Enable to log all administrative events, such as logins, resets, and configuration updates.
System activity event Enable to log all system-related events, such as rebooting the FortiMail unit.
Enable to log all POP3 events.
POP3 server event
(server mode only)
IMAP server event
(server mode only)
Enable to log all IMAP events.
SMTP server event
Update
HA
Enable to log all SMTP relay or proxy events.
Enable to log both successful and unsuccessful attempts to download FortiGuard updates.
Enable to log all high availability (HA) activity. For more
information, see “About logging, alert email, & SNMP in HA” on page 162
.
WebMail event Enable to log all webmail events.
Enable to log all antivirus events.
Enable to log all antispam events.
Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.
Configuring logging to the hard disk
Instead of or in addition to logging remotely, you can store log messages locally, on the hard disk of the FortiMail unit.
By default, the FortiMail unit stores all log files on a local hard disk. To ensure that local hard disk has sufficient disk space to store new log messages and that it does not overwrite existing logs, you should regularly download backup copies of the oldest log files to your management computer or other storage, and then delete them from the FortiMail unit. (Alternatively, you could configure logging to a remote host.) For more information,
see “Viewing log messages” on page 83
and
“Configuring logging to a Syslog server or
FortiAnalyzer unit” on page 441 .
If the FortiMail unit is logging to its hard disk, you can use the web-based manager to view log messages that are stored locally on the FortiMail unit. For details, see
“Viewing log messages” on page 83
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
439
Configuring logging Log & Report
Before you can log to the hard disk, you must first enable logging. For details, see
“Choosing which events to log” on page 439 . For logging accuracy, you should also verify
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure logging to the hard disk
1 Go to Log & Report > Log Setting > Local Log Settings.
2 Enable Enable log to local disk.
3 In Log file size, enter the file size limit of the current log file in megabytes (MB), and in
Log time, enter the file age limit.
When a log file reaches either the age or size limit, the FortiMail unit will rotate the current log file: that is, it renames the current log file (elog.log) with a file name indicating its sequential relationship to other log files of that type (elog2.log, etc.), then creates a new current log file.
The log file size limit must be between 10 MB and 1000 MB.
Note: Large log files may decrease display and search performance.
4 From Log level, select the severity level that a log message must equal or exceed in order to be recorded to this storage location.
Caution: Avoid recording log messages using low severity thresholds such as Information or Notification to the local hard disk for an extended period of time. A low log severity threshold is one possible cause of frequent logging. Excessive logging frequency can cause undue wear on the hard disk and may cause premature failure.
For information about severity levels, see
“Log message severity levels” on page 438 .
5 From Log options when disk is full, select what the FortiMail unit will do when the local disk is full and a new log message is caused, either:
• Do not log: Discard the new log message.
• Overwrite: Delete the oldest log file in order to free disk space, and store the new log message.
6 In Logging Policy Configuration, enable the types of logs that you want to record to this storage location.
Caution: Avoid recording highly frequent log types such as traffic logs to the local hard disk for an extended period of time. Excessive logging frequency can cause undue wear on the hard disk and may cause premature failure.
For details, see
“Choosing which events to log” on page 439
.
7 Click Apply.
440
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring logging
Configuring logging to a Syslog server or FortiAnalyzer unit
Instead of or in addition to logging locally, you can store log messages remotely, on a
Syslog server or FortiAnalyzer unit.
You can add a maximum of three remote Syslog servers.
Note: Logs stored remotely cannot be viewed from the web-based manager of the FortiMail unit. If you require the ability to view logs from the web-based manager, also enable local
storage. For details, see “Configuring logging to the hard disk” on page 439
.
Before you can log to a remote location, you must first enable logging. For details, see
“Choosing which events to log” on page 439 . For logging accuracy, you should also verify
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure logging to a Syslog server or FortiAnalyzer unit
1 Go to Log & Report > Log Setting > Remote Log Settings.
2 Either click New or double-click a remote logging configuration that you want to modify.
It is possible to store log messages on more than one remote host for the purpose of logging redundancy.
3 Enable Log to Remote Host.
4 In IP, enter the IP address of the Syslog server or FortiAnalyzer unit.
5 In Port, if the remote host is a FortiAnalyzer unit, enter 514; if the remote host is a
Syslog server, enter the UDP port number on which the Syslog server listens for connections.
6 From Level, select the severity level that a log message must equal or exceed in order to be recorded to this storage location.
For information about severity levels, see
“Log message severity levels” on page 438 .
7 From Facility, select the facility identifier that the FortiMail unit will use to identify itself when sending log messages to the first Syslog server.
To easily identify log messages from the FortiMail unit when they are stored on the
Syslog server, enter a unique facility identifier, and verify that no other network devices use the same facility identifier.
8 Enable CSV format if you want to send log messages in comma-separated value
(CSV) format.
Note: Do not enable this option if the remote host is a FortiAnalyzer unit. FortiAnalyzer units do not support CSV-formatted log messages.
9 In Logging Policy Configuration, enable the types of logs that you want to record to this storage location.
For details, see
“Choosing which events to log” on page 439
.
10 Click Apply.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
441
Configuring report profiles & generating reports Log & Report
11 If the remote host is a FortiAnalyzer unit, confirm with the FortiAnalyzer administrator that the FortiMail unit has been added to the FortiAnalyzer unit’s device list, allocated sufficient disk space quota, and assigned permission to transmit logs to the
FortiAnalyzer unit. For details, see the FortiAnalyzer Administration Guide .
12 To verify logging connectivity, from the FortiMail unit, trigger a log message that matches the types and severity levels that you have chosen to store on the remote host. Then, on the remote host, confirm that it has received that log message.
For example, if you have chosen to record event log messages to the remote host if they are more severe than information, you could log in to the web-based manager or download a backup copy of the FortiMail unit’s configuration file in order to trigger an event log message.
If the remote host does not receive the log messages, verify the FortiMail unit’s network interfaces (see
“Configuring the network interfaces” on page 121 and
“About the management IP” on page 122 ) and static routes (see
(ping) is enabled on the remote host, you may be able to use the execute traceroute command to determine the point where connectivity fails. For details, see the FortiMail CLI Reference .
Configuring report profiles & generating reports
The Configuration tab displays a list of report profiles, which define what information will appear in generated reports.
It also enables you to generate a report from its profile on demand, separately from any schedule you may have configured for it.
In addition to log files, FortiMail units require a report profile to be able to generate a report. A report profile is a group of settings that contains the report name, file format, subject matter, and other aspects that the FortiMail unit considers when generating the report.
You may want to create one report profile for each type of report that you will generate on demand or periodically, by schedule.
If you used the Quick Start Wizard to perform initial setup of your FortiMail unit, the Quick
Start Wizard automatically created two report profiles:
• predefined_report_yesterday
• predefined_report_last_week
Otherwise, no report profiles exist by default.
When generating a report, FortiMail units collate information collected from its log files and present the information in tabular and graphical format.
Note: In addition to viewing full reports, you can also view summary email statistics. For
more information, see “Viewing the email statistics” on page 58
.
442
Note: Generating reports can be resource intensive. To avoid email processing performance impacts, you may want to generate reports during times with low traffic volume, such as at night. For more information on scheduling the generation of reports, see
“Configuring the schedule of a report profile” on page 445 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring report profiles & generating reports
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of report profiles, go to Log & Report > Report Settings > Configuration.
Figure 272: Viewing the list of report profiles
Report Name The name of the report profile.
Domain The name of the protected domain that is the subject matter of this report.
Schedule The scheduled frequency with which the FortiMail unit generates the report.
If this report in not scheduled to be periodically generated according to the schedule configured in the report profile, but instead will be generated only on demand, when you manually click Generate, Not Scheduled appears in this column.
To configure a report profile
1 Go to Log & Report > Report Settings > Configuration.
2 Either click New to add a profile, or double-click to select a profile that you want to modify.
3 In Report Name, enter a name for the report profile.
Report names cannot include spaces.
4 Click the arrow next to each option, and configure the following:
Time Period
Query Selection
Schedule
Domain
Select the time span of log messages from which to generate the report.
For more information, see “Configuring the time period of a report profile” on page 444 .
Select one or more subject matters to include in the report. For more information, see
“Configuring the query selection of a report profile” on page 444
.
Select to generate reports from this report profile either manually only or automatically, according to a schedule. For more information, see
“Configuring the schedule of a report profile” on page 445 .
Select the protected domains to include in the report. For more information, see
“Configuring the protected domain of a report profile” on page 446
.
Incoming Outgoing Select whether to report upon incoming email, outgoing email, or both.
Email Notification Select to email reports generated using this report profile by adding recipients to the Email Notification list and selecting either html or pdf file format for the attached report.
5 Click OK.
On-demand reports are generated immediately; scheduled reports, if you have configured a schedule, are generated at those intervals. For information on viewing
generated reports, see “Viewing generated reports” on page 92 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
443
Configuring report profiles & generating reports Log & Report
To manually generate a report
If you have configured a report profile to be generated regularly according to a schedule, the FortiMail unit will automatically do so. However, you may alternatively or additionally manually trigger the generation of a report. This can be used with both scheduled and on demand report profiles, and occurs independently of any automatic report generation schedules you may have configured. For more information, see
“Configuring the schedule of a report profile” on page 445
.
1 Go to Log & Report > Report Settings > Configuration.
2 Click to select the report profile whose settings you want to use when generating the report.
3 Click Generate.
The FortiMail unit immediately begins to generate a report. To view the resulting report, see
“Viewing generated reports” on page 92
.
Configuring the time period of a report profile
When configuring a report profile, you can select the time span of log messages from which to generate the report.
Figure 273: Time Period
444
(First unnamed option, containing one drop-down list.)
Last N Hours or
Last N Days or
Last N Weeks
(Second unnamed option, containing two drop-down lists.)
From date
To date
Select the time span of the report, such as This Month or Last N
Days.
Alternatively, select and configure From Date and To Date.
Enter the number N of the unit of time.
This option appears only when you have selected Last N Hours, Last
N Days, or Last N Weeks from Time Period, and therefore must define N.
Select and configure the beginning of the time span. For example, you may want the report to include log messages starting from
May 5, 2006 at 6 PM. You must also configure To date.
Select to configure the end of the time span. For example, you may want the report to include log messages up to May 6, at 12 AM. You must also select and configure From date.
Configuring the query selection of a report profile
When configuring a report profile, you can select one or more queries or query groups that define the subject matter of the report.
Each query group contains multiple individual queries, each of which correspond to a chart that will appear in the generated report. You can select all queries within the group by marking the checkbox of the query group, or you can expand the query group and then individually select each query that you want to include.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring report profiles & generating reports
For example:
• If you want the report to include charts about spam, you might select both of the query groups Spam by Sender and Spam by Recipient.
• If you want the report to specifically include only a chart about top virus senders by date, you might expand the query group Virus by Sender, then select only the individual query Top Virus Sender By Date.
Figure 274: Query Selection
Mail Statistics
Total Summary
Enable to include information on email message statistics, such as Mail Stat
Messages By Day.
Enable to include summary information, such as Total Sent And Received.
High Level
Breakdown
Mail by Sender
Enable if you want to include all top level and summary information for all queries, such as Top Client IP By Date.
Mail by Recipient
Enable to include information on email messages by each sender, such as
Top Sender By Date.
Enable to include information on email messages by each recipient, such as
Top Recipient By Date.
Spam by Sender Enable to include information on spam by each sender, such as Top Spam
Sender By Date.
Spam by Recipient Enable to include information on spam by each recipient, such as Top Spam
Recipient By Date.
Virus by Sender Enable to include information on infected email messages by each sender, such as Top Virus Sender By Date.
Virus by Recipient Enable to include information on infected email messages by each recipient, such as Top Virus Recipient By Date.
Configuring the schedule of a report profile
When configuring a report profile, you can select whether the FortiMail unit will generate the report on demand or according to the schedule that you configure.
Note: Generating reports can be resource-intensive. To improve performance, generate reports during times when traffic volume is low, such as at night or during weekends.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
445
Configuring report profiles & generating reports
Figure 275: Schedule
Log & Report
Not Scheduled
Daily
These days
These dates
At hour
Select if you do not want the FortiMail unit to generate the report automatically according to a schedule.
If you select this option, the report will only be generated on demand, when you manually select Run Report from the report profile list. For
more information, see “Configuring report profiles & generating reports” on page 442
.
Select to generate the report each day. Also configure At Hour.
Select to generate the report on specific days of each week, then select those days. Also configure At Hour.
Select to generate the report on specific date of each month, then enter those date numbers. Separate multiple date numbers with a comma. Also configure At Hour.
For example, to generate a report on the first and 30 th month, enter 1,30.
day of every
Select the time of the day when the report will be generated, according to a 24-hour clock.
This option does not apply if you have selected Not Scheduled.
Configuring the protected domain of a report profile
When configuring a report profile, you can select one or more protected domains whose log messages will be used when generating the report.
Figure 276: Domain
446
Available domains
Select All or the name of a protected domain from the drop-down menu, then click Add to add that protected domain to the Selected domains area.
Selected Domains The list of protected domains whose log messages will be used when generating the report.
To remove a protected domain from this list, click to select it in the area, then click Remove.
Configuring incoming or outgoing directionality of a report profile
When configuring a report profile, you can select to report only on email messages matching the directionality that you select: incoming, outgoing, or both.
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring alert email
Figure 277: Incoming/Outgoing
Incoming/Outgoing Select the directionality, relative to the protected domain, of email messages that you want to report on.
• Incoming
• Outgoing
• Both
Configuring email notification for a report profile
When configuring a report profile, you can configure the FortiMail unit to email a copy of the generated report, in either HTML or PDF file format, to designated recipients.
Figure 278: Email Notification
Report format
Email address
All notification
Email address
Select which file format of the generated report to attach to the email, either
html or pdf.
Enter the email address of a recipient, then click Add to add the email address to the All notification Email address area.
The list of recipients to which the FortiMail unit will send a copy of reports generated using this report profile.
To remove a recipient address, select it in the area, then click Remove.
Configuring alert email
The Alert Email menu enables you to configure the FortiMail unit to notify you by email message when specific types of events occur and are logged. For example, if you require notification about virus detections, you can configure the FortiMail unit to send an alert email message whenever the FortiMail unit detects a virus.
To configure alerts, you must configure both the alert email recipients (see
alert email message (see
“Configuring alert categories” on page 448
).
Alert email messages also require that you configure the FortiMail unit with the IP address of at least one DNS server. The FortiMail unit uses the domain name of the SMTP server to send alert email messages; to resolve this domain name into an IP address, the
FortiMail unit must be able to query a DNS server. For information on configuring DNS,
see “Configuring DNS” on page 130
.
This topic includes:
•
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
447
Configuring alert email Log & Report
•
Configuring alert recipients
The Configuration tab enables you to configure which email addresses will receive alerts.
Before the FortiMail unit can send alert email messages, you must configure it with one or more recipients.
You must also configure which categories of events will cause the FortiMail unit to send
alert email message. For more information, see “Configuring alert categories” on page 448
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure recipients of alert email messages
1 Go to Log & Report > Alert Email > Configuration.
2 In Email to, enter one or more recipient email addresses.
Enter only one email address per field.
3 Click Create.
The alert recipients entry appears below the Email to fields.
4 To verify that alert email is configured correctly by sending a sample alert email to all configured recipients, click Test.
Configuring alert categories
The Categories tab enables you to configure which events will cause the FortiMail unit to send an alert email message.
Before the FortiMail unit can send an alert email message, you must select the event or events that will cause it to send an alert.
You must also configure alert email message recipients. For more information, see
“Configuring alert recipients” on page 448
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To select events that will trigger an alert email message
1 Go to Log & Report > Alert Email > Categories.
2 Select one or more of the following event categories:
Virus incidents
Critical events
Disk is full
Enable to send an alert email message when the FortiMail unit detects a virus.
Enable to send an alert email message when the FortiMail unit detects a system error that may affect its operation.
Enable to send an alert email message when the hard disk of the
FortiMail unit is full.
448
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Log & Report Configuring alert email
Remote archiving/NAS failures
HA events
Enable to send an alert email message when the remote archiving feature encounters one or more failures.
Enable to send an alert email message when any high availability (HA) event occurs.
When a FortiMail unit is operating in HA mode, the subject line of the alert email includes the host name of the cluster member. If you have configured a different host name for each member of the cluster, this enables you to identify which FortiMail unit in the HA cluster sent the
.
Disk quota of an account is exceeded
Enable to send an alert email message when an email user’s account exceeds its quota of hard disk space.
This option is available only if the FortiMail unit is in server mode.
Enable to send an alert email message when a dictionary is corrupt. Dictionary is corrupted
System quarantine quota is full
Enable to send an alert email message when the system quarantine reaches its quota of hard disk space. For more information on the
Deferred emails # over x, interval time y minutes
Enable to send an alert email message if the deferred email queue contains greater than this number of email messages. Enter a number between 1 and 10000 to define the alert threshold, then enter the interval of time between each alert email message that the FortiMail unit will send while the number of email messages in the deferred email queue remains over this limit.
3 Click Apply.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
449
Configuring alert email Log & Report
450
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Testing firmware before installing it
Installing firmware
Fortinet periodically releases FortiMail firmware updates to include enhancements and address issues. After you have registered your FortiMail unit, FortiMail firmware is available for download at http://support.fortinet.com
.
Installing new firmware can overwrite antivirus and antispam packages using the versions of the packages that were current at the time that the firmware image was built. To avoid repeat updates, update the firmware before updating your FortiGuard packages.
New firmware can also introduce new features which you must configure for the first time.
For information specific to the firmware release version, see the Release Notes
available with that release.
Note: In addition to major releases that contain new features, Fortinet releases patch releases that resolve specific issues without containing new features and/or changes to existing features. It is recommended to download and install patch releases as soon as they are available.
Note: Before you can download firmware updates for your FortiMail unit, you must first register your FortiMail unit with Fortinet Technical Support. For details, go to http://support.fortinet.com/ or contact Fortinet Technical Support.
This topic includes:
•
Testing firmware before installing it
•
•
Testing firmware before installing it
You can test a new firmware image by temporarily running it from memory, without saving it to disk. By keeping your existing firmware on disk, if the evaluation fails, you do not have to re-install your previous firmware. Instead, you can quickly revert to your existing firmware by simply rebooting the FortiMail unit.
To test a new firmware image
1 Connect your management computer to the FortiMail console port using a RJ-45 to
DB-9 serial cable or a null-modem cable.
2 Initiate a connection from your management computer to the CLI of the FortiMail unit.
3 Connect port1 of the FortiMail unit directly or to the same subnet as a TFTP server.
4 Copy the new firmware image file to the root directory of the TFTP server.
5 Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
To use the FortiMail CLI to verify connectivity, enter the following command: execute ping 192.168.1.168 where 192.168.1.168 is the IP address of the TFTP server.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
451
Testing firmware before installing it Installing firmware
6 Enter the following command to restart the FortiMail unit: execute reboot
7 As the FortiMail units starts, a series of system startup messages are displayed.
Press any key to display configuration menu........
8 Immediately press a key to interrupt the system startup.
Note: You have only 3 seconds to press a key. If you do not press a key soon enough, the
FortiMail unit reboots and you must log in and repeat the execute reboot command.
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: Configuration and information.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,I,Q,or H:
9 Type G to get the firmware image from the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
10 Type the IP address of the TFTP server and press Enter.
The following message appears:
Enter Local Address [192.168.1.188]:
11 Type a temporary IP address that can be used by the FortiMail unit to connect to the
TFTP server.
The following message appears:
Enter File Name [image.out]:
12 Type the firmware image file name and press Enter.
The FortiMail unit downloads the firmware image file from the TFTP server and displays a message similar to the following:
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]
13 Type R.
The FortiMail image is loaded into memory and uses the current configuration, without saving the new firmware image to disk.
14 To verify that the new firmware image has been loaded, log in to the CLI and type: get system status
15 Test the new firmware image.
• If the new firmware image operates successfully, you can install it to disk, overwriting the existing firmware, using the procedure
“Installing firmware” on page 453
.
• If the new firmware image does not operate successfully, reboot the FortiMail unit to discard the temporary firmware and resume operation using the existing firmware.
452
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Installing firmware
Installing firmware
You can use either the web-based manager or the CLI to upgrade or downgrade the firmware of the FortiMail unit.
Administrators whose Domain is System and whose access profile contains Read-Write access in the Others category, such as the admin administrator, can change the FortiMail firmware.
Firmware changes are either:
• an upgrade to a newer version
• a reversion to an earlier version
To determine if you are upgrading or reverting your firmware image, examine the firmware version number. For example, if your current firmware version is FortiMail-400
3.00,build288,080327, changing to FortiMail-400 3.00,build266,071209, an earlier build number and date, indicates that you are reverting.
Reverting to an earlier version may cause the FortiMail unit to remove parts of the configuration that are not valid for that earlier version. In some cases, you may lose all the
mail data and configurations. For details, see “Downgrading from version 4.0 to 3.0” on page 455
.
When upgrading, there may also be additional considerations. For details, see
.
Therefore, no matter you are upgrading or downgrading, it is always a good practice to
back up the configuration and mail data. For details, see “Backup and restore” on page 97
.
If you are installing firmware to a high availability (HA) group, install firmware on the primary unit before installing firmware on the backup unit(s).
Similar to upgrading the firmware of a standalone FortiMail unit, normal email processing is temporarily interrupted while firmware is being installed on the primary unit, but, if the
HA group is active-passive, is not interrupted while firmware is being installed on backup units.
Installing firmware on an active-passive HA group does not necessarily trigger a failover.
Before a firmware installation, the primary unit signals the backup unit that a firmware upgrade is taking place. This causes the HA daemon operating on the backup unit to pause its monitoring of the primary unit for a short time. When the firmware installation is complete, the primary unit signals the backup unit to resume HA heartbeat monitoring. If the backup unit has not received this signal after a few minutes, the backup unit resumes
HA heartbeat monitoring anyway, and, if the primary unit has failed during the firmware installation, the HA group fails over to the backup unit, which becomes the new primary unit.
To install firmware using the web-based manager
1 Log in to the Fortinet Technical Support web site, https://support.fortinet.com/ .
2 Download the firmware image file to your management computer.
3 Log in to the web-based manager as the admin administrator, or an administrator account that has system configuration read and write privileges.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
453
Installing firmware Installing firmware
4 In the advanced mode of the web-based manager, there are two places where you can install a firmware:
• Go to Monitor > System Status > Status, and in the System Information area, in the
Firmware version row, click Update. Click Browse to locate the firmware and then click Submit.
• or go to Maintenance > System > Configuration, under Restore Firmware, check
Local PC, and click Browse to locate the firmware. Then click Restore.
Note: For FortiMail v4.0, restoring firmware from a FortiManager unit will be supported in future FortiManager releases. For more information, see
“Configuring centralized administration” on page 109
. f
Your web browser uploads the firmware file to the FortiMail unit. The FortiMail unit installs the firmware and restarts. Time required varies by the size of the file and the speed of your network connection.
If you are downgrading the firmware to a previous version, the FortiMail unit reverts the configuration to default values for that version of the firmware. You must either reconfigure the FortiMail unit or restore the configuration file.
5 Clear the cache of your web browser and restart it to ensure that it reloads the webbased manager and correctly displays all tab, button, and other changes.
6 To verify that the firmware was successfully installed, log in to the web-based manager and go to Monitor > System Status > Status. Text appearing in the Firmware version row indicates the currently installed firmware version.
To install firmware using the CLI
1 Log in to the Fortinet Technical Support web site, https://support.fortinet.com/ .
2 Download the firmware image file to your management computer.
3 Connect your management computer to the FortiMail console port using a RJ-45 to
DB-9 serial cable or a null-modem cable.
4 Initiate a connection from your management computer to the CLI of the FortiMail unit, and log in as the admin administrator, or an administrator account that has system configuration read and write privileges.
5 Connect port1 of the FortiMail unit directly or to the same subnet as a TFTP server.
6 Copy the new firmware image file to the root directory of the TFTP server.
7 Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
To use the FortiMail CLI to verify connectivity, enter the following command: execute ping 192.168.1.168 where 192.168.1.168 is the IP address of the TFTP server.
454
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Installing firmware
8 Enter the following command to download the firmware image from the TFTP server to the FortiMail unit: execute restore image tftp <name_str> <tftp_ipv4> where <name_str> is the name of the firmware image file and <tftp_ipv4> is the
IP address of the TFTP server. For example, if the firmware image file name is image.out and the IP address of the TFTP server is 192.168.1.168, enter: execute restore tftp image.out 192.168.1.168
One of the following message appears:
This operation will replace the current firmware version!
Do you want to continue? (y/n) or:
Get image from tftp server OK.
Check image OK.
This operation will downgrade the current firmware version!
Do you want to continue? (y/n)
9 Type y.
The FortiMail unit downloads the firmware image file from the TFTP server. The
FortiMail unit installs the firmware and restarts. Time required varies by the size of the file and the speed of your network connection.
If you are downgrading the firmware to a previous version, the FortiMail unit reverts the configuration to default values for that version of the firmware. You must either reconfigure the FortiMail unit or restore the configuration file.
10 If you also use the web-based manager, clear the cache of your web browser and restart it to ensure that it reloads the web-based manager and correctly displays all tab, button, and other changes.
11 To verify that the firmware was successfully installed, log in to the CLI and type: get system status
12 If you have downgraded the firmware version, reconnect to the FortiMail unit using its default IP address for port1, 192.168.1.99, and restore the configuration file. For
details, see “Reconnecting to the FortiMail unit” on page 456
and “Restoring the configuration” on page 457 .
If you have upgraded the firmware version, to verify the conversion of the configuration
file, see “Verifying the configuration” on page 459
. If the upgrade is unsuccessful, you can downgrade the firmware to a previous version.
13 Update the FortiGuard Antivirus definitions.
Note: Installing firmware replaces the current antivirus definitions with those included with the firmware release that you are installing. After you install the new firmware, make sure that your FortiGuard Antivirus definitions are up-to-date. For more information, see
“Manually requesting updates” on page 119 .
14 After upgrading to FortiMail v3.0 from any older version, create new LDAP profiles.
LDAP profiles cannot be automatically converted from the FortiMail v3.0 configuration format. For details, see
“Configuring LDAP profiles” on page 333 .
Downgrading from version 4.0 to 3.0
Direct FortiMail firmware downgrade from v4.0 to v3.0 is not supported. If you have to downgrade, all configuration and mail data will be lost.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
455
Installing firmware
456
Installing firmware
In addition, you can only clean install the v3.0 firmware using direct console connection.
To downgrade the FortiMail firmware from v4.0 to v3.0
1 Follow the procedures described in “Clean installing firmware” on page 459 .
2 After you downgrade the firmware, perform “execute formatmaildisk” and “execute fectoryreset” for format the hard disk and reset the unit to factory defaults.
3 Configure the unit’s IP address and other network settings.
4 Load back the v3.0 configuration if applicable.
Reconnecting to the FortiMail unit
After downgrading to a previous firmware version, the FortiMail unit reverts to default settings for the installed firmware version, including the IP addresses of network interfaces through which you connect to the FortiMail web-based manager and/or CLI.
Use either of the following procedures if the FortiMail unit has been reset to a default configuration and you need to reconnect to the web-based manager.
Note: If your FortiMail unit has not been reset to its default configuration, but you cannot connect to the web-based manager or CLI, you can restore the firmware, resetting the
FortiMail unit to its default configuration in order to reconnect using the default network interface IP address. For more information, see
“Clean installing firmware” on page 459 .
To reconnect using the LCD panel
Note: This procedure requires a FortiMail model whose hardware includes a front LCD panel.
1 Press Enter to display the Main Menu.
2 Press Enter to display the interface list.
3 Use the up or down arrows to highlight the network interface that is connected to your management computer, and press Enter.
4 Press Enter for IP Address.
5 Use the up and down arrows to increase or decrease each number of each IP address digit. Press Enter to go to the next IP address digit or press Esc to move to the previous digit.
6 After selecting the last IP address digit, press Enter to save the IP address.
7 Repeat steps
to
to enter the netmask address for the network interface.
8 After selecting the last netmask address digit, press Enter to save the netmask address.
9 Press Esc to return to the Main Menu.
The network interface’s IP address and netmask is saved. You should now be able to reconnect to either the web-based manager or CLI through that network interface using. For information on restoring the configuration, see
“Restoring the configuration” on page 457 .
To reconnect using the CLI
1 Connect your management computer to the FortiMail console port using a RJ-45 to
DB-9 serial cable or a null-modem cable.
2 Start HyperTerminal, enter a name for the connection and click OK.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Installing firmware
3 Configure HyperTerminal to connect directly to the communications (COM) port on your computer and click OK.
4 Select the following port settings and click OK:
Bits per second 9600
Data bits
Parity
8
None
Stop bits
Flow control
1
None
5 Press Enter to connect to the FortiMail CLI.
The login prompt appears.
6 Type admin and press Enter twice.
The following prompt is displayed:
Welcome!
7 Enter the following command: set system interface <interface_str> mode static ip
<address_ipv4> <mask_ipv4> where:
• <interface_str> is the name of the network interface, such as port1
• <address_ipv4> is the IP address of the network interface, such as 192.168.1.10
• <mask_ipv4> is the netmask of the network interface, such as 255.255.255.0
8 Enter the following command: set system interface <interface_str> config allowaccess
<accessmethods_str> where:
• <interface_str> is the name of the network interface configured in the previous step, such as port1
• <accessmethods_str> is a space-delimited list of the administrative access protocols that you want to allow on that network interface, such as ping ssh https
The network interface’s IP address and netmask is saved. You should now be able to reconnect to either the web-based manager or CLI through that network interface. For information on restoring the configuration, see
“Restoring the configuration” on page 457 .
Restoring the configuration
You can restore a backup copy of the configuration file from your local PC using either the web-based manager or CLI. For information about configuration backup, see
“Backup and restore” on page 97 .
Note: For FortiMail v4.0, restoring configuration from a FortiManager unit will be supported
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
457
Installing firmware
458
Installing firmware
If you have just downgraded or restored the firmware of the FortiMail unit, restoring the configuration file can be used to reconfigure the FortiMail unit from its default settings.
To restore the configuration file using the web-based manager
1 Clear your browser’s cache. If your browser is currently displaying the web-based manager, also refresh the page.
2 Log in to the web-based manager.
3 In the advanced management mode, go to Maintenance > System > Configuration.
4 Under Restore Configuration, click Local PC.
5 Click Browse to locate and select the configuration file that you want to restore, then click Restore.
The FortiMail unit restores the configuration file and reboots.Time required varies by the size of the file and the speed of your network connection.
6 After restoring the configuration file, verify that the settings have been successfully
To restore the configuration file using the CLI
Note: The following procedure restores only the core configuration file, which does not include items such as the Bayesian databases, dictionary database, and other items. To restore backups of those items, use the web-based manager.
1 Initiate a connection from your management computer to the CLI of the FortiMail unit, and log in as the admin administrator, or an administrator account that has system configuration read and write privileges.
2 Connect a network interface of the FortiMail unit directly or to the same subnet as a
TFTP server.
3 Copy the new firmware image file to the root directory of the TFTP server.
4 Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
To use the FortiMail CLI to verify connectivity, enter the following command: execute ping 192.168.1.168 where 192.168.1.168 is the IP address of the TFTP server.
5 Enter the following command: execute restore config tftp <file_name> <tftp_ipv4>
The following message appears:
This operation will overwrite the current settings!
(The current admin password will be preserved.)
Do you want to continue? (y/n)
6 Enter y.
The FortiMail unit restores the configuration file and reboots. Time required varies by the size of the file and the speed of your network connection.
7 After restoring the configuration file, verify that the settings have been successfully
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Clean installing firmware
Verifying the configuration
After installing a new firmware file, you should verify that the configuration has been successfully converted to the format required by the new firmware and that no configuration data has been lost.
In addition to verifying successful conversion, verifying the configuration also provides familiarity with new and changed features.
To verify the configuration upgrade
1 Clear your browser’s cache and refresh the login page of the web-based manager.
2 Log in to the web-based manager using the admin administrator account.
Other administrator accounts may not have sufficient privileges to completely review the configuration.
3 Review the configuration and compare it with your configuration backup to verify that the configuration has been correctly converted.
4 Configure new settings and settings that could not be converted to the new format, such as LDAP profiles when upgrading to FortiMail v3.0.
Upgrading
If you are upgrading, it is especially important to note that the upgrade process may require a specific path. Very old versions of the firmware may not be supported by the configuration upgrade scripts that are used by the newest firmware. As a result, you may need to upgrade to an intermediate version of the firmware first, before upgrading to your intended version. Upgrade paths are described in the Release Notes.
Before upgrading the firmware of the FortiMail unit, for the most current upgrade
information, review the Release Notes for the new firmware version. Release Notes are available from http://support.fortinet.com
when downloading the firmware image file.
Release Notes may contain late-breaking information that was not available at the time this Administration Guide was prepared.
Clean installing firmware
Clean installing the firmware can be useful if:
• you are unable to connect to the FortiMail unit using the web-based manager or the
CLI
• you want to install firmware without preserving any existing configuration
• a firmware version that you want to install requires that you format the boot device (see the Release Notes accompanying the firmware)
Unlike upgrading or downgrading firmware, clean installing firmware re-images the boot device, including the signatures that were current at the time that the firmware image file was created. Also, a clean install can only be done during a boot interrupt, before network connectivity is available, and therefore requires a local console connection to the CLI. A clean install cannot be done through a network connection.
Caution: Back up your configuration before beginning this procedure, if possible. A clean install resets the configuration, including the IP addresses of network interfaces. For
information on backups, see “Backup and restore” on page 97
. For information on reconnecting to a FortiMail unit whose network interface configuration has been reset, see
“Reconnecting to the FortiMail unit” on page 456 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
459
Clean installing firmware
460
Installing firmware
Caution: If you are reverting to a previous FortiMail version (for example, reverting from v3.0 to v2.80), you might not be able to restore your previous configuration from the backup configuration file.
To clean install the firmware
1 Download the firmware file from the Fortinet Technical Support web site, https://support.fortinet.com/ .
2 Connect your management computer to the FortiMail console port using a RJ-45 to
DB-9 serial cable or a null-modem cable.
3 Initiate a local console connection from your management computer to the CLI of the
FortiMail unit, and log in as the admin administrator, or an administrator account that has system configuration read and write privileges.
4 Connect port1 of the FortiMail unit directly to the same subnet as a TFTP server.
5 Copy the new firmware image file to the root directory of the TFTP server.
6 Verify that the TFTP server is currently running, and that the FortiMail unit can reach the TFTP server.
To use the FortiMail CLI to verify connectivity, if it is responsive, enter the following command: execute ping 192.168.1.168 where 192.168.1.168 is the IP address of the TFTP server.
7 Enter the following command to restart the FortiMail unit: execute reboot or power off and then power on the FortiMail unit.
8 As the FortiMail units starts, a series of system startup messages are displayed.
Press any key to display configuration menu........
9 Immediately press a key to interrupt the system startup.
Note: You have only 3 seconds to press a key. If you do not press a key soon enough, the
FortiMail unit reboots and you must log in and repeat the execute reboot command.
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: Configuration and information.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,I,Q,or H:
10 If the firmware version requires that you first format the boot device before installing firmware, type F. Format the boot disk before continuing.
11 Type G to get the firmware image from the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Installing firmware Clean installing firmware
12 Type the IP address of the TFTP server and press Enter.
The following message appears:
Enter Local Address [192.168.1.188]:
13 Type a temporary IP address that can be used by the FortiMail unit to connect to the
TFTP server.
The following message appears:
Enter File Name [image.out]:
14 Type the firmware image file name and press Enter.
The FortiMail unit downloads the firmware image file from the TFTP server and displays a message similar to the following:
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]
15 Type D.
The FortiMail unit downloads the firmware image file from the TFTP server. The
FortiMail unit installs the firmware and restarts. Time required varies by the size of the file and the speed of your network connection.
The FortiMail unit reverts the configuration to default values for that version of the firmware.
16 Clear the cache of your web browser and restart it to ensure that it reloads the webbased manager and correctly displays all tab, button, and other changes.
17 To verify that the firmware was successfully installed, log in to the CLI and type: get system status
The firmware version number is displayed.
18 Either reconfigure the FortiMail unit or restore the configuration file from a backup. For details, see the FortiMail Install Guide
and “Restoring the configuration” on page 457 .
19 Update the attack definitions.
Note: Installing firmware replaces the current FortiGuard Antivirus definitions with the definitions included with the firmware release you are installing. After you install new
firmware, update the antivirus definitions. For details, see “Configuring FortiGuard updates
& FortiGuard Antispam queries” on page 110
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
461
Clean installing firmware Installing firmware
462
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Fine tuning Network topology tuning
Fine tuning
This chapter is a collection of guidelines to ensure the most secure and reliable operation of FortiMail units.
These same guidelines can be found alongside their related setting throughout this
Administration Guide. To provide a convenient checklist, these guidelines are also listed here.
For additional information, see also
“Troubleshooting” on page 469 .
This topic includes:
•
•
•
•
•
•
•
•
Network topology tuning
The FortiMail unit can be bypassed in a complex network environment if the network is not carefully planned and deployed.
To ensure maximum safety:
• Configure routers and firewalls to send all SMTP traffic to or through the FortiMail unit for scanning.
• If the FortiMail unit will operate in gateway mode, on public DNS servers, modify the
MX records for each protected domain to contain only a single MX record entry that refers to the FortiMail unit. Spammers can easily determine the lowest priority mail server (highest preference number in MX record) and deliver spam to it, instead of the
FortiMail unit, in an attempt to avoid spam defenses.
• If the FortiMail unit will operate in transparent mode, deploy it directly in front of your protected email servers so that all email can be scanned.
• If the FortiMail unit will operate in transparent mode, do not connect two ports to the same VLAN on a switch or to the same hub. Some Layer 2 switches become unstable when they detect the same media access control (MAC) address originating on more than one switch interface or from more than one VLAN.
For additional network topology considerations that are specific to each operation mode, see the FortiMail Install Guide .
System security tuning
• Enable administrative access only to the network interfaces (located in System >
Network > Interface) through which legitimate FortiMail administrators will connect.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
463
High availability (HA) tuning Fine tuning
• Restrict administrative access to trusted hosts/networks (located in System >
Administrator > Administrator) from which legitimate FortiMail administrators will connect.
• Create additional system- and domain-level administrators with limited permissions for less-demanding management tasks.
• Administrator passwords should be at least six characters long, use both numbers and letters, and be changed regularly. Administrator passwords can be changed by going to System > Administrator > Administrator and selecting the Edit icon for the login to be modified.
• If your FortiMail unit has an LCD panel, restrict access to the control buttons and LCD by requiring a personal identification number (PIN, located in System > Configuration >
Options).
• Do not increase the administrator idle time-out (located in System > Configuration >
Options) from the default of five minutes.
• Verify that the system time and time zone (located in System > Configuration > Time) are correct. Many features, including FortiGuard updates, SSL connections, log timestamps and scheduled reports, rely on a correct system time.
High availability (HA) tuning
• Isolate HA interface connections from your overall network. Heartbeat and synchronization packets contain sensitive configuration information and can consume considerable network bandwidth. For an active-passive or a config-only HA group consisting of only two FortiMail units, directly connect the HA interfaces using a crossover cable. For a config-only HA group consisting of more than two FortiMail units, connect the HA interfaces to a switch and do not connect this switch to your overall network.
• Use FortiMail active-passive HA to provide failover protection so that if your primary
FortiMail unit fails, the backup FortiMail unit can continue processing email with only a minor interruption to your email traffic.
• Use config-only HA if you want to create a mail server farm for a large organization.
You can also install a FortiMail config-only HA group behind a load balancer. The load balancer can balance the mail processing load to all of the FortiMail units in the configonly HA group, improving mail processing capacity.
• Maintain the HA heartbeat connection between HA members. If HA heartbeat communication is interrupted and no remote services are detected, HA synchronization is disrupted and, for active-passive HA groups, the backup unit will assume that the primary unit has failed and become the new primary unit.
• License all of the FortiMail units in the HA group for the FortiGuard Antispam and
FortiGuard Antivirus services. If you only license the primary unit in an active-passive
HA group, after a failover the backup unit will not be able to connect to the FortiGuard
Antispam service. Also, antivirus engine and antivirus definition versions are not synchronized between the primary and backup units.
• Configure HA to synchronize the system mail directory and the user home directory so that no email messages in these directories are lost when a failover occurs.
464
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Fine tuning SMTP connectivity tuning
• Do not synchronize/back up the MTA spool directories. Because the content of the
MTA spool directories is very dynamic, synchronizing MTA spool directories between
FortiMail units may not be effective and may use a lot of bandwidth. In addition, it is usually not necessary because, if the former primary unit is able to restart, the MTA spool directories will synchronize after a failover. For details, see
“Using high availability (HA)” on page 156 .
• Store mail data on a NAS server while operating an HA group. For example, backing up your NAS server regularly can help prevent loss of FortiMail mail data. Also, if your
FortiMail unit experiences a temporary failure you can still access the mail data on the
NAS server.
• If you are using a NAS server, disable mail data synchronization. If mail data synchronization is enabled for a FortiMail active-passive HA group that is using a NAS server for remote storage of mail data, both the primary and backup units store the mail data to the NAS server, resulting in duplicate traffic. Disable mail data synchronization to conserve system resources and network bandwidth.
• Use SNMP, syslog, or email alerts to monitor a cluster for failover messages. These alert messages may aid in quick discovery and diagnosis of network problems. SNMP can be configured in System > Configuration > SNMP v1/v2c. Syslog output can be configured in Log and Report > Log Settings > Remote Log Settings. Email alerts can be configured in Log and Report > Alert Email.
• If you configure an HA virtual IP in active-passive mode, configure one IP address but both host names in your DNS records.
SMTP connectivity tuning
• Configure a fully qualified domain name (FQDN) that is different than that of your protected email server (gateway mode and transparent mode). The FortiMail unit’s domain name will be used by many FortiMail features such as quarantine, spam reports, Bayesian database training, alerts, and DSN email. The FQDN is formed by prepending the host name to the local domain name, both of which are configured in
Mail Settings > Settings > Mail Server Settings.
• Use a different host name for each FortiMail unit when managing multiple FortiMail units of the same model or when configuring an HA cluster. The host name is set in
Mail Settings > Settings > Mail Server Settings.
• If the FortiMail unit is used as an outbound relay (gateway mode and server mode only) or if remote email users will view their per-recipient quarantines, the FortiMail unit’s FQDN must be globally DNS-resolvable. External SMTP servers require that A records and reverse DNS records be configured on public DNS servers for both forward and reverse lookup of the FQDN and its IP address.
• Configure the public DNS records for each of your protected domains with only one MX record that routes incoming email through the FortiMail unit (gateway mode). With only one MX record, spammers cannot bypass the FortiMail unit by using lower-priority mail gateways.
• If the FortiMail unit is operating in transparent mode, SMTP clients are configured for
authentication, and you have disabled the Use client-specified SMTP server to send
email option for SMTP proxies (located in Mail Settings > Proxies > Proxies), you must
configure and apply an authentication profile (such as Profile > Authentication >
Authentication). Without the authentication profile, authentication with the FortiMail unit will fail. Additionally, you must configure an access control rule (located in Policy >
Access Control > Receive) to allow relay to external domains.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
465
Antispam tuning Fine tuning
Antispam tuning
• If the spam catch rate is low, see
for fine tuning instructions.
• Use black and white lists with caution. They are simple and efficient tools for fighting spam and enhancing performance. They can also cause false positives and false negatives if not used properly, however. For example, a white list entry *.edu would allow all mail from the .edu top level domain to bypass the FortiMail unit's antispam scans.
• Do not whitelist protected domains. Because white lists bypass antispam scans, email with spoofed sender addresses in the protected domains could bypass antispam features.
• To prevent directory harvest attacks (DHA), use a combination of recipient verification and sender reputation.
DHA is one a common method used by spammers. It utilizes recipient verification in an attempt to determine an email server’s valid email addresses so that they can be added to a spam database.
If Recipient Address Verification (located in Mail Settings > Domains > Domains) is
enabled, each recipient address will be verified with the protected email server. For email destined for invalid recipient addresses, the FortiMail unit will return User
Unknown messages to the SMTP client. However, spammers will utilize this response to guess and learn valid recipient addresses.
To prevent this, enable Enable sender reputation checking in session profiles (located
in Profiles > Session > Session). Sender reputation weighs each SMTP client’s IP address and assigns them a score. If the SMTP client sends several email messages to unknown recipients, the sender’s reputation score is increased significantly. When the sender reputation score exceeds the threshold, the SMTP client’s SMTP sessions are terminated at connection level.
• To prevent delivery status notification (DSN) spam, enable bounce verification.
Spammers may sometimes use the DSN mechanism to bypass antispam measures. In this attack, sometimes called “backscatter”, the spammer spoofs the email address of a legitimate sender and intentionally sends spam to an undeliverable recipient, expecting that the recipient’s email server will send a DSN back to the sender to notify him/her of the delivery failure. Because this attack utilizes innocent email servers and a standard notification mechanism, many antispam mechanisms may be unable to detect the difference between legitimate and spoofed DSN.
To prevent this, enable bounce address tagging and verification (located in AntiSpam >
Bounce Verification > Settings) and configure it with an active key. In addition, disable
both the Bypass bounce verification option (located in Mail Settings > Domains >
Domains) and the Bypass Bounce Verification check option (located in Profile >
Session > Session). It is also recommended to select Use antispam profile settings for
the Bounce verification action option (located in AntiSpam > Bounce Verification >
Settings). Finally, verify that all email, both incoming and outgoing, is routed through the FortiMail unit. The FortiMail unit will not be able to tag email, or recognize legitimate DSN for previously sent email, if all email does not pass through it.
Policy tuning
• Disable or delete policies and policy settings with care. Any changes made to policies take effect immediately.
466
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Fine tuning System maintenance tips
• Arrange policies in the policy list from most specific at the top to more general at the bottom. Policy matches are checked from the top of the list, downward. For example, a very general policy matches all connection attempts. When you create exceptions to a general policy, you must add them to the policy list above the general policy.
• Verify all SMTP traffic has a matching policy. If traffic does not match a policy, it is allowed. If you’re certain all desired traffic is allowed by existing policies, add an IP policy to the bottom of the IP policy list to reject all remaining connections and thereby tighten security.
To do this, create a new IP policy. Enter 0.0.0.0/0 as the IP address to match, and select Reject connections with this match. Finally, move this policy to the bottom of the
IP policy list. With this policy in place, the FortiMail unit’s default behavior of allowing traffic with no policy matches is effectively reversed. Traffic with no other matches will now be denied by this final policy.
• Users can authenticate with the FortiMail unit using SMTP, POP3, IMAP, LDAP, or
RADIUS servers. For users to be able to authenticate, you must create and apply an authentication profile (located in Profile > LDAP > LDAP and Profile > Authentication >
Authentication).
• Addresses specified in an IP-based policy should be as specific as possible. Use subnets or specific IP addresses for more granular control. Use a 32-bit subnet mask
(that is, 255.255.255.255) when creating a single host address. The IP setting
0.0.0.0/0 matches all hosts.
System maintenance tips
• Before upgrading or downgrading the firmware, always perform a complete backup, including the configuration file and other related data such as the Bayesian database, dictionary, and black and white lists. For details on how to perform a complete backup, see
“Backup and restore” on page 97 .
• Upgrade to the latest available firmware. After downloading the firmware file from
Fortinet Technical Support ( https://support.fortinet.com/ ), back up the configuration and other data, then go to Monitor > System Status > Status, and, in the Firmware Version row, select the Update link.
• Configure the FortiMail unit to accept both scheduled and push updates of antivirus and attack definitions. FortiGuard updates are configured in
Maintenance > FortiGuard > Update.
• Before a FortiMail unit can receive FortiGuard Antivirus and/or FortiGuard Antispam updates, it must be able to connect to the FortiGuard Distribution Network (FDN). FDN connection status can be checked in Maintenance > FortiGuard > Update.
• Allow the FortiMail unit access to a valid DNS server. DNS services are required for many FortiMail features, including scheduled updates and FortiGuard Antispam rating queries. The DNS server used by the FortiMail unit is configured in System >
Network > DNS.
Performance tuning
• Enable Recipient Address Verification (located in Mail Settings > Domains > Domains)
with an SMTP or LDAP server. This is especially important when quarantining is enabled because of the potentially large amount of quarantined mail for invalid recipients.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
467
Performance tuning Fine tuning
Note: Microsoft Exchange server's user verification feature is disabled by default.
Alternatively, enable Automatic Removal of Invalid Quarantine Accounts to delete
invalid user quarantine directories daily at a configured time.
If quarantining is enabled and neither of these features are enabled, performance will suffer and could potentially cause the FortiMail unit to refuse SMTP connections if subject to extremely heavy mail traffic.
• Enable greylisting (located in Profile > AntiSpam > AntiSpam) to reject many spam delivery attempts before more resource-intensive antispam scans are used to identify spam.
• Apply spam throttling features by creating an IP-based policy (located in Policy >
Policies > Policies) with a session profile (located in Profile > Session > Session).
Sender reputation, session limiting, and error handling are particularly useful.
antispam profile.
• To reduce latency associated with DNS queries, use a DNS server on your local network.
• If logs are stored on the FortiMail unit, set logging rotation size (located in
Log and Report > Log Settings > Local Log Settings) to between 10 MB and 20 MB, and set the event logging level to warning or greater. Delete or back up old logs regularly to free storage space.
• Regularly delete or backup old reports to reduce the number of reports on the local disk.
• Regularly delete old and unwanted mail queue entries and quarantined mail.
• Schedule resource-intensive and non-time-critical tasks, such as report generation and delivery of deferred oversize messages, to low-traffic periods.
• Disable resource-intensive scans, such as the heuristic scan (located in Profile >
AntiSpam > AntiSpam), when spam capture rate is otherwise satisfactory.
• Consider enabling the Max message size to scan and Bypass scan on SMTP
authentication in the Scan Conditions section of antispam profiles (located in Profile >
AntiSpam > AntiSpam).
• If possible, format the mail and log disks regularly to improve disk performance.
Caution: Back up logs and mail before formatting the hard disks. Formatting log disks deletes all the log entries. Formatting mail disks with the execute formatmaildisk CLI command will result in the loss of all locally stored mail; execute formatmaildisk_backup will preserve it. These operations require a reboot when complete. For more information, see the FortiMail CLI Reference .
468
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Troubleshooting Hardware issues
Troubleshooting
This chapter provides troubleshooting techniques for some frequently encountered problems. Each troubleshooting item describes both the problem and the solution.
For late-breaking troubleshooting information, see the Fortinet Knowledge Base .
For additional information, see also
This topic includes:
•
•
•
•
•
•
Hardware issues
Problem
Event log shows RAID errors regarding a degraded array event on multiple HD dev.
(ref./dev/md2 and /dev/md3)
Solution
You may have a hard drive device problem. For example, one of the RAID disks may not be functioning properly. Check the RAID status (see
“Configuring RAID” on page 151 ).
GUI and CLI connection issues
Problem
An administrator account can connect to the advanced mode of the web-based manager, but not to the basic mode nor to the CLI.
Solution
Set the administrator account’s Domain to System. Domain administrators, also known as tiered administrators, cannot access the CLI or the basic mode of the GUI. For more information, see
“Management methods” on page 19 .
If you require the ability to restrict the account to specific areas of the GUI, consider using
access profiles instead. For details, see “Configuring access profiles” on page 149 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
469
FortiGuard connection issues Troubleshooting
FortiGuard connection issues
Problem
The FortiMail unit cannot connect to the FDN servers to use FortiGuard Antivirus and/or FortiGuard Antispam services.
Solution
FortiGuard Antivirus and FortiGuard Antispam subscription services use multiple types of connections with the FortiGuard Distribution Network (FDN). For details on verifying FDN
connection, see “Verifying connectivity with FortiGuard services” on page 113
.
For all FortiGuard connection types, you must satisfy the following requirements:
• Register your FortiMail unit with the Fortinet Technical Support web site, https://support.fortinet.com/ .
• Obtain a trial or purchased service contract for FortiGuard Antispam and/or FortiGuard
Antivirus, and apply it to your FortiMail unit. If you have multiple FortiMail units, including those operating in high availability (HA), you must obtain separate contracts for each FortiMail unit. You can view service contracts applied to each of your registered FortiMail units by visiting the Fortinet Technical Support web site, https://support.fortinet.com/ .
• Configure your FortiMail unit to connect with a DNS server that can resolve the domain names of FortiGuard servers. For more information, see
“Configuring DNS” on page 130 .
• Configure your FortiMail unit with at least one route so that the FortiMail unit can connect to the Internet. For more information, see
“Configuring static routes” on page 128 .
You can verify that you have satisfied DNS and routing requirements by using the CLI commands:
• execute nslookup host antispam.fortigate.com
• execute traceroute <address_ipv4> where <address_ipv4> is one of the FortiGuard servers.
If you have satisfied these requirements, verify that you have also satisfied the requirements specific to the type of connection that is failing, listed in
.
Table 40: FortiGuard connectivity requirements scheduled updates
(FortiGuard
Antivirus/FortiGuard
Antispam)
• Configure the system time of the FortiMail unit, including its time zone.
For more information, see “Configuring the time & date” on page 133 .
• Intermediary firewall devices must allow the FortiMail unit to use
HTTPS on TCP port 443 to connect to the FDN.
• If your FortiMail unit connects to the Internet through a proxy, use the
CLI command set system autoupdate tunneling to enable the
FortiMail unit to connect to the FDN through the proxy. For more information, see the FortiMail CLI Reference .
• You might need to override the FortiGuard server to which the
FortiMail unit is connecting, and connect to one other than the default server for your time zone. For more information, see
“Verifying connectivity with FortiGuard services” on page 113
.
470
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Troubleshooting MTA issues
Table 40: FortiGuard connectivity requirements push updates
(FortiGuard
Antivirus)
• Satisfy all requirements for scheduled updates (above).
• If there is a NAT device installed between the FortiMail unit and the
FDN, you must configure it to forward push traffic (UDP port 9443) to the FortiMail unit. You must also configure “Use override push IP”. For more information, see
“Configuring push updates” on page 117
.
• Intermediary firewall devices must allow the FortiMail unit to use UDP port 53 to connect to the FDN.
rating queries
(FortiGuard
Antispam)
If you suspect that one of the devices on your network is interfering with connectivity, you can analyze traffic and verify that the FortiMail unit is sending and receiving traffic on the required port numbers by using the CLI command diagnose sniffer to perform packet capture. If traffic is being corrupted or interrupted, you may need to perform packet capture at additional points on your network to locate the source of the interruption. For details on using FortiMail packet capture for troubleshooting, see the FortiMail Install
Guide .
MTA issues
Problem
SMTP clients receive the message 550 5.7.1 Relay access denied.
Solution
This indicates rejection due to lack of relay permission.
• For incoming connections, relay will be allowed automatically unless explicitly rejected
through the access control list (see “Configuring access control rules” on page 262 ).
• For outgoing connections, relay will be allowed only if explicitly granted by
authentication (see “Controlling email based upon IP addresses” on page 278 ) or by
the access control list (see “Configuring access control rules” on page 262 ). If
authentication is required, verify that the SMTP client is configured to authenticate.
If you receive a 5.7.1 error message that does not mention relay access, and sender reputation or endpoint reputation is enabled, verify that the SMTP client has not exceeded the reputation score threshold for rejection.
Problem
The FortiMail unit is bypassed.
Solution
FortiMail units can be physically bypassed in a complex network environment if the network is not carefully planned and deployed. Bypassing can occur if SMTP traffic is not correctly routed by intermediary NAT devices such as routers and firewalls.
If your FortiMail unit will be performing antispam scans on outgoing email, all outgoing email must be routed through the FortiMail unit. If your email users and protected servers are configured to relay outgoing mail through another MTA such as that of your ISP, the
FortiMail unit will be bypassed for outgoing email.
Spammers can easily determine the lowest priority mail server (highest preference number in the DNS MX record) and deliver spam through that lower-priority MX in an attempt to avoid more effective spam defenses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
471
MTA issues
472
Troubleshooting
To ensure that spammers cannot bypass the FortiMail unit
1 Configure routers and firewalls to route SMTP traffic to the FortiMail unit for scanning.
2 If the FortiMail unit is operating in gateway mode, modify the DNS server for each protected domain to keep only one single MX record which refers to the FortiMail unit.
3 Verify that all possible connections have a matching policy. If no policy matches, the connection will be allowed but will not be scanned. (To prevent this, you can add a policy to the bottom of the IP policy list that rejects all connections that have not matched any other policy.)
4 Verify that you have selected an antispam profile in each policy, and have enabled antispam scans.
Problem
Both antispam and antivirus scans are bypassed.
Solution
If email is not physically bypassing the FortiMail unit, but is not undergoing both antispam and antivirus scans, verify that access control rules are not too permissive. Also verify that a policy exists to match those connections, and that you have selected antispam and antivirus profiles in the policy. Scans will not be performed if no policy exists to match the connection.
Problem
Antispam scans are bypassed, but antivirus scans are not.
Solution
If antivirus scans occur, but antispam scans do not, verify that white lists are not too permissive and that you have not whitelisted senders in the protected domains. White list entries cause the FortiMail unit to omit antispam scans.
Additionally, verify that either the Bypass scan on SMTP authentication option is disabled,
or confirm that authenticated SMTP clients have not been compromised and are not a source of spam.
Problem
Recipient verification through SMTP fails.
Solution
If you have enabled the Recipient Address Verification option with a protected domain’s
SMTP server, but recipient verification fails, possible causes include:
• The SMTP server is not available.
• The network connection is not reliable between the FortiMail unit and the SMTP server.
• The SMTP server does not support ESMTP. EHLO, as defined in ESMTP, is a part of the SMTP verification process. If the SMTP server does not support ESMTP, recipient verification will fail.
• The server is a Microsoft Exchange server and SMTP recipient verification is not enabled and configured.
When the SMTP server is unavailable for recipient verification, the FortiMail unit returns the 451 SMTP reply code. The email would remain in the sending queue of the sending
MTA for the next retry.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Troubleshooting MTA issues
Problem
SMTP clients receive the message 451 Try again later.
Solution
There are several situations in which the FortiMail unit could return the 451 Try again later SMTP reply code to an SMTP client. Below are some common causes.
• The greylist routine has encountered an unknown sender or the greylist entry has expired for the existing sender and recipient pair. This is an expected behavior, and, for legitimate email, will resolve itself when the SMTP client retries its delivery later during the greylist window.
• Recipient verification is enabled and the FortiMail unit is unable to connect to the recipient verification server. There should be some related entries in the antispam log, such as Verify <[email protected]> Failed, return TEMPFAIL. If this occurs, verify that the server is correctly configured to support recipient verification, and that connectivity with the recipient verification server has not been interrupted.
Problem
The FortiMail unit replies with a temporary failure SMTP reply code, and the event log shows Milter (fas_milter): timeout before data read.
Solution
The timeout is caused by the FortiMail unit not responding within 4 minutes.
Slow or unresponsive DNS server response for DNSBL and SURBL scans can cause the
FortiMail unit’s antispam scans to be unable to complete before the timeout. When this occurs, the FortiMail unit will report a temporary failure. In most cases, the sending MTA will retry delivery later. If this problem is persistent, verify connectivity with your DNSBL and SURBL servers, and consider providing private DNSBL/SURBL servers on your local network.
Problem
When recipient verification is enabled on the Microsoft Exchange server, all email is rejected.
Solution
By default, Microsoft Exchange servers will not verify the recipient. With an Microsoft
Exchange server as the MTA, it is recommended to configure the FortiMail to use LDAP to do recipient verification using the Microsoft Active Directory service. Alternatively, you can configure Microsoft Exchange to enable SMTP recipient verification.
To configure recipient verification on a Microsoft Exchange server
1 Open the Microsoft Exchange system manager and go to Global settings >
Message Delivery > Properties.
2 Enable Recipient Filtering.
3 Click Filter recipients who are not in the Directory.
4 Go to Administrative Groups > First Administrative Group > Servers > [your server] >
SMTP > the default SMTP virtual server > Properties.
5 Click Advanced.
6 Click Edit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
473
Antispam issues Troubleshooting
7 Click Apply Recipient Filter.
8 Click OK.
•
To test the configuration, open a Telnet connection to port 25 of your Microsoft Exchange server.
Antispam issues
Problem
The spam detection rate is low.
Solution
• Confirm that no SMTP traffic is bypassing the FortiMail unit due to an incorrect routing policy. Configure routers and firewalls to direct all SMTP traffic to or through the
FortiMail unit to be scanned. If the FortiMail unit is operating in gateway mode, for each protected domain, modify public DNS records to keep only a single MX record entry that points to the FortiMail unit.
• Use white lists with caution. For example, a white list entry *.edu would allow all email from all domains in the .edu top level domain to bypass antispam scans.
• Do not whitelist protected domains. Because white lists bypass antispam scans, email with spoofed sender addresses in the protected domains could bypass antispam features.
• Verify that all protected domains have matching policies and proper protection profiles.
• Consider enabling adaptive antispam features such as greylisting and sender reputation.
Caution: Enable additional antispam features gradually, and do not enable additional antispam features after you have achieved a satisfactory spam detection rate. Excessive antispam scans can unnecessarily decrease the performance of the FortiMail unit.
Problem
Email users are spammed by DSN for email they did not actually send.
Solution
Spammers may sometimes use the delivery status notification (DSN) mechanism to bypass antispam measures. In this attack, sometimes called “backscatter”, the spammer spoofs the email address of a legitimate sender and intentionally sends spam to an undeliverable recipient, expecting that the recipient’s email server will send a DSN back to the sender to notify him/her of the delivery failure. Because this attack utilizes innocent email servers and a standard notification mechanism, many antispam mechanisms may be unable to detect the difference between legitimate and spoofed DSN.
To detect backscatter
) and the Bypass Bounce Verification check option (see
“Configuring session profiles” on page 285
).
474
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Troubleshooting Antispam issues
Problem
Email users cannot release and delete quarantined messages by email.
Solution
Two common reasons are:
• The domain name portion of the recipient email address (for example, fortimail.example.com in [email protected]) could not be resolved by the DNS server into the FortiMail unit's IP address.
• The sender’s email address in the release message was not the same as the intended recipient of the email that was quarantined. If you have configured your mail client to handle multiple email accounts, verify that the release/delete message is being sent by the email address corresponding to that per-recipient quarantine. For example, if an email for [email protected] is quarantined, to release that email, you must send a release message from [email protected].
Problem
3 In addition, verify that all outgoing and incoming email passes through the FortiMail unit. The FortiMail unit will not be able to tag email, or recognize legitimate DSN for previously sent email, if all email does not pass through it. For details, see
“Configuring bounce verification & tagging” on page 409
.
Attachments less than the 10 MB configured limit are not deliverable
Solution
The message limit is a total maximum for the entire transmitted email: the message body, message headers, all attachments, and encoding, which in some cases can expand the size of the email. For example, depending on the encoding and the content of the email, an email with an 8 MB attachment could easily exceed the transmitted message size limit of 10 MB.
Therefore, attachments should be significantly smaller than the configured limit.
Problem
Legitimate SMTP clients are blocked by sender reputation or endpoint reputation.
Solution
When sender reputation or endpoint reputation is enabled in a session profile, it relies on
the thresholds set for Temporarily fail client at n at and Reject client at n to determine if it
should block an SMTP client or not. (For endpoint reputation, this threshold is instead
located in the field Auto blacklist score trigger value.)
If either of these two values have a low threshold, a legitimate SMTP client's sender reputation score can easily reach that threshold and the FortiMail unit could refuse further connections from that SMTP client. If this is a common problem, you can increase the value of the thresholds in the session profile.
However, to prevent the problem from recurring, you should locate and resolve the reason that the sender reputation score is increasing: it may be due to an increased amount of spam originating, for example, from a compromised MTA.
Problem
The exported email archive is an empty file.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
475
Antispam issues Troubleshooting
Solution
After selecting the checkboxes of archived email (see
“Configuring global email archive settings” on page 431
) that you want to export, make sure that you click the Mark button.
Only email whose Status column contains a check mark will be exported.
Problem
Event log messages show DNSBL query errors.
Solution
Log messages such as:
RblServer::check 20.4.90.202.zen.spamhaus.org error=2 : 'Host name lookup failure' could mean that the query is being refused because it exceeds pre-defined service limitations by the DNSBL service provider. If you have very high volume of email traffic, consider providing a DNSBL server on your local network by synchronizing the DNSBL database to it. For details, consult your service provider.
Problem
Antipam quarantine reports are delayed.
Solution
•
•
•
In most cases, this is caused by an excessive number of quarantine accounts.
When an email is accepted for a recipient and identified as spam, a quarantine account is automatically created in FortiMail.
Check that these quarantine accounts are valid, as netbots and spam harvest scans can cause the creation of a large number of false accounts.
There are options to manage quarantine accounts in FortiMail.These options are available in the domain settings under Mail Settings > Domains.
• Enable Recipient Address Verification to stop invalid account creation with SMTP or
LDAP authentication (Note that LDAP cache should be enabled).
• Remove invalid accounts by enabling Automatic Removal of Invalid Quarantine
Accounts.
Recipient validation is a clean solution with a performance cost on SMTP or LDAP services. Its another disadvantage is that it also results in informing the outside whether the accounts are valid or not.
The automatic clearance of accounts is started once per day at 4:00 AM by default, but can be modified by the following CLI command: config antispam settings set system option backend_verify <hh:mm:ss> end where hh is the hour according to a 24-hour clock, mm is the minute, and ss is the second.
476
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Troubleshooting HA issues
HA issues
Problem
Active-passive HA cluster does not switch to the backup unit after a failure.
Solution
If an individual service has failed that does not disrupt the HA heartbeat, an active-passive
HA cluster may not fail over. For example, it is possible that one or more services (such as
SMTP, IMAP, POP3, web access, or a hard drive or network interface) could fail on the primary unit (master) without affecting the HA heartbeat.
To cause failover when an individual service fails, configure service monitoring (see
“Configuring service-based failover” on page 175 ) on both the primary unit and backup
unit.
Problem
Mail queues do not appear on the HA backup unit.
Solution
In order to display queue content in the backup unit, mail data must be synchronized from
the primary unit. If the Backup MTA queue directories option is disabled, mail queues will
not be synchronized. You can enable MTA spool synchronization to be able to view the mail queues from either the backup unit or the primary unit.
Note: Synchronization of MTA spool directories can result in decreased performance, and may not enable you to view all email in the mail queues, as mail queue content can change more rapidly than synchronization occurs.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
477
HA issues Troubleshooting
478
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Setup for email users Training Bayesian databases
Setup for email users
This chapter contains information that you may need to inform or assist your email users so that they can use FortiMail features.
This information is not the same as what is included in the help for FortiMail webmail. It is included in the Administration Guide because:
• Email users may require some setup before they will be able to access the help for
FortiMail webmail.
• Some information may be too technical for some email users.
• Email users may not be aware that their email has been scanned by a FortiMail unit, much less where to get documentation for it.
• Email users may not know which operation mode you have configured.
• Email users may be confused if they try to access a feature, but you have not enabled it (such as Bayesian scanning or their personal quarantine).
• You may need to tailor some information to your network or email users.
Note: For additional email client setup information, see the FortiMail Install Guide .
This topic includes:
•
•
•
Accessing the personal quarantine & webmail
•
Sending email from an email client (gateway and transparent mode)
Training Bayesian databases
Bayesian scanning can be used by antispam profiles to filter email for spam. In order to be accurate, the Bayesian databases that are at the core of this scan must be trained. This is especially important when the databases are empty.
Administrators can provide initial training. For details, see
“Training the Bayesian databases” on page 421
. If you have enabled it (see
“Configuring the Bayesian training control accounts” on page 429
and
“Accept training messages from users” on page 306 ),
email users may also be able to contribute to training the Bayesian databases.
To help to improve the accuracy of the database, email users selectively forward email to the FortiMail unit. These email are used as models of what is or is not spam. When it has seen enough examples to become more accurate at catching spam, a Bayesian database is said to be well-trained.
For example, if the local domain is example.com, and the Bayesian control email addresses are the default ones, an administrator might provide the following instructions to his or her email users.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
479
Managing tagged spam Setup for email users
To train your antispam filters
1 Initially, forward a sample set of spam and non-spam messages.
• If you have collected spam, such as in a junk mail folder, and want to train your personal antispam filters, forward them to [email protected] from your email account. Similar email will be recognized as spam.
• If you have collected non-spam email, such as your inbox or archives, and want to train your personal spam filters, forward them to [email protected] from your email account. Similar email will be recognized as legitimate email.
2 On an ongoing basis, to fine-tune your antispam filters, forward any corrections — spam that was mistaken for legitimate email, or email that was mistaken for spam.
• Forward undetected spam to [email protected] from your email account.
• Forward legitimate email that was mistaken for spam to [email protected] from your email account.
• If you belong to an alias and receive spam that was sent to the alias address, forward it to [email protected] to train the alias’s database. Remember to enter the alias, instead of your own email address, in the From: field.
This helps your antispam filters to properly distinguish similar email/spam in the future.
Managing tagged spam
Instead of detaining an email in the system or personal quarantine, the administrator can configure the FortiMail unit to tag the subject line or header of an email that is detected as
spam. For details, see “Configuring antispam action profiles” on page 312 .
Once spam is tagged, the administrator notifies email users of the text that comprises the tag. Email users can then set up a rule-based folder in their email clients to automatically collect the spam based on tags.
For example, if spam subject lines are tagged with “SPAM”, email users can make a spam folder in their email client, then make filter rules in their email clients to redirect all email with this tag from their inbox into the spam folder.
Methods to create mailbox folders and filter rules vary by email client. For instructions, see your email client’s documentation.
Accessing the personal quarantine & webmail
Each email user has a personal quarantine, also known as the Bulk mailbox folder. If you have selected that action in the antispam action profiles, spam for an email user is redirected to their personal quarantine.
Email users should monitor their personal quarantines to ensure that legitimate email is not accidentally quarantined. To do this, you can enable quarantine reports (see
“Configuring global quarantine report settings” on page 380
,
“Configuring protected domains” on page 211
, and “Using quarantine reports” on page 481 ). You can also enable
email users to view their Bulk folder through:
• FortiMail webmail
• POP3, using an email client such as Microsoft Outlook or Mozilla Thunderbird
In addition to personal quarantine access, in server mode, FortiMail webmail also provides access to the Inbox, address book, and other features.
480
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Setup for email users Accessing the personal quarantine & webmail
Available access methods vary by the operation mode of the FortiMail unit:
•
Accessing personal quarantines through FortiMail webmail (gateway and transparent mode)
•
Accessing FortiMail webmail (server mode)
•
Accessing personal quarantines through POP3 or IMAPv4 (gateway and transparent mode)
•
Accessing mailboxes through POP3 or IMAPv4 (server mode)
Accessing personal quarantines through FortiMail webmail (gateway and transparent mode)
To allow email users to access Bulk folders through FortiMail webmail, the administrator must:
• create an authentication profile that allows users to authenticate
• configure an incoming recipient-based policy that matches the email user’s address, where webmail access to the quarantine is enabled, and the authentication profile is selected
For details, see “Controlling email based upon the recipient” on page 272 and
“Configuring authentication profiles” on page 330
.
Once this is configured, the administrator informs email users of the FortiMail webmail
URL. When they log in, email users will immediately see their Bulk folders. (Unlike server mode, in gateway mode or transparent mode, this is the only mailbox folder.)
For additional instructions related to their personal quarantine, email users can click the
Help button in FortiMail webmail.
Accessing FortiMail webmail (server mode)
Unlike gateway mode and transparent mode, server mode does not require that the administrator create an authentication profile. However, he or she must still configure an incoming recipient-based policy that matches the email user’s address, where webmail access to the quarantine is enabled through a resource profile.
Once this is configured, the administrator informs email users of the FortiMail webmail
URL. When they log in, email users will immediately see all of their mailbox folders, including their Inbox, in addition to their Bulk folder.
For additional instructions related to their personal quarantine, email users can click the
Help button in FortiMail webmail.
Using quarantine reports
If an administrator has enabled:
• quarantine reports to email users (see
“Configuring global quarantine report settings” on page 380 )
when email is added to their personal quarantine, email users will periodically receive an email similar to one of the samples below.
Email users can follow the instructions in the quarantine report to release or delete email from their personal quarantine. Quarantine reports can be used from with FortiMail webmail, or from an email client with POP3 access.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
481
Accessing the personal quarantine & webmail Setup for email users
Example: Quarantine report (HTML)
The following sample report in HTML format informs the email user about how many messages are in quarantine, and explains how to delete one or all quarantined messages, and how to release an individual email. Email users can make decisions to release or delete an email based on a message’s subject and sender information contained in the body of the report.
Figure 279: Sample quarantine report in HTML format
Example: Quarantine report (plain text)
The following sample report in plain text format informs email users about how many messages are in quarantine, and explains how to delete one or all quarantined messages, and how to release an individual email. Email users can make decisions to release or delete an email based on a message’s subject and sender information contained in the body of the report.
482
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Setup for email users Accessing the personal quarantine & webmail
Table 41: Sample quarantine report in plain text format
From: [email protected]
Subject: Quarantine Summary: [3 message(s) quarantined from Wed,
11 Jul 2007 11:00:01 to Wed, 11 Jul 2007 12:00:01]
Date: Wed, 11 Jul 2007 12:00:01 -0400
Date: Wed, 11 Jul 2007 11:11:25
Subject: Sign up for FREE offers!!!
From: "Spam Sender" <[email protected]>
Message-Id: [email protected]
Date: Wed, 11 Jul 2007 11:14:16
Subject: Buy cheap stuff!
From: "Spam Sender" <[email protected]>
Message-Id: [email protected]
Date: Wed, 11 Jul 2007 11:15:46
Subject: Why pay more?
From: "Spam Sender" <[email protected]>
Message-Id: [email protected]
Actions: o) Release a message:
Send an email to <[email protected]> with subject line set to "[email protected]:Message-Id".
o) Delete a message:
Send an email to <[email protected]> with subject line set to "[email protected]:Message-Id".
o) Delete all messages:
Send an email to <[email protected]> with subject line set to
"delete_all:[email protected]:ea809095:ac146004:05737c7c111d68d01
11d68d0111d68d0".
Accessing personal quarantines through POP3 or IMAPv4 (gateway and transparent mode)
To allow email users to access Bulk folders through FortiMail webmail, the administrator must configure an incoming recipient-based policy that matches the email user’s address, where POP3 access to the quarantine is enabled, and the authentication profile is selected.
For details, see “Controlling email based upon the recipient” on page 272 and
“Configuring authentication profiles” on page 330
.
Once this is configured, the administrator informs email users of the IP address and
POP3/IMAPv4 port number of the FortiMail unit, which they will use when configuring their email client to connect. After their email client is connected, email users will see their Bulk folder. (Unlike server mode, in gateway mode or transparent mode, this is the only mailbox folder.)
Methods vary by the email client. For details, see the email client’s documentation.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
483
Sending email from an email client (gateway and transparent mode) Setup for email users
Accessing mailboxes through POP3 or IMAPv4 (server mode)
To allow email users to access their Inbox, Bulk, and other folders through an email client, the administrator must configure an incoming recipient-based policy that matches the email user’s address, where POP3/IMAPv4 access to the quarantine is enabled.
Once this is configured, the administrator informs email users of the IP address and
POP3/IMAPv4 port number of the FortiMail unit, which they will use when configuring their email client to connect. After their email client is connected, email users will see all of their mailbox folders, including their Inbox and Bulk.
If tagged spam (see “Configuring antispam action profiles” on page 312 ) appears in their
Inbox, email users can use their email client’s filtering rules to redirect spam email to their
Bulk folder or other folder.
Methods vary by the email client. For details, see the email client’s documentation.
Sending email from an email client (gateway and transparent mode)
To enable email users to send email through the FortiMail unit using an email client, the administrator must:
• Create an access control rule that permits valid email clients to connect. For details, see
“Configuring access control rules” on page 262 .
• Create an authentication profile to authenticate the users. For details, see
“Configuring authentication profiles” on page 330 .
• Enable SMTP authentication in the incoming recipient-based policy. For details, see
“Controlling email based upon the recipient” on page 272 .
The email user must configure their email client with:
• outgoing SMTP email server that is either the FortiMail unit (gateway mode) or the protected SMTP server (transparent mode)
• enabled SMTP authentication
• user name and password (provided by the administrator; these credentials must mast the ones retrieved by the authentication profile)
• authentication that includes the domain name, such as [email protected] instead of user1
484
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Appendix A: Supported RFCs
Appendix A: Supported RFCs
FortiMail units support the following RFCs:
• RFC 822 ( Standard for the Format of ARPA Internet Text Messages ): see page
• RFC 1213 ( Management Information Base for Network Management of TCP/IP-based internets: MIB-II
• RFC 1869 ( SMTP Service Extensions
• RFC 1891 ( SMTP Delivery Status Notifications ): see page
• RFC 1892 ( Multipart/Report Content Type for the Reporting of Mail System
Administrative Messages )
• RFC 1893 ( Enhanced Mail System Status Codes )
• RFC 1894 ( Extensible Message Format for Delivery Status Notifications )
• RFC 1918 ( Address Allocation for Private Internets ): see page 13 ,
,
• RFC 1985 ( SMTP Service Extension for Remote Message Queue Starting )
• RFC 2034 ( SMTP Service Extension for Returning Enhanced Error Codes )
• RFC 2045 ( Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet
Message Bodies )
• RFC 2476 ( Message Submission
• RFC 2505 ( Anti-Spam Recommendations for SMTP MTAs )
• RFC 2554 ( SMTP Service Extension for Authentication )
• RFC 2634 ( Enhanced Security Services for S/MIME ): see page
• RFC 2665 ( Definitions of Managed Objects for the Ethernet-like Interface Types
• RFC 2821 ( Simple Mail Transfer Protocol ): see page 26 ,
• RFC 2822 ( Internet Message Format ): see page
,
,
, 323
• RFC 2920 ( SMTP Service Extension for Command Pipelining ): see page
• RFC 3461 ( Simple Mail Transfer Protocol (SMTP) Service Extension for Delivery
Status Notifications (DSNs)
290
• RFC 3463 ( Enhanced Mail System Status Codes ): see page
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
485
Appendix A: Supported RFCs
486
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Appendix B: Maximum Values Matrix
Appendix B: Maximum Values Matrix
This table shows maximum configurable values for FortiMail Version 4.0 Patch 2 and is not a promise of performance.
Table 42: Maximum configurable values
Feature FortiMail-
100(C)
FortiMail-
400(B)
500
5000
FortiMail-
2000(A)
3000
20000
FortiMail-
2000B
5000
20000
FortiMail-
4000A,
5001A
10000
40000
Protected domains 50
Domain associations
2000
IP policies
Recipient based policies (incoming) per domain
60
60
Recipient based policies (outgoing)
Total recipient based policies
(incoming and outgoing)
60
300
Email users (server mode)
User groups per domain
User groups per system
Users per user group
200
20
100
20
Total administrators
IP pool profile
Session profiles
50
100
60
Dictionary profiles 20
Dictionary groups 10
Dictionary profiles per dictionary group
Entries per dictionary
LDAP profiles
10
256
20
200
600
600
3000
1000
100
500
100
250
100
200
50
25
10
1024
50
600
1500
1500
7500
3000
200
1000
200
500
100
600
100
50
10
2048
100
600
1500
1500
7500
3000
200
1000
200
500
100
600
100
50
10
2048
100
600
1500
1500
7500
3000
200
1000
200
500
100
600
100
50
10
2048
100
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
487
488
Appendix B: Maximum Values Matrix
Table 42: Maximum configurable values
Each type of other profiles per domain
(antivirus, antispam, authentication, resource, authentication, and content)
50
Each type of other profiles per system
(antivirus, antispam, authentication, resource, authentication, and content)
60
256 Banned words in each antispam profile
White words in each antispam profile
Access rules
Entries in the lists within a session profile, including sender blacklist addresses, sender whitelist addresses, recipient blacklist addresses, and recipient whitelist addresses
256
128
128
Certificate bindings 10
Units in a config
HA cluster
25
500 Email archiving policies
Email archiving exempt policies
500
Stored greylist entries (default)*
Stored greylist entries (available range)
40 000
40 000 to125
000
Greylist exempt list entries
500 or 1% of the stored greylist entries, whichever is greater
50
200
256
256
512
512
100
25
500
500
80 000
40 000 to 125
000
500 or 1% of the stored greylist entries, whichever is greater
50
600
256
256
1024
1024
600
25
500
500
80 000
40 000 to
125 000
500 or 1% of the stored greylist entries, whichever is greater
50
600
256
256
1024
1024
1000
25
500
500
80 000
80 000 to
250 000
50
600
256
256
1024
1024
2000
25
500
500
80 000
80 000 to
250 000
500 or 1% of the stored greylist entries, whichever is greater
500 or 1% of the stored greylist entries, whichever is greater
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Appendix B: Maximum Values Matrix
Table 42: Maximum configurable values
Bounce verification keys
Length of bounce verification keys
White list or black list entries
16
63
2048
16
63
2048
16
63
2048
16
63
2048
16
63
2048
*The number of stored greylist entries can be changed with the CLI command set as greylist capacity. For details about this command, see the FortiMail CLI Reference .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
489
Appendix B: Maximum Values Matrix
490
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Appendix C: Port Numbers
Appendix C: Port Numbers
The following tables and diagram describe the port numbers that the FortiMail unit uses:
• ports for traffic originating from units (outbound ports)
• ports for traffic receivable by units (listening ports)
• ports used to connect to the Fortinet Distribution Network (FDN ports)
Traffic varies by enabled options and configured ports. Only default ports are listed.
Table 43: FortiMail outbound ports
Functionality
DNS lookup; RBL lookup
FortiGuard Antispam rating lookup
NTP synchronization
SNMP traps
Syslog
Remote email archive storage to FTP or SFTP server
SMTP email relay or delivery; SMTP authentication; SMTP recipient verification; SMTP alert email
Dynamic DNS updates; HA web service monitoring
POP3 authentication; HA POP3 service monitoring
IMAP authentication; HA IMAP service monitoring
LDAP authentication and queries
FortiGuard Antivirus or FortiGuard Antispam update; registration with, configuration backup to, and configuration and firmware pull from a
FortiManager unit
SMTPS email relay or delivery
RADIUS authentication
HA heartbeat
HA configuration and data synchronization
Remote mail data storage on an NFS NAS
Port(s)
UDP 53
UDP 53
UDP 123
UDP 162
UDP 514
TCP 21 or TCP 22
TCP 25
TCP 80
TCP 110
TCP 143
TCP 389 or TCP 636
TCP 443
TCP 465
TCP 1812
TCP 2000
TCP 2001, TCP 2002,
TCP 2003
TCP 2049
Table 44: FortiMail listening ports
Functionality
FortiGuard Antivirus push update
The FDN sends notice that an update is available. Update downloads then occur on standard originating ports for updates.
Port(s)
Note: When operating in the default configuration, FortiMail units do not accept TCP or UDP connections on any port except the port1 and port2 network interfaces, which accept ICMP pings,
HTTPS connections on TCP port 443, and SSH connections on TCP port 22.
SNMP poll UDP 161
UDP 9443
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
491
Appendix C: Port Numbers
Table 44: FortiMail listening ports
SSH administrative access to the CLI; remote management from a
FortiManager unit
Telnet administrative access to the CLI
SMTP email relay; SMTP email delivery (server mode only); HA SMTP service monitoring
HTTP administrative access to the web-based manager; HA web service monitoring; webmail and per-recipient quarantine access for email users
POP3 email retrieval (server mode only); POP3 email quarantine retrieval
(gateway mode and transparent mode only); HA POP3 service monitoring
IMAP email retrieval (server mode only); HA IMAP service monitoring
HTTPS administrative access to the web-based manager; remote management from a FortiManager unit; webmail and per-recipient quarantine access for email users
SMTPS email relay; SMTPS email delivery (server mode only)
TCP 22
TCP 23
TCP 25
TCP 80
TCP 110
TCP 143
TCP 443
IMAPS email retrieval (server mode only)
POP3S email retrieval (server mode only)
HA heartbeat
HA configuration and data synchronization
TCP 465
TCP 993
TCP 995
TCP 2000
TCP 2001, TCP 2002,
TCP 2003
Table 45: FortiMail FDN ports
Functionality
FortiGuard Antispam rating queries
FortiGuard Antivirus push update
The FDN sends notice that an update is available. Update downloads then occur on standard originating ports for updates.
FortiGuard Antispam or FortiGuard Antivirus updates
Port(s)
UDP 53
UDP 9443
TCP 443
492
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Appendix C: Port Numbers
Figure 280: FortiMail port numbers
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
493
Appendix C: Port Numbers
494
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
Index
Symbols
Numerics
550, 25, 26, 27, 28, 44, 45, 47, 264, 266, 282, 288, 292, 293,
314, 317, 328, 371, 400, 412, 471
A
access control
action
quarantine for review, 315, 328
reject, 44, 47, 314, 328 replace, 328 rewrite recipient email address, 315, 328
tag email in header, 44, 47, 314, 328
tag email in subject, 44, 46, 313, 327
active-passive HA, 157, 163, 168
address book
administrative access, 19, 122
administrator
"admin" account, 453, 454, 458, 459, 460
system quarantine account, 387
alert email, 162, 163, 437, 447
event categories, 448 recipients, 448
alias, 62, 229, 252, 255, 340, 342
antispam
determining which profile applies, 261
antivirus
determining which profile applies, 261
appearance, web-based manager, 141
archive
using for Bayesian training, 81
asynchronous digital subscriber line (ADSL), 413
attachment, 318, 319, 320, 323
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
495
Index
authentication, 203, 232, 266, 330
bypassing antispam scans after, 312
autoexempt list
B
back up
Bayesian database
black/white lists
banned word scan, 307, 308, 312
Bayesian control account
Bayesian database back up
global, 221 per protected domain, 221
reset
restore
backing up
restoring
blind carbon copy (BCC), 314, 328
496
bounce address, 410 tag key, 410
tagging, 409 verification, 409, 410
verification failure, 410, 412
verification
bridge, 122, 123, 126, 128, 174, 232
bypass
antispam scan, 264, 266, 312, 472
bounce message verification, 290
quarantine authentication, 381
C
carriage return and line feed (CRLF), 292
end point, 79, 80, 412, 414, 415, 416, 417, 418
certificate authority (CA), 190, 191, 193, 195, 196, 197, 248,
certificate request
downloading and submitting, 193
certificate revocation list (CRL), 196, 197, 248
clear
Bayesian database
column view
command line interface (CLI), 13, 14
comma-separated value (CSV), 228, 242, 441
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
configuration example
configuration, verifying the, 459
configured operating mode, 165
content
content monitor
D
daemon
daylight savings time (DST), 134
default
administrator account, 453, 454, 458, 459, 460
network interface configuration, 123
delivery status notification (DSN), 22, 60, 62, 202, 204, 268,
digital certificate requests, 189
digital subscriber line (DSL), 413
directory harvest attacks (DHA), 466
discard, 44, 45, 47, 264, 266, 314, 317, 328, 400, 412
quarantine, 61, 64, 65, 69, 387
Distinguished Name (DN), 191, 196, 197, 350
DNS black list (DNSBL), 22, 297, 301
record for DKIM, 289 record for DomainKeys, 289
document type definition (DTD), 323
domain
domain name
download
dynamic public IP address, 130, 413
E
EHLO, 21, 25, 26, 27, 218, 220, 232, 286, 291, 292, 294
email access
email archiving, 431 configuring settings, 431
encryption
endpoint reputation score, 288
Error Correcting Code (ECC), 155
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
497
Index
Extended Simple Mail Transfer Protocol (ESMTP), 204
extended unique identifier (EUI), 108
F
failed to mount archive filesystem, 105
failover, 135, 163, 168, 172, 173
false positive or false negative, 63, 316, 396, 430
FDN
formatted view
formatting the boot device, 459
FortiGuard
Antispam, 12, 23, 110, 158, 159, 162, 287, 297, 301
Antivirus, 11, 12, 110, 158, 159, 162, 317
FortiGuard Distribution Network (FDN), 54, 110, 112, 113,
FortiGuard Distribution Server (FDS), 112
FortiMail-2000, 57, 63, 151, 154
FortiMail-2000A, 135, 152, 154, 156, 209
FortiMail-400, 57, 151, 182, 183, 487
FortiMail-4000, 57, 135, 151, 154
FortiMail-4000A, 152, 154, 156, 209
Fortinet
Technical Support, 11, 113, 119
Technical Support, registering with, 11
Technical Support, web site, 11
fully qualified domain name (FQDN), 15, 192, 202, 212, 215,
fully-qualified domain name (FQDN), 192
G
gateway mode, 67, 124, 211, 243, 259, 276, 277, 333
global
graphical user interface (GUI), 35
group
498
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
H
HA
active-passive, 157, 161, 163, 168
configuration not synchronized, 160
configuration options, 160, 168
configured operating mode, 165
effective operating mode, 165, 166
failover, 135, 159, 163, 168, 172, 173, 177
forcing configuration synchronization, 166 forcing data synchronization, 166
interface configuration synchronization, 160
mail queue sync after a failover, 161
MTA spool directory sync after a failover, 161
restarting HA processes on a stopped primary unit, 167
virtual IP DNS settings, 185 virtual IP firewall settings, 185
wait for recovery then assume slave role, 171 wait for recovery then restore original role, 171
header rewrite
HELO, 21, 25, 26, 27, 218, 220, 232, 286, 291, 292, 294
host name, 51, 67, 131, 202, 220
HTTP
webmail access, 125, 127, 277, 330
HTTP service
HTTPS, 67, 125, 127, 190, 192, 277, 330, 381
hypertext markup language (HTML), 323
I
image spam scan, 299, 311, 312
Internet service provider (ISP), 130, 203, 237, 260, 272, 285,
Invalid Quarantine Accounts, 219
IP-based policy, 259, 278, 330
K
key size, certificate, 192 key type, certificate, 192
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
499
Index
L
email alias objects, 349 group objects, 349
local certificate
local domain name, 67, 131, 202, 389, 429
local-part, 67, 69, 71, 389, 429
log
column view, 86 formatted view, 86
severity level, 438 storage, 438 storing, 438
M
500
mail exchanger (MX), 211, 212, 215
MAIL FROM, 26, 28, 29, 62, 63, 66, 74, 75, 76, 220, 255, 256,
262, 265, 271, 273, 276, 277, 278, 283, 292, 294, 296,
mail queues
mail routing, 219, 230, 233, 344
mailbox
mailHost, 351 mailRoutingAddress, 351
maintenance
Bayesian database back up
Bayesian database restore
black/white list back up
black/white list restore
mail queue back up and restore, 98
management IP, 122, 123, 126, 232, 382
manual
maximum message header size, 295
maximum message size, 203, 220, 295, 312
maximum transmission unit (MTU), 125, 127
media access control (MAC), 124, 126, 463
Microsoft
Microsoft Active Directory, 250, 335, 336, 337, 347, 349, 351
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
Microsoft Windows Service for NFS, 209
mobile phone, 413 mobile subscriber IDSN (MSISDN), 79, 413
mobile subscriber IDSNs (MSISDN), 80, 415, 417
mode
monitor
monitoring services
Mozilla
MTA
multimedia messaging service (MMS), 288, 414
MX
MX record, 174, 185, 203, 211, 238, 293
N
network access server (NAS), 413
network address authority (NAA), 108
network address translation (NAT), 60
network area storage (NAS)
network attached storage (NAS), 209, 432
storing mail data in HA mode, 174
network file system (NFS), 105, 107, 163, 209
connected to protected server, 217
network time protocol (NTP), 134
O
on HA failure
wait for recovery then assume slave role, 171 wait for recovery then restore original role, 171
Online Certificate Status Protocol (OCSP), 197, 248, 249, 250
operation mode, 12, 20, 37, 54, 160
outgoing proxy, 229, 230, 231, 237, 238
P
system quarantine administrator, 388
password-based encryption (PBE), 376
personal digital assistant (PDA), 413
PIN (Personal Identification Number), 135
point-to-point protocol over ATM (PPPoA), 413 point-to-point protocol over Ethernet (PPPoE), 413
policy
recipient-based, 259, 272 incoming, 272 outgoing, 272
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
501
Index
port number, 36, 113, 202, 203, 215
pretty good privacy (PGP), 322
privacy-enhanced email (PEM), 193, 376
profile
protected domain, 21, 65, 211, 316, 446
fully qualified domain name (FQDN), 215
recipient address verification, 21
public key infrastructure (PKI), 67, 248, 277, 333
push update, 117 push updates, 117
502
Q
quarantine
per-recipient, 45, 63, 67, 125, 127, 259, 277, 314, 328
quarantine report, 63, 64, 67, 161, 202, 247, 339
query
DNS
filter, 337, 342, 343, 349, 352
R
level, 151 mirrored array, 151 striped array, 151 support, 151
random access memory (RAM), 55
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
RCPT TO, 26, 28, 29, 62, 63, 71, 74, 75, 203, 217, 218, 230,
231, 232, 238, 255, 256, 261, 262, 265, 269, 271, 273,
276, 278, 292, 294, 296, 402, 406, 408
read & write, 149 administrator, 112, 134, 148, 149 read only, 149
Received, 220, 286, 296, 300, 301, 303
recipient address rewrite, 315, 328
recipient address verification, 21, 62, 217, 219
recipient-based policy, 259, 272
incoming, 272, 330 outgoing, 272
reconnecting to the FortiMail unit, 456
Redundant Array of Independent Disks (RAID), 151
registering
with Fortinet Technical Support, 11
regular expression, 15, 31, 75, 265, 266, 307, 368, 406, 408
reject, 25, 26, 27, 28, 44, 45, 47, 264, 266, 282, 288, 293, 314,
access denied, 264, 266, 400, 412, 471
Relaying denied, 264, 266, 293, 400, 412
remote authentication dial-in user service (RADIUS), 330, 413
replacement messages, 22, 206, 316 custom, 206
report
directionality
reports
configuring a report profile, 443
reset
Bayesian database
effective operating mode for HA, 166
resource profile, 68, 276, 277, 283, 329, 333
restore
Bayesian database
black/white lists
RFC
route
S
score
search, 68, 75, 80, 82, 397, 432
secure MIME (S/MIME), 269, 270, 291, 322, 372, 374
secure shell (SSH), 107, 125, 127
secure socket layers (SSL), 332
sender address
tagging, 409 verification, 409, 410
verification failure, 410, 412
sender identity, different, 277, 283
sender policy framework (SPF), 290
sender validation
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
503
Index
server mode, 62, 67, 124, 211, 228, 241, 243, 246, 259, 276,
277, 329, 330, 331, 333, 340, 481
services
session
short message service (SMS), 414
SMTP
AUTH, 203, 232, 262, 277, 292, 333
discard, 44, 45, 47, 264, 266, 314, 317, 328, 400, 412
greeting, 21, 211, 220, 286, 291, 294
proxy or use implicit relay, 238
reply code 550, 25, 26, 27, 28, 44, 45, 47, 264, 266, 282,
288, 292, 293, 314, 317, 328, 371, 400, 412, 471
SMTPS, 190, 202, 203, 215, 216, 217
event, 139 manager, 137, 138, 139, 140
spam
spam report, 63, 64, 65, 67, 161, 202, 247, 339, 380
query to determine recipient, 339
recipient, 382 text format, 382
spam URI realtime black list (SURBL), 22, 303
static route, 128 static routing, 128
subject information, certificate, 191
subject line, 44, 46, 71, 73, 313, 318, 327
subscriber ID, 80, 288, 413, 415, 417
subscriber identity module (SIM) card, 413
system options
system resource usage, 51 system time, 51
T
T11 network address authority (NAA), 108
technical
temporary failure, 73, 74, 78, 282, 287, 371, 473
time to live (TTL)
504
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
Index
transparent mode, 54, 67, 122, 123, 126, 128, 174, 229, 243,
259, 260, 261, 262, 276, 277, 282, 333
transport layer security (TLS), 195, 291, 332, 333, 370
troubleshooting, 111, 114, 307, 308, 355
U
unauthenticated sessions, 266, 292
uniform resource identifier (URI), 300, 303
antivirus definitions, manually, 119
password, when not required, 381
user groups
User Principle Name (UPN), 339
V
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
virtual IP
DNS settings, 185 firewall settings, 185
virus definition
viruses
hidden in encryption connections, 291
W
wait for recovery then assume slave role
wait for recovery then restore original role
web release host name, 161, 382
web-based manager
webmail
access, 122, 125, 127, 277, 330
wemail
white list
wild cards, 15, 309, 310, 391, 406, 408, 434
window
X
505
Y
Index
506
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
www.fortinet.com
www.fortinet.com
Download
Link público atualizado
O link público para seu chat foi atualizado. Você pode visualizar e gerenciar seus links de chat após o registro aqui.
Link público do documento
Anúncio