System. Fortinet 4.0 Patch 2
تبلیغات
تبلیغات
System Configuring network settings
System
The System menu enables you to configure network settings, administrator accounts, the time, the web-based manager, SNMP, RAID, high availability (HA), and certificates.
This topic includes:
•
•
Configuring the time, GUI, & SNMP
•
Configuring administrator accounts & access profiles
•
•
•
Configuring network settings
The Network submenu provides options to configure network connectivity and administrative access to the web-based manager or CLI of the FortiMail unit through each network interface.
This topic includes:
•
Configuring the network interfaces
•
•
•
Configuring the network interfaces
The Interface tab displays a list of the FortiMail unit’s network interfaces.
You must configure at least one of the FortiMail unit’s network interfaces to enable it to connect to your network. Depending on your network topology and other considerations, you may choose to connect the FortiMail unit to your network using two or more of the
FortiMail unit’s network interfaces. You can configure each network interface separately.
For more information, see
“Editing network interfaces” on page 123 .
Caution: If your FortiMail unit is not properly deployed and configured for the topology of your network, including network interface connections, email may be able to bypass the
FortiMail unit. For information on correctly deploying your FortiMail unit, see the FortiMail
Install Guide .
The web-based manager, FortiMail webmail, and the per-recipient quarantines can be accessed remotely using the network interfaces’ IP addresses. For details, see
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
121
Configuring network settings
To view the list of network interfaces, go to System > Network > Interface.
Figure 59: Viewing the list of network interfaces
System
122
Name The name of the network interface, such as port1.
If the FortiMail unit is operating in transparent mode, this column also indicates that the
IP/Netmask The IP address and netmask of the network interface.
If the FortiMail unit is in transparent mode, IP/Netmask may alternatively display
bridging. This means that
“Do not associate with management IP” on page 126
has been disabled, and the network interface is acting as a Layer 2 bridge. If high availability (HA) is also enabled, IP and Netmask may alternatively display
bridged (isolated) while the effective operating mode is slave and therefore the network interface is currently disconnected from the network, or bridging (waiting for
recovery) while the effective operating mode is failed and the network interface is currently disconnected from the network but a failover may soon occur, beginning connectivity. For more information, see
“Effective Operating Mode” on page 165
and
“Virtual IP Address” on page 174 .
Access
Status
The administrative access and webmail access services that are enabled on the network interface, such as HTTPS for the web-based manager.
Indicates the “up” (available) or “down” (unavailable) administrative status for the network interface.
• Green up arrow: The network interface is up and can accept or receive traffic.
• Red down arrow: The network interface is down and cannot or receive accept traffic.
To change the administrative status (that is, bring up or down a network interface), see
“Editing network interfaces” on page 123 .
About the management IP
When a FortiMail unit is operating in transparent mode, one or more of its network interfaces may be configured to act as a Layer 2 bridge, without IP addresses of their own.
However, for administrators to be able to configure the FortiMail unit through a network connection rather than a local console, the FortiMail unit must have an IP address. The management IP address enables administrators to connect to the FortiMail unit through
port1 or other network ports, even when they are currently bridging.
By default, the management IP address is indirectly bound to port1, through the bridge. If other network interfaces are also included in the bridge with port1, the FortiMail unit can be configured to respond to connections to the management IP address that arrive on those other network interfaces. For more information, see
“Do not associate with management IP” on page 126
.
Unless you have configured an override server IP address, FortiMail units will use this IP address for connections with the FortiGuard Distribution Network (FDN). Depending on your network topology, the management IP may be a private network address, and therefore not routable from the FDN, making it unsuitable for use as the destination IP address of push update connections from the FDN. In this case, for push updates to function correctly, you must configure an override server. For more information, see
“Configuring push updates” on page 117
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
The web-based manager, FortiMail webmail, and the per-recipient quarantines can be
accessed remotely using the management IP address. For details, see “URL for access” on page 35 .
Editing network interfaces
You can edit a network interface to change its IP address, netmask, administrative access protocols, and other settings.
Caution: Enable administrative access only on network interfaces connected to trusted private networks or directly to your management computer. If possible, enable only secure administrative access protocols such as HTTPS or SSH. Failure to restrict administrative access could compromise the security of your FortiMail unit.
If your FortiMail unit is operating in transparent mode, depending on your network topology, you may or may not need to configure the network interfaces of the FortiMail unit.
• If all email servers protected by the FortiMail unit are located on the same subnet, no network interface configuration is necessary. Bridging is the default configuration for network interfaces when the FortiMail unit is operating in transparent mode, and the
FortiMail unit will bridge all connections occurring through it from the network to the protected email servers.
• If email servers protected by the FortiMail unit are located on different subnets, you must connect those email servers through separate physical ports on the FortiMail unit, and configure the network interfaces associated with those ports, assigning IP addresses and removing them from the bridge.
It is possible to configure a mixture of bridging and non-bridging network interfaces. For example, if some email servers belong to the same subnet, network interfaces for those email servers may remain in the bridge group; email servers belonging to other subnets may be attached to network interfaces that are not associated with the bridge.
Note: You can restrict which IP addresses are permitted to log in as a FortiMail administrator through network interfaces. For details, see
“Configuring administrator accounts” on page 147
.
To edit a network interface
1 Go to System > Network > Interface.
2 Double-click the row corresponding to the network interface that you want to modify, or click to select the interface and then click Edit.
The Edit Interface page appears. Appearance varies by:
• the operational mode of the FortiMail unit (gateway, transparent, or server)
• if the FortiMail unit is operating in transparent mode, by whether the network interface is port1, which is required to be configured as a Layer 2 bridge and associated with the management IP, and therefore cannot be configured with its own IP and Netmask
3 For gateway mode or server mode, configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
123
Configuring network settings
Figure 60: Editing a network interface (gateway mode and server mode)
System
Interface Name The name (such as port2) and media access control (MAC) address for this network interface.
Addressing mode
Manual
IP/Netmask
Select to enter a static IP address, then enter the IP address and
netmask for the network interface in IP/Netmask.
Enter the IP address and netmask for the network interface.
If the FortiMail unit is operating in gateway mode or server mode,
this option is available only if Manual is selected.
DHCP Select to retrieve a dynamic IP address using DHCP.
This option appears only if the FortiMail unit is operating in gateway mode or server mode.
Retrieve default gateway and DNS from server
Enable to retrieve both the default gateway and DNS addresses from the DHCP server, replacing any manually configured values.
Connect to server Enable for the FortiMail unit to attempt to obtain DNS addressing information from the DHCP server.
Disable this option if you are configuring the network interface offline, and do not want the unit to attempt to obtain addressing information at this time.
124
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Access Enable protocols that this network interface should accept for connections to the FortiMail unit itself. (These options do not affect connections that will travel through the FortiMail unit.)
• HTTPS: Enable to allow secure HTTPS connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
• HTTP: Enable to allow HTTP connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
For information on redirecting HTTP requests for webmail and
Caution: HTTP connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit. For information on further restricting access of administrative connections, see
“Configuring administrator accounts” on page 147 .
• PING: Enable to allow ICMP ECHO (ping) responses from this network interface.
For information on configuring the network interface from which the FortiMail unit itself will send pings, see the FortiMail CLI
Reference .
• SSH: Enable to allow SSH connections to the CLI through this network interface.
• SNMP: Enable to allow SNMP connections (queries) to this network interface.
For information on further restricting access, or on configuring the network interface that will be the source of traps, see
“Configuring SNMP queries & traps” on page 135
.
• TELNET: Enable to allow Telnet connections to the CLI through this network interface.
Caution: Telnet connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit.
MTU
Override default MTU value (1500).
Enable to change the maximum transmission unit (MTU) value, then enter the maximum packet or Ethernet frame size in bytes.
If network devices between the FortiMail unit and its traffic destinations require smaller or larger units of traffic, packets may require additional processing at each node in the network to fragment or defragment the units, resulting in reduced network performance. Adjusting the MTU to match your network can improve network performance.
The default value is 1500 bytes. The MTU size must be between
576 and 1500 bytes.
Administrative status Select either:
• Up: Enable (that is, bring up) the network interface so that it can send and receive traffic.
• Down: Disable (that is, bring down) the network interface so that it cannot send or receive traffic.
If the FortiMail unit is operating in transparent mode, configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
125
Configuring network settings
Figure 61: Editing a network interface (transparent mode, non-bridging)
System
Figure 62: Editing a network interface (transparent mode, port1)
Interface Name
Addressing mode
Do not associate with management IP
Enable to configure an IP address and netmask for this network interface, separate from the management IP, then configure
This option appears only if the network interface is not port1, which is required to be a member of the bridge.
IP/Netmask
The name (such as port2) and media access control (MAC) address for this network interface.
Enter the IP address and netmask for the network interface.
If the FortiMail unit is operating in transparent mode, this option is
available only if Do not associate with management IP is enabled.
126
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Access Enable protocols that this network interface should accept for connections to the FortiMail unit itself. (These options do not affect connections that will travel through the FortiMail unit.)
• HTTPS: Enable to allow secure HTTPS connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
• HTTP: Enable to allow HTTP connections to the web-based manager, webmail, and per-recipient quarantine through this network interface.
For information on redirecting HTTP requests for webmail and
Caution: HTTP connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit. For information on further restricting access of administrative connections, see
“Configuring administrator accounts” on page 147 .
• PING: Enable to allow ICMP ECHO (ping) responses from this network interface.
For information on configuring the network interface from which the FortiMail unit itself will send pings, see the FortiMail CLI
Reference .
• SSH: Enable to allow SSH connections to the CLI through this network interface.
• SNMP: Enable to allow SNMP connections (queries) to this network interface.
For information on further restricting access, or on configuring the network interface that will be the source of traps, see
“Configuring SNMP queries & traps” on page 135
.
• TELNET: Enable to allow Telnet connections to the CLI through this network interface.
Caution: Telnet connections are not secure, and can be intercepted by a third party. If possible, enable this option only for network interfaces connected to a trusted private network, or directly to your management computer. Failure to restrict administrative access through this protocol could compromise the security of your FortiMail unit.
MTU
Override default MTU value (1500).
Enable to change the maximum transmission unit (MTU) value, then enter the maximum packet or Ethernet frame size in bytes.
If network devices between the FortiMail unit and its traffic destinations require smaller or larger units of traffic, packets may require additional processing at each node in the network to fragment or defragment the units, resulting in reduced network performance. Adjusting the MTU to match your network can improve network performance.
The default value is 1500 bytes. The MTU size must be between
576 and 1500 bytes.
Administrative status Select either:
• Up: Enable (that is, bring up) the network interface so that it can send and receive traffic.
• Down: Disable (that is, bring down) the network interface so that it cannot send or receive traffic.
4 Click OK.
To configure a non-bridging network interface
1 Go to System > Network > Interface.
2 Double-click the row corresponding to the network interface that you want to remove from the bridge, or click to select the interface and then click Edit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
127
Configuring network settings
Note: port1 is required to be a member of the bridge, and cannot be removed from it.
Figure 63: Editing a network interface (transparent mode, non-bridging)
System
128
3 Enable Do not associate with management IP.
This option appears only if the FortiMail unit is operating in transparent mode and if the network interface is not port1, which is required to be a member of the bridge.
4 In IP/Netmask, enter the IP address and netmask of the network interface.
5 Click OK.
Repeat this procedure for each network interface that is connected to an email server on a distinct subnet. When complete, configure static routes for those email servers.
For details, see
“Configuring static routes” on page 128 .
Configuring static routes
The Routing tab displays a list of routes and enables you to configure static routes and gateways used by the FortiMail unit.
Static routes direct traffic exiting the FortiMail unit — you can specify through which network interface a packet will leave, and the IP address of a next-hop router that is reachable from that network interface. The router is aware of which IP addresses are reachable through various network pathways, and can forward those packets along pathways capable of reaching the packets’ ultimate destinations.
A default route is a special type of static route. A default route matches all packets, and defines a gateway router that can receive and route packets if no other, more specific static route is defined for the packet’s destination IP address.
You should configure at least one static route, a default route, that points to your gateway.
However, you may configure multiple static routes if you have multiple gateway routers, each of which should receive packets destined for a different subset of IP addresses.
For example, if an SMTP server is directly attached to one of the network interfaces, but all other destinations, such as connecting clients, are located on distant networks such as the Internet, you might need to add only one route: a default route for the gateway router through which the FortiMail unit connects to the Internet.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
To determine which route a packet will be subject to, the FortiMail unit examines the packet’s destination IP address and compares it to those of the static routes. If more than one route matches the packet, the FortiMail unit will apply the route with the smallest index number. For this reason, you should give more specific routes a smaller index number than the default route.
When you add a static route through the web-based manager, the FortiMail unit evaluates the route to determine if it represents a different route compared to any other route already present in the list of static routes. If no route having the same destination exists in the list of static routes, the FortiMail unit adds the static route, using the next unassigned route index number.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of static routes, go to System > Network > Routing.
Figure 64: Viewing the list of static routes
Destination IP/Netmask The destination IP address and subnet of packets subject to the static route.
0.0.0.0/0.0.0 indicates that the route matches all destination IP addresses.
Gateway The IP address of the next-hop router to which packets subject to the static route will be forwarded.
To configure a static route
1 Go to System > Network > Routing.
2 Either click New to add a route, or double-click to select a route that you want to modify.
3 Configure the following:
Figure 65: Configuring a static route
Destination
IP/netmask
Gateway
Enter the destination IP address and netmask of packets that will be subject to this static route.
To create a default route that will match all packets, enter 0.0.0.0/0.0.0.0.
Type the IP address of the next-hop router to which the FortiMail unit will forward packets subject to this static route. This router must know how to route packets to the destination IP addresses that you have specified in Destination
IP/netmask. For an Internet connection, the next hop routing gateway routes traffic to the Internet.
4 Click Create or OK.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
129
Configuring network settings System
Configuring DNS
The DNS tab enables you to configure the DNS servers that the FortiMail unit will query to resolve domain names into IP addresses.
FortiMail units require DNS servers for features such as reverse DNS lookups, FortiGuard connectivity, and other aspects of email processing. Your ISP may supply IP addresses of
DNS servers, or you may want to use the IP addresses of your own DNS servers.
Caution: If the FortiMail unit is operating in gateway mode, you must configure the MX record of the DNS server for each protected domain to direct all email to this FortiMail unit instead of the protected SMTP servers. Failure to update the records of your DNS server may enable email to circumvent the FortiMail unit.
Note: For improved FortiMail unit performance, use DNS servers on your local network.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the primary and secondary DNS servers, go to Settings > Network > DNS.
Figure 66: Configuring DNS
130
Primary DNS server Enter the IP address of the primary DNS server.
Secondary DNS server Enter the IP address of the secondary DNS server.
Configuring dynamic DNS
The DDNS tab enables you to configure the FortiMail unit to use a dynamic DNS (DDNS) service.
If the FortiMail unit has a static domain name but a dynamic public IP address, you can use DDNS to update DNS servers on the Internet when the public IP address for its fully qualified domain name (FQDN) changes.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of dynamic DNS accounts, go to System > Network > DDNS.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring network settings
Figure 67: Viewing the list of dynamic DNS accounts
Server
Username
Host/Domain Name
Update Time
The name of your DDNS service provider.
Your user name for the DDNS service provider.
A public host name or fully qualified domain name (FQDN) that should resolve to the public IP address of the FortiMail unit.
Its public DNS records are updated by the DDNS service provider when the FortiMail unit sends its current public IP address. As such, it might not be the same as the host name and local domain name that you have
configured in “Host name” on page 202 and “Local domain name” on page 202
, which could be valid only for your internal network.
The interval in hours between each time that the FortiMail unit contacts the DDNS service provider.
To configure DDNS
1 Go to System > Network > DDNS.
2 If you have not yet configured the dynamic DNS account that the FortiMail unit will use when it connects to the DDNS service provider, click New, configure the following for your dynamic DNS account, then click Create:
Figure 68: Adding a dynamic DNS account
Server
User name
Password
Update time
Select a DDNS service provider to which the FortiMail unit will send DDNS updates.
Enter the user name of your account with the DDNS service provider. The FortiMail unit will provide this to authenticate itself with the service when sending updates.
Enter the password for the DDNS user name.
Enter the interval in hours between each time that the FortiMail unit will query the DDNS service provider’s IP detection page if
is Auto detect.
Caution: Do not exceed the recommended frequency published by your DDNS service provider. Some DDNS service providers consider excessive connections to be abusive, and may ignore further queries from the FortiMail unit.
The tab returns to the list of dynamic DNS accounts, which should now include your new account.
3 Double-click the row corresponding to the DDNS account.
The Host/Domain Name Setting area is now visible.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
131
Configuring network settings
Figure 69: Editing a dynamic DNS account
System
4 In the Host/Domain Name Setting area, click Create New, or, to modify an existing host/domain name, click its row to select it, then click Edit.
5 Configure the following:
Figure 70: Configuring a dynamic DNS domain name
Server
Status
The dynamic DNS service provider of this account.
Enable to update the DDNS service provider when the FortiMail unit’s public
IP address changes.
Disable to notify the DDNS service provider that this FQDN should use its offline redirect, if you have configured any. If the FortiMail unit’s public IP address changes, it will not notify the DDNS service provider.
132
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Host name
IP mode
Enter the fully qualified domain name (FQDN) whose records the DDNS provider should update.
Select which of the following ways the FortiMail unit should use to determine its current publicly routable IP address.
• Auto detect: Periodically query the DDNS service provider’s IP address detection web page to see if the FortiMail unit’s public IP address has changed. The IP detection web page returns the apparent source IP address of the query. If this IP address has changed, the FortiMail unit then sends an update request to the DDNS service provider, causing it to
update DNS records for the FQDN in “Host name” on page 133 .
This option is the most common choice. To configure the interval of DDNS
IP detection queries, see “Update time” on page 131 .
Note: If this query occurs through a NAT device such as a router or firewall, its apparent source IP address will not be the private network IP address of any of the FortiMail unit’s network interfaces. Instead, it will be be the IP address of the NAT device’s externally facing network interface.
For example, a public virtual IP (VIP) on a FortiGate unit in NAT mode might be used to route email from the Internet to a FortiMail unit. DDNS updates are also routed out from the VIP to the DDNS service provider on the Internet. From the DDNS service provider’s perspective, the DDNS update connection appears to come from the VIP, and therefore it updates the DNS records with the IP address of the VIP. The DDNS service provider does not know the private network address of the FortiMail unit.
• Bind interface: Use the current IP address of one of the FortiMail unit’s network interfaces. Choose this option only if the network interface has an
IP address that is routable from the Internet — that is, it is not an
RFC 1918 private network address.
• Static IP: Use an IP address that you configure. You must manually update the accompanying field if the FortiMail unit’s public IP address changes.
6 Click Create.
7 Click OK.
To verify your DDNS configuration and connectivity, do not query DNS servers — depending on DNS caching, record propagation, and other effects, DNS queries may not be able to determine whether the update actually reached your DDNS service provider.
Instead, log in to your DDNS service provider account and verify whether its host records have been updated. You can also view the FortiMail event log. Log messages such as this indicate DDNS update failure:
DDNS daemon failed on update members.dyndns.org , domain fortimail.example.com, next try at 1251752285\n
Configuring the time, GUI, & SNMP
The Configuration submenu enables you to configure an assortment of system-wide settings such as the system time, administrator accounts, the idle timeout of the webbased manager, and SNMP access.
This topic includes:
•
•
Configuring the idle timeout & LCD panel options
•
Configuring SNMP queries & traps
•
Configuring the time & date
The Time tab enables you to configure the system time and date of the FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
133
Configuring the time, GUI, & SNMP System
You can either manually set the FortiMail system time or configure the FortiMail unit to automatically keep its system time correct by synchronizing with Network Time Protocol
(NTP) servers.
Note: For many features to work, including scheduling, logging, and certificate-dependent features, the FortiMail system time must be accurate.
Note: FortiMail units support daylight savings time (DST), including recent changes in the
USA, Canada and Western Australia.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the system time, go to System > Configuration > Time.
Figure 71: Configuring the date and time
134
System Time
Refresh
The date and time according to the FortiMail unit’s clock at the time that this tab was loaded, or when you last selected the
Refresh button.
Select to update the System Time field with the current time according to the FortiMail unit’s clock.
Time Zone Select the time zone in which the FortiMail unit is located.
Automatically adjust clock for daylight saving changes
Enable to adjust the FortiMail system clock automatically when your time zone changes to daylight savings time (DST) and back to standard time.
Set date Select this option to manually set the date and time of the
FortiMail unit’s clock, then select the Hour, Minute, Second, Year,
Month and Day fields before you click Apply.
Alternatively, configure Synchronize with NTP server.
Synchronize with NTP Server Select to use a network time protocol (NTP) server to automatically set the system date and time, then configure Server and Syn Interval.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Server
Syn Interval
Enter the IP address or domain name of an NTP server.
You can add a maximum of 10 NTP servers. The FortiMail unit uses the first NTP server based on the selection mechanism of the NTP protocol.
Click the plus sign to add more servers.
Click the minus sign to remove servers. Note that you cannot remove the last server.
To find the NTP servers that you can use, see http://www.ntp.org
.
Enter how often in minutes the FortiMail unit should synchronize its time with the NTP server. For example, entering 1440 causes the FortiMail unit to synchronize its time once a day.
Configuring the idle timeout & LCD panel options
The Options tab enables you to set the idle timeout of the web-based manager, and to restrict access to the control buttons and LCD by requiring a PIN (personal identification number).
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the web-based manager and LCD panel options, go to System > Configuration >
Options.
Figure 72: Configuring global options for the web-based manager and LCD panel
Idle Timeout Enter the amount of time that an administrator may be inactive before the FortiMail unit automatically logs out the administrator.
Note: For better security, use a low idle timeout value.
LCD Panel
PIN Protection Enable to require administrators to first enter the PIN before using the LCD display panel and control buttons on the FortiMail unit, then enter the 6-digit PIN number.
This option appears only on FortiMail models whose hardware includes an LCD panel.
Caution: For better security, always configure an LCD PIN. Failure to configure a PIN allows anyone with physical access to reconfigure the FortiMail unit.
Configuring SNMP queries & traps
The SNMP v1/v2c tab enables you to configure SNMP to monitor FortiMail system events and thresholds, or a high availability (HA) cluster for failover messages.
You can also use SNMP to monitor some FortiMail-2000A and FortiMail-4000 models which have monitored power supplies and RAID controllers. When a monitored power supply or a RAID controller is removed or added, the FortiMail unit will send configured notification for those events by log messages, alert email messages, and/or SNMP traps.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
135
Configuring the time, GUI, & SNMP System
Before you can use its SNMP queries, you must enable SNMP access on the network interfaces that SNMP managers will use to access the FortiMail unit. For more information, see
“Editing network interfaces” on page 123 .
For information on HA-specific MIB and trap MIB fields, see
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure the SNMP agent of the FortiMail unit, go to System > Configuration >
SNMP v1/v2c.
Note: You can download the SNMP MIB file from the Fortinet Technical Support web site, https://support.fortinet.com/ .
Figure 73: Enabling the SNMP agent
136
SNMP agent enable Enable to activate the FortiMail SNMP agent. This must be enabled to accept queries or send traps from the FortiMail unit.
Description
Location
Enter a descriptive name for the FortiMail unit.
Enter the location of the FortiMail unit.
Enter administrator contact information.
Contact
SNMP Threshold
Trap Type
Trigger
The type of trap, such as CPU Usage.
Either the percent of the resource in use or the number of times the trigger level must be reached before it is triggered.
For example, using the default value, if the mailbox disk is 90% or more full, it will trigger.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Threshold The number of triggers that will result in an SNMP trap.
For example if the CPU level exceeds the set trigger percentage once before returning to a lower level, and the threshold is set to more than one an SNMP trap will not be generated until that minimum number of triggers occurs during the sample period.
Sample Period(s) The time period in seconds during which the FortiMail unit SNMP Agent counts the number of triggers that occurred.
The default period is 600 seconds (ten minutes).
This value should not be less than the Sample Freq(s).
Sample Freq(s) The interval in seconds between measurements of the trap condition. You will not receive traps faster than this rate, depending on the selected sample period.
The default sample frequency is 30 seconds.
This value should be less than the Sample Period(s).
Communities The list of SNMP communities added to the FortiMail configuration.
Name
Status
Queries
Traps
The name of the SNMP community. The SNMP Manager client must be configured with this name.
A green check mark icon indicates that the community is enabled.
A green check mark icon indicates that queries are enabled.
A green check mark icon indicates that traps are enabled.
Configuring an SNMP community
An SNMP community is a grouping of equipment for SNMP-based network administration purposes. You can add up to three SNMP communities so that SNMP managers can connect to the FortiMail unit to view system information and receive SNMP traps. You can configure each community differently for SNMP traps and to monitor different events. You can add the IP addresses of up to eight SNMP managers to each community.
To configure an SNMP community
1 Go to System > Configuration > SNMP v1/v2c.
2 Click New to add a community, or click to select a community that you want to modify, then click Edit.
3 Configure the following:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
137
Configuring the time, GUI, & SNMP
Figure 74: Configuring an SNMP Community
System
138
Name
Status
Hosts
IP Address
Interface
Delete
Create
Enter a name to identify the SNMP community. If you are editing an existing community, you cannot change the name.
Enable to, if they are enabled, send traps to and allow queries from the community’s SNMP managers.
The list of SNMP managers that can use the settings in this SNMP community to monitor the FortiMail unit. Click Create to create a new entry.
Enter the IP address of an SNMP manager. By default, the IP address is
0.0.0.0, so that any SNMP manager can use this SNMP community.
Select the name of the network interface that connects to the network where this SNMP manager is located. You need to do this if the SNMP manager is on the Internet or behind a router.
Click to remove this SNMP manager.
Click to add a new default entry to the Hosts list that you can edit as needed.
You can have up to eight SNMP manager entries for a single community.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Queries
Traps
SNMP Event
Enter the Port number (161 by default) that the SNMP managers in this community use for SNMP v1 and SNMP v2c queries to receive configuration information from the FortiMail unit. Mark the Enable check box to activate queries for each SNMP version.
Enter the Local Port and Remote Port numbers (162 local, 162 remote by default) that the FortiMail unit uses to send SNMP v1 and SNMP v2c traps to the SNMP managers in this community. Enable traps for each SNMP version that the SNMP managers use.
Enable each SNMP event for which the FortiMail unit should send traps to the
SNMP managers in this community.
FortiMail MIBs
The FortiMail SNMP agent supports Fortinet proprietary MIBs as well as standard RFC
1213 and RFC 2665 MIBs. RFC support includes support for the parts of RFC 2665
(Ethernet-like MIB) and the parts of RFC 1213 (MIB II) that apply to FortiMail unit configuration.
The FortiGate MIBs are listed in Table 8 . You can obtain these MIB files from Fortinet technical support. To be able to communicate with the SNMP agent, you must compile all of these MIBs into your SNMP manager.
Your SNMP manager may already include standard and private MIBs in a compiled database that is ready to use. You must add the Fortinet proprietary MIB to this database.
If the standard MIBs used by the Fortinet SNMP agent are already compiled into your
SNMP manager you do not have to compile them again.
Table 8: FortMail MIBs
MIB file name fortimail.mib
fortimail.trap.mib
Description
The proprietary Fortinet MIB includes detailed FortiMail system configuration information. Your SNMP manager requires this information to monitor FortiMail configuration settings. For more information, see
.
The proprietary Fortinet trap MIB includes FortiMail trap information.
Your SNMP manager requires this information to receive traps from the
FortiMail SNMP agent. For more information, see
.
FortiMail traps
The FortiMail unit’s SNMP agent can send traps to SNMP managers that you have added to SNMP communities. To receive traps, you must load and compile the FortMail trap MIB into the SNMP manager.
All traps sent include the trap message as well as the FortiMail unit serial number and host name.
Table 9: FortiMail traps
Trap fmlTrapCpuHighThreshold fmlTrapMemLowThreshold fmlTrapLogDiskHighThreshold
Description
Trap sent if CPU usage becomes too high.
Trap sent if memory usage becomes too high.
Trap sent if Log disk usage becomes too high.
fmlTrapMailDiskHighThreshold fmlTrapAvThresholdEvent
Trap sent if Mailbox disk usage becomes too high.
fmlTrapMailDeferredQueueHighThreshold Trap sent if the number of deferred email messages becomes too great.
Trap sent when the number of detected viruses reaches the threshold.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
139
Configuring the time, GUI, & SNMP
140
System
Table 9: FortiMail traps
Trap fmlTrapSpamThresholdEvent fmlTrapSystemEvent fmlTrapRAIDEvent fmlTrapHAEvent fmlTrapArchiveEvent fmlTrapIpChange
Description
Trap sent when the number of spam email messages reaches the threshold.
Trap sent when system shuts down, reboots, upgrades, etc.
Trap sent for RAID operations.
Trap sent when an HA event occurs.
Trap sent when remote archive event occurs.
Trap sent when the IP address of the specified interface has been changed.
MIB fields
The Fortinet MIB contains fields reporting current FortiMail unit status information. The tables below list the names of the MIB fields and describe the status information available for each one. You can view more details about the information available from all Fortinet
MIB fields by compiling the MIB file into your SNMP manager and browsing the MIB fields.
Table 10: System MIB fields
MIB field fmlSysModel fmlSysSerial fmlSysVersion
Description
FortiMail model number, such as 400 for the FortiMail-400.
FortiMail unit serial number.
The firmware version currently running on the FortiMail unit.
fmlSysVersionAv fmlSysOpMode
The antivirus definition version installed on the FortiMail unit.
The operation mode (gateway, transparent, or server) of the FortiMail unit.
The current CPU usage (%).
fmlSysCpuUsage fmlSysMemUsage The current memory utilization (%).
fmlSysLogDiskUsage The log disk usage (%).
fmlSysMailDiskUsage The mail disk usage (%).
fmlSysSesCount The current IP session count.
fmlSysEventCode fmlRAIDCode
System component events.
RAID system events.
fmlRAIDDevName fmlHAEventId fmlHAUnitIp fmlHAEventReason fmlArchiveServerIp fmlArchiveFilename
RAID device name.
HA event type ID.
Unit IP address where the event occurs.
The reason for the HA event.
IP address of the remote Archive Server.
Archive mail file name.
Table 11: System options MIB fields
MIB field Description fmlSysOptIdleTimeout Idle period after which the administrator is automatically logged out off the system.
fmlSysOptAuthTimeout Authentication idle timeout value.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Table 11: System options MIB fields
MIB field fmlSysOptsLan fmlSysOptsLcdProt
Description
Web administration language.
Whether LCD control buttons protection is enabled or disabled.
Table 12: System session MIB fields
MIB field fmlIpSessTable fmlIpSessEntry fmlIpSessIndex fmlIpSessProto fmlIpSessFromAddr fmlIpSessFromPort fmlIpSessToAddr fmlIpSessToPort fmlIpSessExp
Description
FortiMail IP sessions table.
Particular IP session information.
An index value that uniquely identifies an IP session.
The protocol of the connection.
The session source IP address,
The session source port number.
The session destination IP address.
The session destination port number.
Time (in seconds) until the session expires.
Table 13: Mail options MIB fields
MIB field fmlMailOptionsDeferQ ueue
Description
The current number of deferred email messages.
Customizing the appearance
The Appearance tab enables you to customize the default appearance of the web-based manager, per-recipient quarantine, and webmail pages with your own product name, product logo, and corporate logo.
The webmail’s languages can be customized. If your preferred language is not currently installed, you can add it. You can also adjust the terms in existing language files. This can be useful for localizing terms within a language. For example, you could adjust the English language file to use spellings and terms specific to the locale of the United Kingdom,
Australia, or the United States of America if your email users are most familiar with terminologies popular in those areas.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To customize the appearance of the web-based manager and webmail pages, go to
System > Configuration > Appearance.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
141
Configuring the time, GUI, & SNMP System
Figure 75: Customizing the appearance of the FortiMail web-based manager and webmail
142
Administration Interface
Product name
Top logo
Default language
Enter the name of the product. This name will precede
Administrator Login in the title on the login page of the webbased manager.
Select change to upload a graphic that will appear at the top of all pages in the web-based manager. The image’s dimensions must be 460 pixels wide by 36 pixels tall.
For best results, use an image with a transparent background. Non-transparent backgrounds will not blend with the underlying theme graphic, resulting in a visible rectangle around your logo graphic.
Note: Uploading a graphic overwrites the current graphic.
The FortiMail unit does not retain previous or default graphics. If you want to be able to revert to the current graphic, use your web browser to save a backup copy of the image to your management computer, enabling you to upload it again at a later time.
Select the default language for the display of the web-based manager.
You can configure a separate language preference for each administrator account. For details, see
“Configuring administrator accounts” on page 147
.
Webmail interface
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring the time, GUI, & SNMP
Webmail language
Webmail language customization
Web mail top logo
Select the language in which webmail pages will be displayed. By default, the FortiMail unit will use the same language as the web-based manager. For web-based
manager language settings, see “Configuring the idle timeout & LCD panel options” on page 135
.
The list of languages installed on the FortiMail unit in
English and in their own language.
• Create: Click to add a new language to the list. See “To add a custom webmail language” on page 143 .
• Download Webmail Language: Select a language in the list, then click this button to download the language’s resource file for that language. You can then edit the resource files using an XML editor that supports UTF-8.
See “To add a custom webmail language” on page 143 .
• Upload: Select a language in the list, then click this button to update the language’s resource file for this language from your management computer to the
FortiMail unit. In addition to uploading new language resource files, you can also use this button to update existing languages.
• Delete: Select a language in the list, then click this button to remove the language. This option is available only for non-default languages.
Click Change to upload a graphic that will appear at the top of all webmail pages. The image’s dimensions must be 314 pixels wide by 36 pixels tall.
Note: Uploading a graphic overwrites the current graphic.
The FortiMail unit does not retain previous or default graphics. If you want to be able to revert to the current graphic, use your web browser to save a backup copy of the image to your management computer, enabling you to upload it again at a later time.
To add a custom webmail language
1 Go to System > Configuration > Appearance.
2 Click the arrow to expand Webmail interface.
3 Underneath the list of language customizations, in Language name in English, enter the name for the language using English and US-ASCII encoding, such as Welsh.
4 In Language name, enter the name for the language using its own characters and
UTF-8 encoding.
5 Click Create.
The new language appears at the bottom of the webmail languages list.
6 Click the new language’s row to select it.
7 Click Download and select Download login page resource file.
8 Click Download again and select Download webmail resource file.
Your web browser downloads both files.
9 Open both files in an XML editor or plain text editor that supports UTF-8 encoding.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
143
Configuring administrator accounts & access profiles System
10 For each value in the resource files, translate the word or phrase that is surrounded by double quotes ( " ). It will appear in the location indicated by the key’s name.
For example:
<resource key="report_spam" value="Report Spam"/> indicates by key="report_spam" that the text is a label for the button that corrects the Bayesian scanner when it has not recognized an email that is spam. You could replace the contents of value (that is, Report Spam) with any text in your language that indicates the button’s function.
11 Save both files. Return to the web-based manager.
12 Click the new language’s row to select it.
13 Click Upload and select Upload login page resource file. Choose the login page resource file that you translated, then click OK.
14 Click Upload again and select Upload webmail resource file. Choose the login page resource file that you translated, then click OK.
15 Click Apply.
To verify your language, log in to FortiMail webmail and review the text that appears on each button, field, and menu item. If the characters appear garbled, verify that your web browser is interpreting the web page using the correct encoding.
Configuring administrator accounts & access profiles
The Administrator menu configures administrator accounts and access profiles.
This topic includes:
•
About administrator account permissions & domains
•
Configuring administrator accounts
•
About administrator account permissions & domains
Depending on the account that you use to log in to the FortiMail unit, you may not have complete access to all CLI commands or areas of the web-based manager.
Access profiles and domain assignments together control which commands and areas an administrator account can access. Permissions result from an interaction of the two.
The domain to which an administrator is assigned can be either:
• System: Can access areas regardless of whether an item pertains to the FortiMail unit itself or to a protected domain. The administrator’s permissions are restricted only by his or her access profile.
• a protected domain: Can only access areas that are specifically assigned to that protected domain. The administrator cannot access system-wide settings, files or statistics, nor most settings that can affect other protected domains, regardless of whether access to those items would otherwise be allowed by his or her access profile.
The administrator cannot access the CLI, nor the basic mode of the web-based
.)
144
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Note: IP-based policies, the global black list, and the global white list, the blacklist action, and the global Bayesian database are exceptions to this rule. Domain administrators can configure them, regardless of the fact that they could affect other domains. If you do not want to allow this, do not provide Read-Write permission to those categories in domain administrators’ access profiles.
Table 14: Areas of the GUI (advanced mode) that cannot be accessed by domain administrators
Maintenance
Monitor except for the Personal quarantine tab
System except for the Administrator tab
Mail Settings except for the domain, its subdomains, and associated domains
User > User > PKI User
Policy > Access Control > Receive
Policy > Access Control > Delivery
Profile > Authentication
AntiSpam except for AntiSpam > Bayesian > User and AntiSpam > Black/White List
Email Archiving
Log and Report
Access profiles assign either read, write, or no access to each area of the FortiMail software. To view configurations, you must have read access. To make changes, you must have write access. For more information on configuring an access profile that administrator accounts can use, see
“Configuring access profiles” on page 149
.
Table 15: Areas of control in access profiles
Access control area name
In the web-based manager
In the CLI
Grants access to
(For each config command, there is an equivalent get/show command, unless otherwise noted.
config access requires write permission. get/show access requires read permission.)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
145
Configuring administrator accounts & access profiles
146
System
Table 15: Areas of control in access profiles
Policy
Black/White List
Quarantine
Others policy Monitor > Mail Queue ...
Monitor > Greylist ...
Monitor > Sender Reputation > Display
Mail Settings > Domains > Domains
Mail Settings > Proxies > Proxies
User > User ...
Policy ...
Profile ...
AntiSpam > Greylist ...
AntiSpam > Bounce Verification > Settings
AntiSpam > Endpoint Reputation ...
AntiSpam > Bayesian ... blackwhite-list config antispam greylist exempt config antispam bounce-verification key config antispam settings config domain config mailsetting proxy-smtp config policy ...
config profile ...
config user ...
Monitor > Endpoint Reputation > Auto Blacklist
Maintenance > AntiSpam >
Black/White List Maintenance
AntiSpam > Black/White List ...
N/A quarantine Monitor > Quarantine ...
AntiSpam > Quarantine > Quarantine Report
AntiSpam > Quarantine > System Quarantine Setting
AntiSpam > Quarantine > Control Account others config antispam quarantine-report config mailsetting systemquarantine
Monitor > System Status ...
Monitor > Archive > Email Archives
Monitor > Log ...
Monitor > Report ...
Maintenance ... except the
Black/White List Maintenance tab
System ...
Mail Settings > Settings ...
Mail Settings > Address Book > Address Book
User > User Alias > User Alias
User > Address Map > Address Map
Email Archiving ...
Log and Report ... config archive ...
config log ...
config mailsetting relayserver config mailsetting storage config report config system ...
config user alias config user map diagnose ...
execute ...
get system status
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Unlike other administrator accounts whose Access profile is super_admin_prof and
Domain is System, the admin administrator account exists by default and cannot be deleted. The admin administrator account is similar to a root administrator account. This administrator account always has full permission to view and change all FortiMail configuration options, including viewing and changing all other administrator accounts. It is the only administrator account that can reset another administrator’s password without being required to enter the existing password. As such, it is the only account that can reset another administrator’s password if that administrator forgets his or her password. Its name, permissions, and assignment to the System domain cannot be changed.
Caution: Set a strong password for the admin administrator account, and change the password regularly. By default, this administrator account has no password. Failure to maintain the password of the admin administrator account could compromise the security of your FortiMail unit.
Configuring administrator accounts
The Administrator tab displays a list of the FortiMail unit’s administrator accounts, and displays the IP addresses from which administrator logins can be attempted (trusted hosts).
By default, FortiMail units have a single administrator account, admin. For more granular control over administrative access, you can create additional administrator accounts that are restricted to being able to configure a specific protected domain and/or with restricted permissions. For more information, see
“About administrator account permissions & domains” on page 144 .
Depending on the permission and assigned domain of your account, this list may not display all other administrator accounts. For more information, see
“About administrator account permissions & domains” on page 144 .
Note: If you have configured a system quarantine administrator account, this account does
not appear in the list of standard FortiMail administrator accounts. For more information on the system quarantine administrator account, see
“Configuring the system quarantine administrator account & disk quota” on page 387 .
To be able to access this part of the web-based manager, your administrator account’s access profile must have Read or Read-Write permission to the Others category.
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of administrator accounts, go to System > Administrator > Administrator.
Figure 76: Viewing the list of administrator accounts
Name
Domain
The name of the administrator account.
The entire FortiMail unit (if blank) or name of a protected domain to which an administrator account is assigned.
For more information on protected domain assignments, see
“About administrator account permissions & domains” on page 144 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
147
Configuring administrator accounts & access profiles System
Auth Type The local or remote type of authentication that the administrator can use:
• Local
• RADIUS
• RADIUS + Local
• PKI
For details on each authentications type, see
“Configuring authentication profiles” on page 330
and “Configuring PKI authentication” on page 248 .
Trusted Hosts The IP address and netmask from which the administrator can log in.
Access Profile The access profile that determines the permissions of the administrator account.
For details, see “Configuring access profiles” on page 149 .
To configure an administrator account
1 Go to System > Administrator > Administrator.
2 Either click New to add an account, or click to select an account that you want to modify, then click Edit.
3 Configure the following:
Figure 77: Configuring an administrator account
148
Administrator Enter the name for this administrator account.
Domain Select the entire FortiMail unit (System) or name of a protected domain such as example.com to which this administrator account will be assigned.
For more information on protected domain assignments, see
“About administrator account permissions & domains” on page 144 .
Note: If Domain is a protected domain, the administrator will not be able to use the CLI, nor the basic mode of the web-based manager.
Password
Confirm password
Enter this account’s password.
The password can contain any character except spaces.
This field does not appears if Auth type is not Local or RADIUS+Local.
Caution: Do not enter a FortiMail administrator password less than six characters long. For better security, enter a longer password with a complex combination of characters and numbers, and change the password regularly.
Failure to provide a strong password could compromise the security of your
FortiMail unit.
Enter this account’s password again to confirm it.
This field does not appears if Auth type is not Local or RADIUS+Local.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring administrator accounts & access profiles
Trusted Host #1 Enter an IP address or subnet from which this administrator can log in.
If you want the administrator to be able to access the FortiMail unit from any IP address, type 0.0.0.0/0.0.0.0.
Enter the IP address and netmask in dotted decimal format. For example, you might permit the administrator to log in to the FortiMail unit from your private network by typing 192.168.1.0/255.255.255.0.
Note: For additional security, restrict all trusted host entries to administrative hosts on your trusted private network. For example, if your FortiMail administrators log in only from the 10.10.10.10/26 subnet, to prevent possibly fraudulent login attempts from unauthorized locations, you could configure that subnet in the Trusted Host #1, Trusted Host #2, and Trusted Host #3 fields.
Note: For information on restricting administrative access protocols that can
be used by these hosts, see “Editing network interfaces” on page 123 .
Trusted Host #2 Enter an IP address or subnet from which this administrator can log in.
Trusted Host #3 Enter an IP address or subnet from which this administrator can log in.
Permission Select the permissions of this administrator account:
• all (also known as Administrator)
• Read & Write
• Read Only
Access profile Select the name of an access profile that determines which functional areas
Management mode
Select which display mode of the web-based manager, Basic or Advanced, will initially appear when this administrator logs in.
This is only which display mode will appear when the administrator logs in.
They may switch the theme at any time during their session by clicking
Basic Mode >> or Advanced Mode >>.
For details, see “Basic mode vs. advanced mode” on page 36
.
Auth type Select the local or remote type of authentication that the administrator will be able to use:
• Local
• RADIUS
• RADIUS+Local
• PKI
Note: RADIUS and PKI authentication require that you first configure a
RADIUS authentication profile or PKI user in the advanced mode of the web-
based manager. For more information, see “Configuring authentication profiles” on page 330
and “Configuring PKI authentication” on page 248 .
Select language
Select this administrator account’s preference for the display language of the web-based manager.
Select theme Select this administrator account’s preference for the display theme.
This is only which theme will appear when the administrator logs in. They may switch the theme at any time during their session by clicking Next Theme.
4 Click Create.
Configuring access profiles
The Access Profile tab displays a list of access profiles.
Access profiles, in conjunction with the domain to which an administrator account is assigned, govern which areas of the web-based manager and CLI that an administrator can access, and whether or not they have the permissions necessary to change the configuration or otherwise modify items in each area.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
149
Configuring administrator accounts & access profiles System
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of administrator accounts, go to System > Administrator > Access Profile.
Figure 78: Viewing the list of administrator access profiles
Name
(Green dot in column heading.)
The name of the administrator access profile.
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
Note: The access profile named super_admin_prof is always used by the admin administrator account, and cannot be deleted. In this case, a grey dot indicates only that the profile is not being used by any other administrator account.
To configure an access profile
1 Go to System > Administrator > Access Profile.
2 Either click New to add an account, or double-click to select an access profile that you want to modify.
3 Configure the following:
Figure 79: Configuring an access profile
150
Profile Name
Access Control
Enter the name for this access profile.
For each area of the configuration, select the permissions that will be granted to administrator accounts associated with this access profile, either:
• None
• Read Only
• Read/Write
4 Click Create.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Configuring RAID
The RAID submenu enables you to configure a redundant array of independent disks
(RAID) for the FortiMail hard disks that are used to store logs and email.
Most FortiMail models can be configured to use RAID with their hard disks. The default
RAID level should give good results, but you can modify the configuration to suit your individual requirements for enhanced performance and/or reliability. For more information,
see “Configuring RAID for FortiMail-400 models” on page 152
or
FortiMail-2000A/B or FortiMail-4000A models” on page 154
.
You can configure the RAID levels for the local disk partitions used for storing email files or log files (in the case of FortiMail-400), depending on your requirements for performance, resiliency, and cost.
RAID events can be logged and can be reported with alert email. These events include
disk full, or disk failure notices. For more information, see “About FortiMail logging” on page 437
, and
“Configuring alert email” on page 447
.
Note: If your FortiMail model does not support RAID, the tab in the RAID menu displays the message, RAID is not available on this system.
About RAID levels
Supported RAID levels vary by FortiMail model.
FortiMail-400 models use software RAID controllers which supports RAID levels 0 or 1.
You can configure the log disk with a RAID level that is different from the email disk.
FortiMail-2000A and FortiMail-4000A models use hardware RAID controllers that require that the log disk and mail disk use the same RAID level.
The following tables describe RAID levels supported by each FortiMail model.
Table 16: RAID levels supported for FortiMail-400
RAID 0 Has striping but no redundancy of data. It offers the fastest performance but has no faulttolerance — if any hard disk fails, the whole RAID fails. So adding more disks to a RAID
0 array increases the risk of failure.
Also known as a striped array.
RAID 1 Consists of at least two drives that duplicate the storage of data. There is no striping.
Read performance is improved since either disk can be read at the same time. Write performance is the same as for single disk storage. This technique provides the best performance and the best fault-tolerance in a multi-user system. In a RAID 1 with two hard disks, one hard disk can fail and the RAID will continue to function.
You should replace any failed drive as soon as possible. Until that failed drive is replaced, the RAID is essentially running as a RAID 0.
Also known as a mirrored array.
Table 17: RAID levels supported for FortiMail-2000A and FortiMail-4000A
RAID 10
RAID 10 + hot spare(s)
(4000A model)
A combination of RAID 1 and RAID 0 (see
Table 16 ), also called RAID 1+0. Striped
and mirrored arrays are good for fault tolerance and high performance, such as for high-load databases. RAID 10 requires a minimum of four drives. Adding two additional drives to the array will add another RAID 1.
Any RAID 1 in the array can have a hard disk failure and continue to function, but if both hard disks in a RAID 1 fail then the whole RAID fails.
A RAID 10 configuration that has a backup hard disk installed that takes the place of a failed RAID hard disk. The RAID 10 + hot spares must use at least five drives, one spare in addition to the RAID 10 drives. To add another RAID 1, you would need seven drives total because at least one hot spare drive is required.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
151
Configuring RAID System
Table 17: RAID levels supported for FortiMail-2000A and FortiMail-4000A
RAID 50
RAID 50 + hot spare(s)
(4000A model)
A combination of RAID 5 with RAID 0 (see
Table 16 ). RAID 5 provides data striping
at the byte level and also stripe error correction information. This results in excellent performance and good fault tolerance.
The RAID 50 array type provides fault tolerance and high performance. It requires a minimum of six drives. To add another RAID 5 requires an additional three hard disks.
A RAID 50 configuration that has a backup hard disk installed that takes the place of a failed RAID hard disk. The RAID 50 + hot spares must use at least seven drives, one spare in addition to the RAID 50 drives.
Hot spares
FortiMail models with a hardware RAID controller, such as the FortiMail-4000A and
FortiMail-2000A, have a hot spare RAID option. This feature consists of one or more disks that are pre-installed with the other disks in the unit. The hot spare disk is idle until an active hard disk in the RAID fails. Then the RAID immediately puts the hot spare disk into service and starts to rebuild the data from the failed disk onto it. This rebuilding may take up to several hours depending on system load and amount of data stored on the RAID, but the RAID continues without interruption during the process.
The hot spare feature has one or more extra hard disks installed with the RAID. A RAID 10 configuration requires two disks per RAID 1, and can have only one hot spare disk. A
RAID 50 configuration requires three disks per RAID 5, and can have up to two hot spare disks.
Configuring RAID for FortiMail-400 models
To configure RAID, go to System > RAID > RAID System.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
Figure 80: Configuring RAID (FortiMail-400)
152
Device
Unit
The name of the RAID unit, which indicates whether it is used for log message data or for mailboxes, mail queues, and other email-related data. This is hard-coded and not configurable.
The internal mount point of the RAID unit. This is hard-coded and not configurable.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Level The RAID level that indicates whether it is configured for optimal speed, failure tolerance, or both. For more information on RAID
levels, see “About RAID levels” on page 151
.
Click to change the RAID level, either:
• RAID 0
• RAID 1
Resync Action The status of the RAID device.
• idle: The RAID is idle, with no data being written to or read from the RAID disks.
• dirty: Data is currently buffered, waiting to be written to disk.
• clean: No data is currently buffered, waiting to be written to the
RAID unit.
• errors: Errors were detected on the RAID unit.
• no-errors: No errors were detected on the RAID unit.
• dirty no-errors: Data is currently buffered, waiting to be written to the RAID unit, and there are currently no detected RAID errors.
For a FortiMail unit in active use, this is the expected setting.
• clean no-errors: No data is currently buffered, waiting to be written to the RAID unit, and there are currently no RAID errors.
For a FortiMail unit with an unmounted array that is not in active use, this is the expected setting.
Resync Status If the RAID unit is not synchronized and you have clicked Click here
to check array to cause it to rebuild itself, such as after a hard disk is replaced in the RAID unit, a progress bar indicates rebuild progress.
The progress bar appears only when Click here to check array has been clicked and the status of the RAID is not clean no-errors.
Speed Displays the average speed in kilobytes (KB) per second of the data transfer for the resynchronization. This is affected by the disk being in use during the resynchronization.
Refresh Click to manually initiate the tab’s display to refresh itself with current information.
Array Details
Percentage
Done
Enables you to remove or recover disks for the array.
Displays the percentage of resynchronization that remains to be completed.
Displays the amount of the resynchronization that has been completed, including as a percentages and as the number of kilobytes completed and the size of the disk.
Finished in
Speed
Display the estimated time in hours, minutes, seconds until the current resynchronization is complete, assuming that the current speed is maintained.
Displays the average speed in kilobytes (KB) per second of the resynchronization.
If a disk is in use during resynchronization, resynchronization may be slower.
Click here to check array Click to rebuild the RAID unit and start a diagnostic check on this
RAID. The progress is displayed in the Resync Status section.
Note: This link has no effect and a rebuild cannot be performed if the status of the RAID is clean no-errors.
To change RAID levels
Caution: Back up data on the disk before beginning this procedure. Changing the device’s
RAID level temporarily suspends all mail processing and erases all data on the hard disk.
For more information on creating a backup, see
“Backup and restore” on page 97
.
1 Go to System > RAID > RAID System.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
153
Configuring RAID System
2 In the Level column, click the row corresponding to the RAID device whose RAID level you want to change.
The Level field changes to a drop-down menu.
3 Select RAID level 0 or 1.
4 Click Apply.
A warning message appears.
5 Click Yes to confirm the change.
Configuring RAID on FortiMail-2000A/B or FortiMail-4000A models
To configure RAID, go to System > RAID > RAID System.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
Figure 81: Configuring RAID (FortiMail-2000A/B and FortiMail-4000A)
154
Model
Driver
Firmware
The model of the hardware RAID controller.
The version of the RAID controller’s driver software.
The version of the RAID controller’s firmware.
Set RAID level Select the RAID level, then click Change.
RAID 10 and RAID 50 are available on the FortiMail-2000A/B and
FortiMail-4000/A. Hot spares are available only on the FortiMail-4000A.
For more information, see “About RAID levels” on page 151
.
Change
Re-scan
From Set RAID level, select the RAID style, then click this button to apply
the RAID level.
Click to rebuild the RAID unit with disks that are currently a member of it, or detect newly added hard disks, and start a diagnostic check.
List of RAID units in the array
Unit Indicates the identifier of the RAID unit, such as u0.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Configuring RAID
Type
Status
Size
Ignore ECC
Indicates the RAID level currently in use. Depending on the FortiMail model, valid types include:
• RAID 10
• RAID 10 + hot spare(s)
• RAID 50
• RAID 50 + hot spare(s)
For more information, see “About RAID levels” on page 151
. To change
the RAID level, use Set RAID level.
Indicates the status of the RAID unit.
• OK: The RAID unit is operating normally.
• Warning: The RAID controller is currently performing a background task (rebuilding, migrating, or initializing the RAID unit).
Caution: Do not remove hard disks while this status is displayed.
Removing hard disks that are in active use could cause hardware damage.
• Error: The RAID unit is degraded or inoperable. Causes vary, such as when too many hard disks in the unit fail and the RAID unit no longer has the minimum number of disks required to operate in your selected
RAID level. To correct such a situation, you must replace the failed hard disks.
• No Units: No RAID units are available.
Note: If both Error and Warning conditions exist, the status will appear as
Error.
Indicates the total disk space, in gigabytes (GB), available for the RAID unit.
Available space varies by your RAID level selection. Due to some space being consumed to store data required by RAID, available storage space will not equal the sum of the capacities of hard disks in the unit.
Click turn on to ignore the Error Correcting Code (ECC). This option is off by default.
Ignoring the ECC can speed up building the RAID, but the RAID will not be as fault-tolerant.
This option is not available on FortiMail-2000B models.
List of hard disks in the array
ID/Port Indicates the identifier of each hard disk visible to the RAID controller.
Part of Unit
Status
Indicates the RAID unit to which the hard disk belongs, if any.
To be usable by the FortiMail unit, you must add the hard disk to a RAID unit.
Indicates the hardware viability of the hard disk.
• OK: The hard disk is operating normally.
• UNKNOWN: The viability of the hard disk is not known. Causes vary, such as the hard disk not being a member of a RAID unit. In such a case, the RAID controller does not monitor its current status.
Size
Delete
Indicates the capacity of the hard disk, in gigabytes (GB).
Click to unmount a hard disk before swapping it.
After replacing the disk, add it to a RAID unit, then click Re-scan.
To change RAID levels
Caution: Back up data on the disk before beginning this procedure. Changing the device’s
RAID level temporarily suspends all mail processing and erases all data on the hard disk.
For more information on creating a backup, see
“Backup and restore” on page 97
.
1 Go to System > RAID > RAID System.
2 From Set RAID level to, select a RAID level.
3 Click Change.
The FortiMail unit changes the RAID level and reboots.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
155
Using high availability (HA) System
To replace a disk in the array
When replacing a disk in the RAID array, the new disk must have the same or greater storage capacity than the existing disks in the array. If the new disk has a larger capacity than the other disks in the array, only the amount equal to the smallest hard disk will be used. For example, if the RAID has 400 GB disks, and you replace one with a 500 GB disk, to be consistent with the other disks, only 400 GB of the new disk will be used.
FortiMail units support hot swap; shutting down the FortiMail unit during hard disk replacement is not required.
1 Go to System > RAID > RAID System.
2 In the row corresponding to the hard disk that you want to replace (for example, p4), click to select the hard disk, then click Delete.
The RAID controller removes the hard disk from the list.
3 Protect the FortiMail unit from static electricity by using measures such as applying an anti-static wrist strap.
4 Physically remove the hard disk that corresponds to the one you removed in the webbased manager from its drive bay on the FortiMail unit.
On a FortiMail-2000A or FortiMail-4000A, press in the tab, then pull the drive handle to remove the dive. On a FortiMail-2000B, press the button to eject the drive.
To locate the correct hard disk to remove on a FortiMail-2000A, refer to the following diagram.
Drive 1 (p0)
Drive 2 (p1)
Drive 3 (p2)
Drive 4 (p3)
Drive 5 (p4)
Drive 6 (p5)
To locate the correct hard disk to remove on a FortiMail-2000B, refer to the following diagram.
Drive 1 (p0)
Drive 2 (p1)
Drive 3 (p2)
Drive 4 (p3)
Drive 5 (p4)
Drive 6 (p5)
To locate the correct hard disk to remove on a FortiMail-4000A, look for the failed disk.
(Disk drive locations vary by the RAID controller model.)
5 Replace the hard disk with a new hard disk, inserting it into its drive bay on the
FortiMail unit.
6 Click Re-scan.
The RAID controller will scan for available hard disks and should locate the new hard disk. Depending on the RAID level, the FortiMail unit may either automatically add the new hard disk to the RAID unit or allocate it as a spare that will be automatically added to the array if one of the hard disks in the array fails.
The FortiMail unit rebuilds the RAID array with the new hard disk. Time required varies by the size of the array.
Using high availability (HA)
The High Availability submenu enables you to configure the FortiMail unit to act as a member of a high availability (HA) cluster in order to increase processing capacity or availability. It also enables you to monitor the HA cluster.
156
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
For the general procedure of how to enable and configure HA, see “How to use HA” on page 162
.
This topic includes:
•
•
About the heartbeat & synchronization
•
About logging, alert email, & SNMP in HA
•
•
•
Configuring the HA mode & group
•
Configuring service-based failover
•
•
Example: Active-passive HA group in gateway mode
About high availability
FortiMail units can operate in one of two HA modes:
Table 18: Comparison of HA modes
Active-passive HA
2 FortiMail units in the HA group
Config-only HA
2-25 FortiMail units in the HA group
Typically deployed behind a switch Typically deployed behind a load balancer
Both configuration* and data synchronized Only configuration* synchronized
Only primary unit processes email
No data loss when hardware fails
Failover protection, but no increased processing capacity
All units process email
Data loss when hardware fails
Increased processing capacity, but no failover protection
.
Figure 82: Active-passive HA group operating in gateway mode
Mail Server
Internal network
Internet
Switch
Switch
Active-passive
HA Group
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
157
Using high availability (HA)
Figure 83: Config-only HA group operating in gateway mode
Mail Server
Internal network
158
System
Internet
Load balancer
Config only mode HA Group
Note: If the config-only HA group is installed behind a load balancer, the load balancer stops sending email to failed FortiMail units. All sessions being processed by the failed
FortiMail unit must be restarted and will be re-directed by the load balancer to other
FortiMail units in the config-only HA group.
You can mix different FortiMail models in the same HA group. However, all units in the HA group must have the same firmware version.
Note: When mixing FortiMail models, the HA group is limited by the capacity and configuration limits of the least powerful model. For details on configuration maximums, see
“Appendix B: Maximum Values Matrix” on page 487 .
Communications between HA cluster members occur through the heartbeat and synchronization connection. For details, see
“About the heartbeat & synchronization” on page 159
.
To configure FortiMail units that are operating in HA mode, you will usually connect only to the primary unit (master). The primary unit’s configuration is almost entirely synchronized to backup unit(s) (slave), so that changes made to the primary unit are propagated to the backup unit(s).
Exceptions to this rule include connecting to a backup unit in order to view log messages recorded about the backup unit itself on its own hard disk, and connecting to a backup unit
Note: If the HA cluster will use FortiGuard Antivirus or FortiGuard Antispam, license all
FortiMail units in the cluster. If you license only the primary unit in an active-passive HA group, after a failover, the backup unit will not be able to connect to the FortiGuard
Antispam service; for FortiMail units in a config-only HA group, only the licensed unit will be able to use the subscription services.
For the general procedure of how to enable and configure HA, see “How to use HA” on page 162
.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
About the heartbeat & synchronization
Heartbeat and synchronization traffic consists of TCP packets that are transmitted between the FortiMail units in the HA group through the primary and secondary heartbeat interfaces.
Note: Service monitoring traffic can also, for short periods, be used as a heartbeat. For details, see “Remote services as heartbeat” on page 173 .
Heartbeat and synchronization traffic has three primary functions:
• to monitor the responsiveness of the HA group members
• to synchronize configuration changes* from the primary unit to the backup unit(s)
• to synchronize mail data from the primary unit to the backup unit (active-passive only)
.
Mail data consists of the FortiMail system mail directory, user home directories, and MTA spool directories.
Note: FortiGuard Antispam packages and FortiGuard Antivirus engines and definitions are not synchronized between primary and backup units.
When the primary unit’s configuration changes, it immediately synchronizes the change to the backup unit (or, in a config-only HA group, the peer units) through the primary heartbeat interface. If this fails, or if you have inadvertently de-synchronized the backup
unit’s configuration, you can manually initiate synchronization. For details, see “click
HERE to start a configuration/data sync” on page 166
.
During normal operation, the backup unit expects to constantly receive heartbeat traffic from the primary unit. Loss of the heartbeat signal interrupts the HA group, and, if it is active-passive in style, generally triggers a failover. Exceptions include restarts and the execute reload CLI command. Normally, this would be enough time to determine that the primary unit has failed. However, to prevent this type of false failover, before rebooting or reloading the configuration, the primary unit signals to the backup unit to wait for the primary unit to complete the restart or reload.
Behavior when the heartbeat fails varies by your HA mode:
• Active-passive HA: A new primary unit is elected: the backup unit becomes the new primary unit and assumes the duty of processing of email. During the failover, no mail data or configuration changes are lost, but some in-progress email deliveries may be interrupted. These interrupted deliveries may need to be restarted, but most email clients and servers can gracefully handle this. Additional failover behaviors may be
configured. For details, see “On failure” on page 171 .
Note: Maintain the heartbeat connection. If the heartbeat is accidentally interrupted for an active-passive HA group, such as when a network cable is temporarily disconnected, the backup unit will assume that the primary unit has failed, and become the new primary unit.
If no failure has actually occurred, both FortiMail units will be operating as primary units simultaneously. For details on correcting this, see
“click HERE to restore configured operating mode” on page 166 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
159
Using high availability (HA) System
• Config-only HA: Each backup unit continues to operate normally. However, with no primary unit, changes to the configuration are no longer synchronized. You must manually configure one of the backup units to operate as the primary unit, synchronizing its changes to the remaining backup units.
For failover examples and steps required to restore normal operation of the HA group in each case, see
“Example: Failover scenarios” on page 177 .
Configuration settings that are not synchronized
All configuration settings on the primary unit are synchronized to the backup unit, except for the following:
Operation mode
Host name
Interface configuration
(gateway and server mode only)
You must set the operation mode (gateway, transparent, or server) of each
HA group member before configuring HA. For details, see “Operation mode” on page 54 .
The host name distinguishes members of the cluster. For details, see “Host name” on page 202
.
Each of the FortiMail units in the HA group must be configured with different network interface settings for connectivity purposes. For details, see
“Configuring the network interfaces” on page 121 .
Exceptions include some active-passive HA settings which affect the interface configuration for failover purposes. These settings are
synchronized. For details, see “Virtual IP Address” on page 174
.
Each of the FortiMail units in the HA group should be configured with different management IP addresses for connectivity purposes. For details,
see “About the management IP” on page 122
.
Management IP address
(transparent mode only)
SNMP system information
Each of the FortiMail units in the HA group will have its own SNMP system information, including the Description, Location, and Contact. For details,
see “Configuring SNMP queries & traps” on page 135 .
RAID configuration RAID settings are hardware-dependent and determined at boot time by looking at the drives (for software RAID) or the controller (hardware RAID), and are not stored in the system configuration. Therefore, they are not synchronized.
Main HA configuration
HA Daemon configuration
The main HA configuration, which includes the HA mode of operation (such as master or slave) is not synchronized, because this configuration must be different on the primary and backup units. For details, see
HA mode & group” on page 168 .
The following HA daemon settings are not synchronized:
• Shared password
• Backup mail data directories
• Backup MTA queue directories
You must add the shared HA password to each unit in the HA group. All units in the HA group must use the same shared password to identify the group.
Synchronized HA daemon options that are active-passive HA settings affect how often the backup unit tests the primary unit and how the backup unit synchronizes configuration and mail data. Because HA daemon settings on the backup unit control how the HA daemon operates, in a functioning HA group you would change the HA daemon configuration on the backup unit to change how the HA daemon operates. The HA daemon settings on the primary unit do not affect the operation of the HA daemon.
Note: In some active-passive HA groups, you may want to have different
HA daemon configurations on the primary and backup units. For example, after a failover, if the failed primary unit restarts and becomes a backup unit, you might not want the new backup unit to synchronize with the new primary unit in the same way as when the HA group is functioning normally.
160
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
HA service monitoring configuration
In active-passive HA, the HA service monitoring configuration is not synchronized. The remote service monitoring configuration on the backup unit controls how the backup unit checks the operation of the primary unit.
The local services configuration on the primary unit controls how the primary unit tests the operation of the primary unit. For details, see
“Configuring service-based failover” on page 175 .
Note: You might want to have a different service monitoring configuration on the primary and backup units. For example, after a failover you may not want service monitoring to operate until you have fixed the problems that caused the failover and have restarted normal operation of the HA group.
Config-only HA network settings and names
In config-only HA:
•
static routes (see “Configuring static routes” on page 128 )
•
the local domain name (see “Local domain name” on page 202 )
• the quarantine report host name (see
“Web release host name/IP” on page 382
)
Synchronization of the MTA spool directory after a failover
During normal operation, email messages are in one of two states:
• being received or sent by the primary unit
• stored on the primary unit the system mail directory, the user home directories, or the
MTA spool directories (which includes the outgoing mail directory)
When normal operation of an active-passive HA group is interrupted and a failover occurs, sending and receiving is interrupted. The delivery attempt fails, and the sender usually retries to send the email message. However, stored messages remain in the primary unit’s
MTA mail directory.
You usually should configure HA to synchronize the system mail directory and the user home directory to prevent loss of stored email messages, but you usually will not want to regularly synchronize MTA spool directories.
This is because, to prevent loss of email messages in the failed primary unit, FortiMail units in active-passive HA use the following failover mechanism:
Note: If the failed primary unit effective operating mode is failed, a sequence similar to the following occurs automatically when the problem that caused the failure is corrected.
1 The backup unit detects the failure of the primary unit, and becomes the new primary unit.
2 The former primary unit restarts, detects the new primary unit, and becomes a backup unit.
Note: You may have to manually restart the failed primary unit.
3 The former primary unit synchronizes its MTA spool directories with the new primary unit.
This synchronization occurs through the heartbeat link between the primary and backup units, and prevents duplicate email messages from forming in the primary unit’s MTA spool directories.
4 The new primary unit delivers email in its MTA spool directories, including email messages synchronized from the new backup unit.
As a result, as long as the failed primary unit can restart, no email is lost from the MTA spool directories.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
161
Using high availability (HA)
162
System
Even if you choose to synchronize MTA spool directories, because their contents change very rapidly and synchronization is periodic, there is a chance that some of the email in these directories will not have been synchronized at the exact moment a failover occurs.
About logging, alert email, & SNMP in HA
To configure logging and alert email, configure the primary unit and enable HA events.
When the configuration changes are synchronized to the backup unit(s), all of the
FortiMail units in the HA group record their own separate log messages and send separate alert email messages. Log data is not synchronized. For details on configuring logging and viewing log messages, see
Note: To distinguish alert email from each member of the HA cluster, configure a different
host name for each member. For details, see “Host name” on page 202 .
To configure SNMP, configure each cluster member separately and enable HA events for the community. If you enable SNMP for all of these units, they can all send SNMP traps.
Additionally, you can use an SNMP server to monitor the primary and backup units for HA settings such as the HA configured and effective operating modes. For details on configuring SNMP, see
“Configuring SNMP queries & traps” on page 135 .
Note: To aid in quick discovery and diagnosis of network problems, consider configuring
SNMP, Syslog, and/or alert email to monitor the HA cluster for failover messages.
Getting HA information using SNMP
You can use an SNMP manager to get information about how FortiMail HA is operating.
The FortiMail MIB (fortimail.mib) and the FortiMail trap MIB (fortimail.trap.mib) include the
HA fields listed in Table 19 .
Table 19: New HA FortiMail MIB and FortiMail trap MIB fields
MIB Field fortimail.mib
fmlHAEventId fmlHAUnitIp
Description
The ID of the most recent HA event.
The IP address of the port1 interface of the FortiMail unit on which an HA event occurred.
fmlHAEventReason A description of the reason for the HA event. fmlHAMode The HA configured operating mode. The HA operating mode that you have configured the FortiMail unit to operate in. Configured operating mode can be master (primary unit) or slave (backup unit).
fmlHAEffectiveMode The effective HA operating mode (applies to active-passive HA only), either as the primary unit or as the backup unit. The effective operating mode matches the configured operating mode unless a failure has occurred.
fortimail.trap.mib
fmlTrapHAEvent The FortiMail HA trap that is sent when an HA event occurs. This trap includes the contents of the fmlSysSerial, fmlHAEventId, fmlHAUnitIp, and fmlHAEventReason MIB fields.
How to use HA
In general, to enable and configure HA, you should perform the following:
1 If the HA cluster will use FortiGuard Antivirus and/or FortiGuard Antispam services, license all of the FortiMail units in the HA group for the FortiGuard Antispam and
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
FortiGuard Antivirus services, and register them with the Fortinet Technical Support web site, https://support.fortinet.com/ .
2 Physically connect the FortiMail units that will be members of the HA cluster.
You must connect at least one of their network interfaces, which will be used for heartbeat and synchronization traffic between members of the cluster. For reliability reasons, Fortinet recommends that you connect both a primary and a secondary heartbeat interface, and that they be connected directly or through a dedicated switch that is not connected to your overall network.
3 For config-only clusters, configure each member of the cluster to store mail data on a
NAS server that supports NFS connections. (Active-passive groups may also use a
NAS server, but do not require it.) For details, see
“Selecting the mail data storage location” on page 208 .
4 On each member of the cluster:
• Enable the HA mode that you want to use (either active-passive or config-only) and select whether the individual member will act as a primary unit (master) or secondary unit (slave) within the cluster. For information about the differences
between the HA modes, see “About high availability” on page 157
.
• Configure the local IP addresses of the primary and secondary heartbeat and synchronization network interfaces.
• For active-passive clusters, configure the behavior upon failover, and how the network interfaces should be configured for whichever FortiMail unit is currently acting as the primary unit. Additionally, if the FortiMail units store mail data on a
NAS, disable mail data synchronization between members.
• For config-only clusters, if the FortiMail unit is a primary unit, configure the IP addresses of its secondary (also called peer) units; if the FortiMail unit is a secondary unit, configure the IP address of its primary (master) unit.
For details, see
“Configuring the HA mode & group” on page 168
.
5 If the HA cluster is active-passive in style, and you want to trigger failover when hardware or a service fails even if the heartbeat connection is still functioning, configure service monitoring. For details, see
“Configuring service-based failover” on page 175 .
6 Monitor the status of each cluster member. For details, see “Monitoring the HA status” on page 163
. To monitor HA events through log messages and/or alert email, you must
first enable logging of HA activity events. For details, see “Log & Report” on page 437 .
Monitoring the HA status
The Status tab in the High Availability submenu enables you to view the configured operating mode of a FortiMail unit in an HA group, and to manually initiate synchronization. It also enables you to reset the operating mode of a FortiMail unit whose effective operating mode has become different than its configured operating mode, such as after a failover when a configured primary unit is currently acting as a backup unit.
For FortiMail units operating as backup units, the Status tab also enables you to view the status and schedule of the HA synchronization daemon.
Appearance of the Status tab varies by:
• whether the HA group is active-passive or config-only
• whether the FortiMail unit is configured as a primary unit or backup unit
• whether a failover has occurred (active-passive only)
If HA is disabled, this tab displays:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
163
Using high availability (HA) System
HA mode is currently disabled
Before you can use the Status tab, you must first enable and configure HA. For details,
see “Configuring the HA mode & group” on page 168 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the HA operating mode status, go System > High Availability > Status.
Figure 84: Active-passive HA status (primary unit)
Figure 85: Config-only HA status (primary unit)
Figure 86: Active-passive HA status (primary unit after failover)
164
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Mode Status
Configured
Operating Mode
The HA operating mode that you have configured, either:
• master: Configured to be the primary unit of an activepassive group.
• slave: Configured to be the backup unit of an active-passive group.
• config master: Configured to be the primary unit of a config-only group.
• config slave: Configured to be a backup unit of a configonly group.
For information on configuring the operating mode, see
“Mode of operation” on page 171
.
After a failure, the FortiMail unit may not be acting in its configured operating mode. For details, see
For explanations of combinations of configured and effective
.
Effective
Operating Mode
The mode that the unit is currently operating in, either:
• master: Acting as primary unit.
• slave: Acting as backup unit.
• off: For primary units, this indicates that service/interface monitoring has detected a failure and has taken the primary unit offline, triggering failover. For backup units, this indicates that synchronization has failed once; a subsequent failure will trigger failover. For details, see
and “click HERE to restart the HA system” on page 166
.
• failed: Service/network interface monitoring has detected a failure and the diagnostic connection is currently determining whether the problem has been corrected or failover is required. For details, see
.
The configured operating mode matches the effective operating mode unless a failure has occurred.
For example, after a failover, a FortiMail unit configured to operate as a backup unit could be acting as the new primary unit.
For explanations of combinations of configured and effective
.
For information on restoring the FortiMail unit to an effective operating mode that matches the configured operating mode,
see “click HERE to restore configured operating mode” on page 166
.
This option appears only if the FortiMail unit is a member of an active-passive HA group.
Daemon Status
Monitor The time at which the backup unit’s HA daemon will check to make sure that the primary unit is operating correctly, and, if monitoring has detected a failure, the number of times that a failure has occurred.
Monitoring occurs through the heartbeat link between the primary and backup units. If the heartbeat link becomes disconnected, the next time the backup unit checks for the primary unit, the primary unit will not respond. If the maximum number of consecutive failures is reached, and no secondary heartbeat or remote service monitoring heartbeat is available, the backup unit will change its effective operating mode to become the new primary unit.
For details, see “HA base port” on page 173 .
This option appears only for backup units in active-passive HA groups.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
165
Using high availability (HA) System
Configuration The time at which the backup unit’s HA daemon will synchronize the FortiMail configuration from the primary unit to the backup unit.
The message slave unit is currently synchronizing appears when the HA daemon is synchronizing the configuration.
For information on items that are not synchronized, see
“Configuration settings that are not synchronized” on page 160
.
This option appears only for backup units in active-passive HA groups.
Data The time at which the backup unit HA daemon will synchronize mail data from the primary unit to the backup unit.
The message slave unit is currently synchronizing appears when the HA daemon is synchronizing data.
For details, see
“Backup mail data directories” on page 173
and
“Backup MTA queue directories” on page 173 .
This option appears only for backup units in active-passive HA groups.
click HERE to start a configuration/data sync
Click to manually initiate synchronization of the configuration and, for active-passive groups, mail data. For information on
items that are not synchronized, see “Configuration settings that are not synchronized” on page 160
.
click HERE to restore configured operating mode
Click to reset the FortiMail unit to an effective operating mode that matches the FortiMail unit’s configured operating mode.
For example, for a configured primary unit whose effective operating mode is now slave, after correcting the cause of the failover, you might click this option on the primary unit to restore the configured primary unit to active duty, and restore the backup unit to its backup role.
This option appears only if the FortiMail unit is a member of an active-passive HA group.
Note: Before selecting this option, if the effective operating mode changed due to failover, you should resolve any issues that caused the failover.
click HERE to switch to slave mode click HERE to restart the HA system
Click to manually switch the effective operating mode of the primary unit so that it becomes a backup unit.
This option appears only if the FortiMail unit is currently operating as a primary unit.
Click to restart HA processes after they have been halted due to detection of a failure by service monitoring. For details, see
“Configuring service-based failover” on page 175 , and
“Restarting the HA processes on a stopped primary unit” on page 167
.
This option appears only if the FortiMail unit is configured to operate as the primary unit (master), but its effective operating mode is off.
Table 20: Combinations of configured and effective operating modes
Configured
Operating mode
Effective
Operating
Mode master slave master master slave off
Description
Normal for the primary unit of an active-passive HA group.
Normal for the backup unit of an active-passive HA group.
The primary unit has experienced a failure, or the FortiMail unit is in the process of switching to operating in HA mode.
HA processes and email processing are stopped.
166
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Table 20: Combinations of configured and effective operating modes
Configured
Operating mode
Effective
Operating
Mode slave off
Description master master slave failed slave master
The backup unit has detected a failure, or the FortiMail unit is in the process of switching to operating in HA mode.
After the backup unit starts up and connects with the primary unit to form an HA group, the first configuration synchronization may fail in special circumstances. To prevent both the backup and primary units from simultaneously acting as primary units, the effective operating mode becomes off.
If subsequent synchronization fails, the backup unit’s effective operating mode becomes master.
The remote service monitoring or local network interface monitoring on the primary unit has detected a failure, and will attempt to connect to the other FortiMail unit. If the problem that caused the failure has been corrected, the effective operating mode switches from failed to slave, or to match the configured operating mode, depending on the On failure setting.
Additionally, f the HA group is operating in transparent mode, and if the effective operating mode changes to failed, the network interface
IP/netmask on the backup unit displays bridging (waiting for recovery).
For details, see “Configuring the network interfaces” on page 121
.
The primary unit has experienced a failure but then returned to operation. When the failure occurred, the unit configured to be the backup unit became the primary unit. When the unit configured to be the primary unit restarted, it detected the new primary unit and so switched to operating as the backup unit.
The backup unit has detected that the FortiMail unit configured to be the primary unit failed. When the failure occurred, the unit configured to be the backup unit became the primary unit.
Normal for the primary unit of a config-only HA group.
config master
N/A config slave N/A Normal for the backup unit of a config-only HA group.
This topic includes:
•
Restarting the HA processes on a stopped primary unit
Restarting the HA processes on a stopped primary unit
) and either the primary unit or the backup unit detects a service failure on the primary unit, the primary unit changes its effective operating mode to
off, stops processing email, and halts all of its HA processes.
After resolving the problem that caused the failure, you can use the following steps to restart the HA processes on the primary unit.
In this example, resolving this problem could be as simple as reconnecting the cable to the port2 network interface. Once the problem is resolved, use the following steps to restart the stopped primary unit.
To restart a stopped primary unit
1 Log in to the web-based manager of the primary unit.
2 Go to System > High Availability > Status.
3 Select click HERE to restart the HA system.
The primary unit restarts and rejoins the HA group.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
167
Using high availability (HA) System
4 If a failover has occurred due to processes being stopped on the primary unit, and the backup unit is currently acting as the primary unit, you can restore the primary and
.
Configuring the HA mode & group
The Configuration tab in the High Availability submenu enables you to configure most high availability (HA) options, including main aspects such as:
• enabling HA
• selecting whether the HA group is active-passive or config-only in style (for information on the differences, see Table 18 on page 157 )
• whether this individual FortiMail unit will act as a primary unit or a backup unit in the cluster
• network interface(s) that will be used for heartbeat and synchronization
HA settings, with the exception of Virtual IP Address settings, are not synchronized and must be configured separately on each primary and backup unit.
You must maintain the physical link between the heartbeat and synchronization network interfaces. These connections enable cluster members to detect the responsiveness of other members, and to synchronize data. If they are interrupted, normal operation will be interrupted and, for active-passive HA groups, a failover will occur. For more information
on heartbeat and synchronization, see “About the heartbeat & synchronization” on page 159
.
For an active-passive HA group, or a config-only HA group consisting of only two FortiMail units, directly connect the heartbeat network interfaces using a crossover Ethernet cable.
For a config-only HA group consisting of more than two FortiMail units, connect the heartbeat network interfaces through a switch, and do not connect this switch to your overall network.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure most HA options, go to System > High Availability > Configuration.
168
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 87: Active-passive HA (primary unit)
Using high availability (HA)
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
169
Using high availability (HA)
Figure 88: Active-passive HA (backup unit)
System
Figure 89: Config-only HA (primary unit with three backup units)
170
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 90: Config-only HA (backup unit)
Using high availability (HA)
Main Configuration
Mode of operation
On failure
Enables or disables HA, selects active-passive or config-only HA, and selects the initial configured role this FortiMail unit in the HA group.
• off: The FortiMail unit is not operating in HA mode.
• master: The FortiMail unit is the primary unit in an active-passive HA group.
• slave: The FortiMail unit is the backup unit in an active-passive HA group.
• config master: The FortiMail unit is the primary unit in a config-only
HA group.
• config slave: The FortiMail unit is a backup unit in a config-only HA group.
Caution: For config-only HA, if the FortiMail unit is operating in server mode, you must store mail data externally, on a NAS server. Failure to store mail data externally could result in mailboxes and other data scattered over multiple FortiMail units. For details on configuring NAS,
see “Storing mail data on a NAS server” on page 174
and “Selecting the mail data storage location” on page 208
Select one of the following behaviors of the primary unit when it detects a failure, such as upon reboot or from service/interface monitoring.
• switch off: Do not process email or join the HA group until you manually select the effective operating mode (see
• wait for recovery then restore original role: On recovery, the failed primary unit‘s effective operating mode resumes its configured operating mode. This behavior may be useful if the cause of failure is temporary and rare, but may cause problems if the cause of failure is permanent or persistent.
• wait for recovery then restore slave role: On recovery, the failed primary unit’s effective operating mode becomes slave (backup), and it then synchronizes the content of its MTA spool directories with the current primary unit. The new primary unit can then deliver email that existed in the former primary unit’s MTA spool at the time of the failover. For information on manually restoring the FortiMail unit to acting in its configured operation mode, see
“click HERE to restore configured operating mode” on page 166 .
In most cases, you should select the wait for recovery then restore slave
role option.
For details on the effects of this option on the Effective Operating Mode,
see Table 20 on page 166 . For information on configuring
service/interface monitoring, see “Configuring service-based failover” on page 175
.
This option appears only if Mode of operation is master.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
171
Using high availability (HA)
172
System
Shared password
Interface
Enter an HA password for the HA group. You must configure the same
Shared Password value on both the primary and backup unit(s).
The name of the network interface.
IP/Netmask
Port monitor
Primary heartbeat
Click to configure the IP address and netmask of the network interface.
This IP address must be different from, but on the same subnet as, the
IP addresses of the other heartbeat network interfaces of other members in the HA group.
Note: When configuring other FortiMail units in the HA group, use this value as the:
• Remote peer IP (for active-passive groups)
• Master configuration (for backup units in config-only groups)
• Peer systems (for the primary unit on config-only groups)
Enable to monitor a network interface for failure. If the port fails, the primary unit will trigger a failover.
This option applies only if local network interface monitoring is enabled.
For details, see
“Configuring service-based failover” on page 175
.
Select the primary network interface for heartbeat and synchronization
traffic. For more information, see “About the heartbeat & synchronization” on page 159 .
This network interface must be connected directly or through a switch to the Primary heartbeat network interface of other members in the HA group.
Caution: Using the same network interface for both HA synchronization/heartbeat traffic and other network traffic could result in issues with heartbeat and synchronization during times of high traffic load, and is not recommended.
Note: In general, you should isolate the network interfaces that are used for heartbeat traffic from your overall network. Heartbeat and synchronization packets contain sensitive configuration information, are latency-sensitive, and can consume considerable network bandwidth.
Secondary heartbeat
Select the secondary network interface for heartbeat and synchronization traffic, or select one of the following other behaviors.
For more information, see “About the heartbeat & synchronization” on page 159
.
• disabled: Do not use the secondary heartbeat.
• any port: Use any network interface whose Virtual IP Address is
do nothing.
The secondary heartbeat interface is the backup heartbeat link between the units in the HA group. If the primary heartbeat link is functioning, the secondary heartbeat link is used for the HA heartbeat. If the primary heartbeat link fails, the secondary link is used for the HA heartbeat and for HA synchronization.
This network interface must be connected directly or through a switch to the Secondary heartbeat network interfaces of other members in the HA group.
This option appears only for active-passive groups.
Caution: Using the same network interface for both HA synchronization/heartbeat traffic and other network traffic could result in issues with heartbeat and synchronization during times of high traffic load, and is not recommended.
Note: In general, you should isolate the network interfaces that are used for heartbeat traffic from your overall network. Heartbeat and synchronization packets contain sensitive configuration information, are latency-sensitive, and can consume considerable network bandwidth.
Remote peer IP Enter the IP address of the matching heartbeat network interface of the other member of the HA group.
For example, if you are configuring the primary unit’s primary heartbeat network interface, enter the IP address of the backup unit’s primary heartbeat network interface.
Similarly, for the secondary heartbeat network interface, enter the IP address of the other unit’s secondary heartbeat network interface.
This option appears only for active-passive HA.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Backup options
Backup mail data directories
For information about configuration synchronization and what is not
synchronized, see “About the heartbeat & synchronization” on page 159
.
Synchronize system quarantine, email archives, email users’ mailboxes
(server mode only), preferences, and per-recipient quarantines.
Unless the HA cluster stores its mail data on a NAS server, you should configure the HA cluster to synchronize mail directories.
If mail data changes frequently, you can manually initiate a data synchronization when significant changes are complete. For details, see
“click HERE to start a configuration/data sync” on page 166
.
This option appears only for active-passive groups.
Backup MTA queue directories
Synchronize the mail queue of the FortiMail unit. For more information
on the mail queue, see “Managing the deferred mail queue” on page 60
.
This option appears only for active-passive groups.
Caution: If the primary unit experiences a hardware failure and you
cannot restart it, if Backup MTA queue directories is disabled, MTA spool
directory data could be lost.
Note: Enabling Backup MTA queue directories is not recommended.
Periodic synchronization can be processor and bandwidth-intensive.
Additionally, because the content of the MTA spool directories is very dynamic, periodically synchronizing MTA spool directories between
FortiMail units may not guarantee against loss of all email in those directories. Even if MTA spool directory synchronization is disabled, after a failover, a separate synchronization mechanism may successfully prevent loss of MTA spool data. For details, see
MTA spool directory after a failover” on page 161 .
Advanced options
HA base port Enter the first of four total TCP port numbers that will be used for:
• the heartbeat signal
• synchronization control
• data synchronization
• configuration synchronization
Note: For active-passive groups, in addition to configuring the heartbeat, you can configure service monitoring. For details, see
“Configuring service-based failover” on page 175
.
Note: In addition to automatic immediate and periodic configuration synchronization, you can also manually initiate synchronization. For details, see
“click HERE to start a configuration/data sync” on page 166 .
Heartbeat lost threshold
Enter the total span of time, in seconds, for which the primary unit can be unresponsive before it triggers a failover and the backup unit assumes the role of the primary unit.
The heartbeat will continue to check for availability once per second. To prevent premature failover when the primary unit is simply experiencing very heavy load, configure a total threshold of three (3) seconds or more to allow the backup unit enough time to confirm unresponsiveness by sending additional heartbeat signals.
This option appears only for active-passive groups.
Note: If the failure detection time is too short, the backup unit may falsely detect a failure when during periods of high load.
Caution: If the failure detection time is too long the primary unit could fail and a delay in detecting the failure could mean that email is delayed or lost. Decrease the failure detection time if email is delayed or lost because of an HA failover.
Remote services as heartbeat
Enable to use remote service monitoring as a secondary HA heartbeat.
If enabled and both the primary and secondary heartbeat links fail or become disconnected, if remote service monitoring still detects that the primary unit is available, a failover will not occur.
This option appears only for active-passive groups.
Note: Using remote services as heartbeat provides HA heartbeat only, not synchronization. To avoid synchronization problems, you should not use remote service monitoring as a heartbeat for extended periods. This feature is intended only as a temporary heartbeat solution that operates until you reestablish a normal primary or secondary heartbeat link.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
173
Using high availability (HA) System
Virtual IP Address
Master configuration
Select whether and how to configure the IP addresses and netmasks of the FortiMail unit whose effective operating mode is currently master.
For example, a primary unit might be configured to receive email traffic through port1 and receive heartbeat and synchronization traffic through
port5 and port6. In that case, you would configure the primary unit to set the IP addresses or add virtual IP addresses for port1 of the backup unit upon failover in order to mimic that of the primary unit.
• do nothing: Do not change the network interface configuration upon failover, and do not monitor. For details on service monitoring for network interfaces, see
“Configuring the network interfaces” on page 121
.
• add virtual IP/netmask: Add the specified virtual IP address and netmask to the network interface upon failover. Normally, you will configure your network (MX records, firewall policies, routing and so on) so that clients and mail services use the virtual IP address. Both originating and reply traffic uses the virtual IP address. This option results in the network interface having two IP Addresses: the actual
and the virtual. For examples, see
“Example: Active-passive HA group in gateway mode” on page 182 .
• add to bridge: Include the network interface in the Layer 2 bridge.
While the effective operating mode is slave, the interface is deactivated and cannot process traffic, preventing Layer 2 loops.
Then, when the effective operating mode becomes master, the interface is activated again and can process traffic. This option appears only if the FortiMail unit is operating in transparent mode, and for FortiMail interfaces that are already members of the bridge.
For information on configuring bridging network interfaces, see
“Editing network interfaces” on page 123
.
Network interface(s) configured as the heartbeat network interface are required to maintain their IP addresses for heartbeat and synchronization purposes, and cannot be configured with the type add
to bridge.
This option appears only for active-passive groups.
Note: Settings in this section are synchronizable. Configure the primary unit, then synchronize it to the backup unit. For details, see
“click HERE to start a configuration/data sync” on page 166
.
Enter the IP address of the primary heartbeat network interface of the primary unit.
The backup unit synchronizes only with this primary unit’s IP address.
This option appears only for backup units in config-only groups.
Peer systems
IP address
Create
Delete
Double-click in order to modify, then enter the IP address of the primary network interface on that backup unit.
This field appears only for the primary unit config-only groups.
Click to add a backup unit to the list of Peer systems, then double-click its IP address.
The primary unit synchronizes only with backup units in the list of Peer
systems.
This option appears only for the primary unit in config-only groups.
Click the row corresponding to a peer IP address, then click this button to remove that backup unit from the HA group.
This option appears only for the primary unit config-only groups.
Storing mail data on a NAS server
For FortiMail units operating in server mode as a config-only HA group, you must store mail data on a NAS server instead of locally. If mail data is stored locally, email users’ messages and other mail data could be scattered across multiple FortiMail units.
174
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Even if your FortiMail units are not operating in server mode with config-only HA, however, storing mail data on a NAS server may have a number of benefits for your organization.
For example, backing up your NAS server regularly can help prevent loss of mail data.
Also, if your FortiMail unit experiences a temporary failure, you can still access the mail data on the NAS server. When the FortiMail unit restarts, it can usually continue to access and use the mail data stored on the NAS server.
For config-only HA groups using a network attached storage (NAS) server, only the primary unit sends quarantine reports to email users. The primary unit also acts as a proxy between email users and the NAS server when email users use FortiMail webmail to access quarantined email and to configure their own Bayesian filters.
For a active-passive HA groups, the primary unit reads and writes all mail data to and from the NAS server in the same way as a standalone unit. If a failover occurs, the new primary unit uses the same NAS server for mail data. The new primary unit can access all of the mail data that the original primary unit stored on the NAS server. So if you are using a NAS server to store mail data, after a failover, the new primary unit continues operating with no loss of mail data.
Note: If the FortiMail unit is a member of an active-passive HA group, and the HA group stores mail data on a remote NAS server, disable mail data synchronization to prevent
duplicate mail data traffic. For details, see “Backup mail data directories” on page 173 .
For instructions on storing mail data on a NAS server, see
“Selecting the mail data storage location” on page 208
.
Configuring service-based failover
The Services tab in the High Availability submenu enables you to configure remote service monitoring, local network interface monitoring, and local hard drive monitoring.
Note: Service monitoring is not available for config-only HA groups.
HA service monitoring settings are not synchronized and must be configured separately on each primary and backup unit.
With remote service monitoring, the backup unit confirms that it can connect to the primary unit over the network using SMTP service, POP service (POP3), and Web service (HTTP) connections.
With local network interface monitoring and local hard drive monitoring, the primary unit monitors its own network interfaces and hard drives.
If service monitoring detects a failure, the effective operating mode of the primary unit switches to off or failed (depending on the On failure setting) and, if configured, the
FortiMail units send HA event alert email, record HA event log messages, and send HA event SNMP traps. A failover then occurs, and the effective operating mode of the backup
. For information on the effective operating mode, see
“Monitoring the HA status” on page 163
.
Remote service monitoring can be effective to configure in addition to, or sometimes as a backup alternative to, the heartbeat. While the heartbeat tests for the general responsiveness of the primary unit, it does not test for the failure of individual services which email users may be using such as POP3 or webmail. The heartbeat also does not monitor for the failure of network interfaces through which non-heartbeat traffic occurs. In
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
175
Using high availability (HA) System this way, configuring remote service monitoring provides more specific failover monitoring.
Additionally, if the heartbeat link is briefly disconnected, enabling HA services monitoring can prevent a false failover by acting as a temporary secondary heartbeat. For information on treating service monitoring as a secondary heartbeat, see “Remote services as heartbeat” on page 173 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To configure service monitoring, go to System > High Availability > Services.
Figure 91: Configuring services monitoring
176
Remote services
SMTP service To enable connection responsiveness tests for SMTP, enter the IP address and port number of the SMTP service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for email traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
POP service To enable connection responsiveness tests for POP3, enter the IP address and port number of the POP3 service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for email traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Web service To enable connection responsiveness tests for webmail and the perrecipient quarantines, enter the IP address and port number of the HTTP service on the primary unit, the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed unresponsive and a failover occurs.
For example, if the primary unit responds on port1 for webmail traffic, set the remote service monitoring IP address to the port1 IP address of the primary unit.
To disable monitoring of this service, enter 0 as the amount of time to wait for responses.
Local services
Network interfaces
Hard drives
To enable responsiveness tests for network interfaces, enter the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed nonfunctional and a failover occurs.
Network interface monitoring tests all active network interfaces whose:
•
Virtual IP Address setting is not do nothing
•
Port monitor setting is enabled
For details, see
“Port monitor” on page 172 and
“Virtual IP Address” on page 174
.
To disable monitoring of the network interfaces, enter 0 as the failover threshold.
To enable responsiveness tests for hard drives, enter the frequency of the tests, and the number of consecutively failed tests that are allowed before the primary unit is deemed nonfunctional and a failover occurs.
To disable monitoring of the hard drives, enter 0 as the failover threshold.
Example: Failover scenarios
This section describes some basic FortiMail active-passive HA failover scenarios. For each scenario, refer to the HA group shown in Figure 92 . To simplify the descriptions of these scenarios, the following abbreviations are used:
• P1 is the configured primary unit (also called the master)
• B2 is the configured backup unit (also called the slave)
Figure 92: Example active-passive HA group
Active-passive HA group port1
172.16.5.10
(HA virtual IP: 172.16.5.2)
Primary unit (P1)
Switch port6
Heartbeat link
Backup unit (B2) port1
172.16.5.11
This topic includes:
•
Failover scenario: Temporary failure of the primary unit
•
Failover scenario: Primary heartbeat link fails
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
177
Using high availability (HA)
178
System
•
Failover scenario: Temporary failure of the primary unit
In this scenario, the primary unit (P1) fails because of a software failure or a recoverable hardware failure (in this example, the P1 power cable is unplugged). HA logging and alert email are configured for HA group.
When the backup unit (B2) detects that P1 has failed, B2 becomes the new primary unit and continues processing email.
1 The FortiMail HA group is operating normally.
2 The power is accidentally disconnected from P1.
3 B2’s primary heartbeat test detects that P1 has failed.
How soon this happens depends on the HA daemon configuration of B2.
4 The effective operating mode of B2 changes to master.
5 B2 sends an alert email, indicating that B2 has determined that P1 has failed and that
B2 is switching its effective operating mode to master.
6 B2 records event log messages (among others) indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
Recovering from temporary failure of the primary unit
Because the hardware failure of P1 is not permanent, you may want to return both
FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the P1 power cable is unplugged
1 Turn off the P1 power switch, reconnect the power cable and then turn the power switch back on.
P1 starts up and finds B2 operating as a primary unit. P1 switches its effective operating mode to slave.
P1 records event log messages (among others) as this happens.
The configured operating mode of P1 is master and the effective operating mode of P1 is slave.
The configured operating mode of B2 is slave and the effective operating mode of B2 is
master.
P1 synchronizes the content of its MTA spool directories to B2. Email in these directories can now be delivered by B2.
2 Connect to the web-based manager of P1, go to System > High Availability > Status.
3 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
4 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
5 Connect to the web-based manager of P1, go to System > High Availability > Status and select click HERE to restore configured operating mode.
P1 should return to operating as the primary unit and B2 should return to operating as
the backup unit. You may have to repeat steps 4 and 5
a few times.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
6 P1 and B2 synchronize their MTA spool directories again. All of the email in these directories can now be delivered by P1.
Failover scenario: Primary heartbeat link fails
If the primary heartbeat link fails, such as when the cable becomes accidentally disconnected, if you have not configured a secondary heartbeat link, the FortiMail units in the HA group cannot verify that each other are operating, and assume that the other has failed. As a result, the backup unit (B2) changes to operating as a primary unit, and both
FortiMail units are acting as primary units.
Two primary units connected to the same network may cause address conflicts on your network because matching interfaces will have the same IP addresses. Additionally, because the heartbeat link is interrupted, the FortiMail units in the HA group cannot synchronize configuration changes or mail data changes.
Even after reconnecting the heartbeat link, both units will continue operating as primary units. To return the HA group to normal operation, you must connect to the web-based manager of B2 to restore its effective operating mode to slave (backup unit).
1 The FortiMail HA group is operating normally.
2 The heartbeat link Ethernet cable is accidently disconnected.
3 B2’s HA heartbeat test detects that the primary unit has failed.
How soon this happens depends on the HA daemon configuration of B2.
4 The effective operating mode of B2 changes to master.
5 B2 sends an alert email, indicating that B2 has determined that P1 has failed and that
B2 is switching its effective operating mode to master.
6 B2 records event log messages (among others) indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
Recovering from a heartbeat link failure
Because the hardware failure is not permanent (that is, the failure of the heartbeat link was caused by a disconnected cable, not a failed port on one of the FortiMail units), you may want to return both FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the heartbeat link fails
1 Reconnect the primary heartbeat interface by reconnecting the heartbeat link Ethernet cable.
Even though the effective operating mode of B2 is master, B2 is continues to attempt to find the other primary unit. When the heartbeat link is reconnected, B2 finds P1 and determines that P1 is also operating as a primary unit. So B2 sends a heartbeat signal to notify P1 to stop operating as a primary unit. The effective operating mode of P1 changes to off.
2 P1 sends an alert email, indicating that P1 has stopped operating as the primary unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
179
Using high availability (HA) System
3 P1 records event log messages (among others) indicating that P1 is switching to off mode.
The configured operating mode of P1 is master and the effective operating mode of P1 is off.
The configured operating mode of B2 is slave and the effective operating mode of B2 is
master.
P1 synchronizes the content of its MTA spool directories to B2. Email in these directories can now be delivered by B2.
4 Connect to the web-based manager of P1, go to System > High Availability > Status.
5 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
6 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
The HA group should return to normal operation. P1 records the event log message
(among others) indicating that B2 asked P1 to return to operating as the primary unit.
7 P1 and B2 synchronize their MTA spool directories. All of the email in these directories can now be delivered by P1.
Failover scenario: Network connection between primary and backup units fails (remote service monitoring detects a failure)
Depending on your network configuration, the network connection between the primary and backup units can fail for a number of reasons. In the network configuration shown in
Figure 92 on page 177 , the connection between port1 of primary unit (P1) and port1 of the backup unit (B2) can fail if a network cable is disconnected or if the switch between P1 and B2 fails.
A more complex network configuration could include a number of network devices between the primary and backup unit’s non-heartbeat network interfaces. In any configuration, remote service monitoring can only detect a communication failure. Remote service monitoring cannot determine where the failure occurred or the reason for the failure.
In this scenario, remote service monitoring has been configured to make sure that B2 can connect to P1. The On failure setting located in the HA main configuration section is wait
for recovery then restore slave role. For information on the On failure setting, see
“On failure” on page 171 . For information about remote service monitoring, see
“Configuring service-based failover” on page 175
.
The failure occurs when power to the switch that connects the P1 and B2 port1 interfaces is disconnected. Remote service monitoring detects the failure of the network connection between the primary and backup units. Because of the On failure setting, P1 changes its effective operating mode to failed.
When the failure is corrected, P1 detects the correction because while operating in failed mode P1 has been attempting to connect to B2 using the port1 interface. When P1 can connect to B2, the effective operating mode of P1 changes to slave and the mail data on
P1 will be synchronized to B2. B2 can now deliver this mail. The HA group continues to operate in this manner until an administrator resets the effective operating modes of the
FortiMail units.
1 The FortiMail HA group is operating normally.
2 The power cable for the switch between P1 and B2 is accidently disconnected.
180
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
3 B2’s remote service monitoring cannot connect to the primary unit.
How soon this happens depends on the remote service monitoring configuration of B2.
4 Through the HA heartbeat link, B2 signals P1 to stop operating as the primary unit.
5 The effective operating mode of P1 changes to failed.
6 The effective operating mode of B2 changes to master.
7 B2 sends an alert email similar to the following, indicating that B2 has determined that
P1 has failed and that B2 is switching its effective operating mode to master.
8 B2 records the following event log messages (among others) indicating that B2 has determined that P1 has failed and that B2 is switching its effective operating mode to
master.
9 P1 sends an alert email similar to the following, indicating that P1 has stopped operating in HA mode.
10 P1 records the following log messages (among others) indicating that P1 is switching to off mode.
Recovering from a network connection failure
Because the network connection failure was not caused by failure of either FortiMail unit, you may want to return both FortiMail units to operating in their configured modes when rejoining the failed primary unit to the HA group.
To return to normal operation of the HA group after the heartbeat link fails
1 Reconnect power to the switch.
Because the effective operating mode of P1 is failed, P1 is using remote service monitoring to attempt to connect to B2 through the switch.
2 When the switch resumes operating, P1 successfully connects to B2.
P1 has determined the B2 can connect to the network and process email.
3 The effective operating mode of P1 switches to slave.
P1 records the following log messages (among others) as this happens.
4 P1 synchronizes the content of its MTA spool directories to B2. B2 can now deliver all of the email in these directories.
The HA group can continue to operate with B2 as the primary unit and P1 as the backup unit. However, you can use the following steps to restore each unit to its configured operating mode.
5 Connect to the web-based manager of P1 and go to System > High Availability >
Status.
6 Check for synchronization messages.
Do not proceed to the next step until P1 has synchronized with B2.
7 Connect to the web-based manager of B2, go to System > High Availability > Status and select click HERE to restore configured operating mode.
8 Connect to the web-based manager of P1, go to System > High Availability > Status and select click HERE to restore configured operating mode.
P1 should return to operating as the primary unit and B2 should return to operating as
the backup unit. You may have to repeat steps 4 and 5
a few times.
9 P1 and B2 synchronize their MTA spool directories again. P1 can now deliver all of the email in these directories.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
181
Using high availability (HA) System
Example: Active-passive HA group in gateway mode
In this example, two FortiMail-400 units are configured to operate in gateway mode as an active-passive HA group.
The procedures in this example describe HA configuration necessary to achieve this scenario. Before beginning, verify that both of the FortiMail units are already:
• currently physically connected according to
• operating in gateway mode (for details, see “Operation mode” on page 54 )
• each configured with the IP addresses for their port3 and port1 network interfaces
according to Figure on page 185
, with the exception of the HA virtual IP address that
will be configured in this example (for details, see “Editing network interfaces” on page 123 )
• allowing HTTPS administrative access through their port1 network interfaces
according to Figure on page 185
Figure 93: Virtual IP address for HA failover
Local Em ail U sers
Em ail D om ain:
@ exam ple.com
Internal Em ail Server
172.16.1.10
Rem ote Em ail U sers
External
Em ail Server
Sw itch internal
172.16.1.1
w an1
10.10.10.1
Internet
182 port3
172.16.1.5
(H A virtual IP: 172.16.1.2)
Prim ary unit port1
192.168.1.5
virtual IP transfers upon failover
Sw itch
H eartbeat link port6
10.0.0.2
port6
10.0.0.4
Sw itch
D N S Server exam ple.com IN M X 10 fortim ail.exam ple.com
fortim ail.exam ple.com IN A 10.10.10.1
Adm inistrator port3
172.16.1.6
Backup unit port1
192.168.1.6
Active-passive H A group
G atew ay m ode
Protected D om ain:
@ exam ple.com
The active-passive HA group is located on a private network with email users and the protected email server. All are behind a FortiGate unit which separates the private network from the Internet. The DNS server, remote email users, and external SMTP servers are located on the Internet.
For both FortiMail units:
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA) port1 port3 port6
• connected to a switch which is connected only to the computer that the FortiMail administrator uses to manage the HA group
• administrative access occurs through this port
• connected to a switch which is connected to the private network and, indirectly, the Internet
• email connections occur through this port
• connected directly to each other using a crossover cable
• heartbeat and synchronization occurs through this port
The backup unit will become the new primary unit when a failover occurs. In order for it to be able to receive the connections formerly destined for the failed primary unit, the new primary unit must adopt the failed primary unit’s IP address. You will configure an HA virtual IP address on port3 for this purpose.
While the configured primary unit is functional, the HA virtual IP address is associated with its port3 network interface, which receives email connections. After a failover, the HA virtual IP address becomes associated with the new primary unit’s port3. As a result, after a failover, the new primary unit (originally the backup unit) will then receive and be able to process the email connections.
This example contains the following:
•
About standalone vs. HA deployment
•
Configuring the DNS and firewall settings
•
Configuring the primary unit for HA operation
•
Configuring the backup unit for HA operation
•
About standalone vs. HA deployment
If you will be converting a standalone FortiMail unit to a member of an HA group, you may find it useful to first understand the changes you need to make for HA deployment shown in Figure 93 on page 182 in the context of its similarities and differences with a standalone deployment.
First, examine the network interface configuration of a standalone FortiMail-400 unit in
Table 21 .
Table 21: Example standalone network interface configuration
Network interface port1 port2, port4 port3 port5 port6
IP address
192.168.1.5
Default
172.16.1.2
Default
Default
Description
Administrative connections to the FortiMail unit.
Not connected.
Email connections to the FortiMail unit; the target of your email
DNS A records. (No administrative access.)
Not connected.
Not connected.
Similarly, for the HA group, DNS A records should target the IP address of the port3 interface of the primary FortiMail-400 unit. Additionally, administrators should be able to administer each FortiMail unit in the HA group by connecting to the IP address of each
FortiMail unit’s port1.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
183
Using high availability (HA) System
If a failover occurs, the network must be able to direct traffic to port3 of the backup unit
without reconfiguring the DNS A record target. The backup unit must be able to cleanly, automatically substitute for the primary unit, as if they were a single, standalone unit.
Unlike the configuration of the standalone unit, for the HA group to accomplish that substitution, all email connections must use an IP address that transfers between the primary unit and the backup unit according to which one’s effective operating mode is currently master. This transferable IP address can be accomplished by configuring the HA group to either:
• set the IP address of the current primary unit’s network interface
• add a virtual IP address to the current primary unit’s network interface
In this example, the HA group uses the method of adding a virtual IP address. Email connections will not use the actual IP address of port3. Instead, all email connections will use only the virtual IP address 172.16.1.2, which is used by port3 of whichever FortiMail unit’s effective operating mode is currently master. During normal HA group operation, this
IP address resides on the primary unit. Conversely, after a failover occurs, this IP address resides on the former backup unit (now the current primary unit).
Also unlike the configuration of the standalone unit, both port5 and port6 are configured for each member of the HA group. The primary unit’s port5 is directly connected using a crossover cable to the backup unit’s port5; the primary unit’s port6 is directly connected to the backup unit’s port6. These links are used solely for heartbeat and synchronization traffic between members of the HA group.
For comparison with the standalone unit, examine the network configuration of the primary unit in Table 22 .
Table 22: Example primary unit HA network interface configuration
Interface IP/Netmask Virtual IP Address Description
Setting IP address port1 192.168.1.5 do nothing
Default do nothing
Administrative connections to this FortiMail unit. (Because the IP address does not follow the FortiMail unit whose effective mode is currently master, connections to this IP address are specific to this physical unit.
Administrators can still connect to this
FortiMail unit after failover, which may be useful for diagnostic purposes.)
Not connected.
port2, port4 port3 172.16.1.5
add virtual
IP/netmask port5 port6
10.0.1.2
10.0.0.2
do nothing do nothing
172.16.1.2
Email connections to the FortiMail unit; the target of your email DNS MX and A records.
Connections should not be destined for the actual IP address, but instead the virtual IP address (172.16.1.2) which follows the
FortiMail unit whose effective operating mode is master. No administrative access.
Secondary heartbeat and synchronization interface.
Primary heartbeat and synchronization interface.
Because the Virtual IP Address settings are synchronized between the primary and
backup units, you do not need to configure them separately on the backup unit. However, you must configure the backup unit with other settings listed in Table 23 .
184
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
Table 23: Example backup unit HA network interface configuration
Interface IP/Netmask Virtual IP Address Description
Setting IP address port1 port2, port4 port3
192.168.1.6 (synchronized from primary unit)
Default (synchronized from primary unit)
172.16.1.6
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
Administrative connections to this
FortiMail unit. (Because the IP address does not follow the FortiMail unit whose effective mode is currently master, connections to this IP address are specific to this physical unit.
Administrators can connect to this
FortiMail unit even when it is currently the backup unit, which may be useful for
HA configuration and log viewing.)
Not connected.
port5 port6
10.0.1.4
10.0.0.4
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
(synchronized from primary unit)
Connections should not be destined for the actual IP address, but instead the virtual IP address (172.16.1.2) which follows the FortiMail unit whose effective operating mode is master. As a result, no connections should be destined for this network interface until a failover occurs, causing the backup unit to become the new primary unit. No administrative access.
Secondary heartbeat and synchronization interface.
Primary heartbeat and synchronization interface.
Configuring the DNS and firewall settings
In the example shown in Figure 93 on page 182 , SMTP clients will connect to the virtual IP address of the primary unit. For SMTP clients on the Internet, this connection occurs through the public network virtual IP on the FortiGate unit, whose policies allow the connections and route them to the virtual IP on the current primary unit.
Because the FortiMail HA group is installed behind a firewall performing NAT, the DNS server hosting records for the domain example.com must be configured to reflect the public IP address of the FortiGate unit, rather than the private network IP address of the
HA group.
The DNS server has been configured with:
• an MX record to indicate that the FortiMail unit is the email gateway for example.com
• an A record to resolve fortimail.example.com into the FortiGate unit’s public IP address
• a reverse DNS record to enable external email servers to resolve the public IP address of the FortiGate unit into the domain name of the FortiMail unit
For more information on configuring the DNS records and firewalls, see the FortiMail
Install Guide .
Configuring the primary unit for HA operation
The following procedure describes how to prepare a FortiMail unit for HA operation as the primary unit according to Figure 93 on page 182 .
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
185
Using high availability (HA) System
Before beginning this procedure, verify that you have completed the required preparations described in
“Example: Active-passive HA group in gateway mode” on page 182
.
To configure the primary unit for HA operation
1 Connect to the web-based manager of the primary unit at https://192.168.1.5/admin.
2 Go to System > High Availability > Configuration.
3 Configure the following:
master wait for recovery then assume slave role change_me port6
10.0.0.2/255.255.255.0
enabled
10.0.0.4
port5
10.0.1.2/255.255.255.0
enabled
10.0.1.4
enabled disabled
HA base port 2000
15 seconds
Remote services as heartbeat disabled
port1 port2 port3 port4 port5 port6 do nothing do nothing add virtual IP/netmask
172.16.1.2/255.255.255.0
do nothing do nothing do nothing
4 Click Apply.
The FortiMail unit switches to active-passive HA mode, and, after determining that there is no other primary unit, sets its effective operating mode to master. The virtual IP
172.16.1.2 is added to port3; if not already complete, configure DNS records and firewalls to route email traffic to this virtual IP address, not the actual IP address of the
port3 network interface.
186
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Using high availability (HA)
5 To confirm that the FortiMail unit is acting as the primary unit, go to System >
High Availability > Status and compare the Configured Operating Mode and Effective
Operating Mode. Both should be master.
If the effective operating mode is not master, the FortiMail unit is not acting as the primary unit. Determine the cause of the failover, then restore the effective operating mode to that matching its configured operation mode.
Figure 94: Primary unit status
Configuring the backup unit for HA operation
The following procedure describes how to prepare a FortiMail unit for HA operation as the backup unit according to Figure 93 on page 182 .
Before beginning this procedure, verify that you have completed the required preparations described in
“Example: Active-passive HA group in gateway mode” on page 182
. Also verify that you have configured the primary unit as described in
“Configuring the primary unit for HA operation” on page 185 .
To configure the backup unit for HA operation
1 Connect to the web-based manager of the backup unit at https://192.168.1.6/admin.
2 Go to System > High Availability > Configuration.
3 Configure the following:
slave wait for recovery then restore slave role change_me port6
10.0.0.4/255.255.255.0
enabled
10.0.0.2
port5
10.0.1.4/255.255.255.0
enabled
10.0.1.2
enabled
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
187
Using high availability (HA) System
port2 port3 port4 port5 port6 disabled
HA base port 2000
15 seconds disabled Remote services as heartbeat
port1
(Configuration of the settings below will be synchronized from the primary unit, and are therefore not required to be configured on the backup unit.) do nothing do nothing add virtual IP/netmask
172.16.1.2/255.255.255.0
do nothing do nothing do nothing
4 Click Apply.
The FortiMail unit switches to active-passive HA mode, and, after determining that the primary unit is available, sets its effective operating mode to slave.
5 Go to System > High Availability > Status.
6 Select click HERE to start a configuration/data sync.
The backup unit synchronizes its configuration with the primary unit, including Virtual
IP Address settings that configure the HA virtual IP that the backup unit will adopt upon
failover.
7 To confirm that the FortiMail unit is acting as the backup unit, go to System >
High Availability > Status and compare the Configured Operating Mode and Effective
Operating Mode. Both should be slave.
If the effective operating mode is not slave, the FortiMail unit is not acting as the backup unit. Determine the cause of the failover, then restore the effective operating mode to that matching its configured operation mode.
Note: If the heartbeat interfaces are not connected, the backup unit cannot connect to the primary unit, and so the backup unit will operate as though the primary unit has failed and will switch its effective operating mode to master.
188
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Figure 95: Backup unit status page (backup unit not operating as a backup unit)
When both primary unit and the backup unit are operating in their configured mode, configuration of the active-passive HA group is complete. For information on managing
both members of the HA group, see “Administering an HA group” on page 189 .
Administering an HA group
In most cases, you will manage an HA group by connecting to the primary unit, as if it were a standalone unit.
Table 24: Management tasks performed on each HA group member
Connect to...
Primary unit
(192.168.1.5)
Backup unit
(192.168.1.6)
For...
• synchronized configuration items, such as antispam settings
• primary unit HA management tasks, such as viewing its effective operating
mode and configuring its Mode of operation and Shared password
• viewing the log messages of the primary unit
• backup unit HA management tasks, such as viewing its effective operating
mode and configuring its Mode of operation and Shared password
• viewing the log messages of the backup unit
If the initial configuration synchronization fails, such as if it is disrupted or the network cable is loose, you should manually trigger synchronization after changing the configuration of the primary unit. For information on manually triggering configuration synchronization, see
“click HERE to start a configuration/data sync” on page 166 .
Note: Some parts of the configuration are not synchronized, and must be configured separately on each member of the HA group. For details, see
“Configuration settings that are not synchronized” on page 160
.
Managing certificates
The Certificate submenu enables you to generate, import, revoke, and manage other aspects of certificates used by or with the FortiMail unit.
Note: In addition to managing various server certificates, you can also manage personal
This topic includes:
•
•
Managing certificate authority certificates
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
189
Managing certificates System
•
Managing the certificate revocation list
•
Managing OCSP server certificates
Managing local certificates
The Local Certificate tab displays certificate requests and installed local certificates. It also enables you to generate certificate requests, and to import signed certificates in order to install them for local use by the FortiMail unit.
FortiMail units require a local server certificate that it can present when clients request secure connections, including:
• the web-based manager (HTTPS connections only)
• webmail (HTTPS connections only)
• secure email, such as SMTPS, IMAPS, and POP3S
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view the list of certificates and certificate requests, go to System > Certificate >
Local Certificate.
Figure 96: Managing local certificates
View
Generate
Download
Set status
Import
Name
Click the row of a certificate in order to select it, then click this button to display its issuer, subject, and range of dates within which the certificate is valid.
.
Click the row of a certificate file or certificate request file in order to select it, then click this button and select either:
• Download: Download a certificate (.cer) or certificate request (.csr) file. You can send the request to your certificate authority (CA) to obtain a signed certificate
• Download PKCS12 File: Download a PKCS #12 (.p12) file. For details, see
“Downloading a PKCS #12 certificate” on page 195
.
Click the row of a certificate in order to select it, then click this button to use it as the
“default” (that is, currently chosen for use) certificate. The Status column changes to indicate that the certificate is the current (Default) certificate.
This button is not available if the selected certificate is already the “default.”
The name of the certificate file or certificate request file.
190
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Subject
Status
The Distinguished Name (DN) located in the Subject field of the certificate.
If the certificate has not yet been signed, this field is empty.
The status of the local certificate.
• Default: Indicates that the certificate was successfully imported, and is currently selected for use by the FortiMail unit.
• OK: Indicates that the certificate was successfully imported, but is not selected as the certificate currently in use. To use the certificate, click the row of the certificate in order to select it, then click Set status.
• Pending: Indicates that the certificate request has been generated, but must be downloaded, signed, and imported before it can be used as a local certificate.
Generating a certificate signing request
You can generate a certificate request file, based on the information you enter to identify the FortiMail unit. Certificate request files can then be submitted for verification and signing by a certificate authority (CA).
To generate a certificate request
1 Go to System > Certificate > Local Certificate.
2 Click Generate.
3 Configure the following:
Figure 97: Generating a certificate signing request
Certification name
Subject Information
Enter a unique name for the certificate request, such as fmlocal.
Information that the certificate is required to contain in order to uniquely identify the FortiMail unit.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
191
Managing certificates
192
System
ID type Select which type of identifier will be used in the certificate to identify the FortiMail unit:
• Host IP
• Domain Name
Which type you should select varies by whether or not your
FortiMail unit has a static IP address, a fully-qualified domain name (FQDN), and by the primary intended use of the certificate.
For example, if your FortiMail unit has both a static IP address and a domain name, but you will primarily use the local certificate for HTTPS connections to the web-based manager by the domain name of the FortiMail unit, you might prefer to generate a certificate based upon the domain name of the FortiMail unit, rather than its IP address.
• Host IP requires that the FortiMail unit have a static, public IP address. It may be preferable if clients will be accessing the
FortiMail unit primarily by its IP address.
• Domain Name requires that the FortiMail unit have a fullyqualified domain name (FQDN). It may be preferable if clients will be accessing the FortiMail unit primarily by its domain name.
• E-Mail does not require either a static IP address or a domain name. It may be preferable if the FortiMail unit does not have a domain name or public IP address.
IP Enter the static IP address of the FortiMail unit.
This option appears only if ID Type is Host IP.
Domain Name Type the fully-qualified domain name (FQDN) of the FortiMail unit.
The domain name may resolve to either a static or, if the FortiMail unit is configured to use a dynamic DNS service, a dynamic IP address. For more information, see
“Configuring the network interfaces” on page 121 and
“Configuring dynamic DNS” on page 130
.
If a domain name is not available and the FortiMail unit subscribes to a dynamic DNS service, an unable to verify certificate message may be displayed in the user’s browser whenever the public IP address of the FortiMail unit changes.
This option appears only if ID Type is Domain Name.
Optional Information
Type the email address of the owner of the FortiMail unit.
This option appears only if ID Type is E-Mail.
Information that you may include in the certificate, but which is not required.
Key Type
Key Size
Organization
Unit
Type the name of your organizational unit, such as the name of your department. (Optional.)
To enter more than one organizational unit name, click the + icon, and enter each organizational unit separately in each field.
Organization Type the legal name of your organization. (Optional.)
Locality(City) Type the name of the city or town where the FortiMail unit is located. (Optional.)
State/Province Type the name of the state or province where the FortiMail unit is located. (Optional.)
Country Select the name of the country where the FortiMail unit is located.
(Optional.)
E-mail Type an email address that may be used for contact purposes.
(Optional.)
The type of algorithm used to generate the key.
This option cannot be changed, but appears in order to indicate that only RSA is currently supported.
Select a security key size of 1024 Bit, 1536 Bit or 2048 Bit. Larger keys are slower to generate, but provide better security.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
4 Click OK.
The certificate is generated, and can be downloaded to your management computer for submission to a certificate authority (CA) for signing. For more information, see
“Downloading a certificate signing request” on page 193
.
Downloading a certificate signing request
After you have generated a certificate request, you can download the request file to your management computer in order to submit the request file to a certificate authority (CA) for signing.
To download and submit a certificate request
1 Go to System > Certificate > Local Certificate.
2 Click the row that corresponds to the certificate request in order to select it.
3 Click Download, then select Download.
Your web browser downloads the certificate request (.csr) file.
4 Submit the certificate request to your CA.
• Using the web browser on the management computer, browse to the web site for your CA.
• Follow your CA’s instructions to place a Base64-encoded PKCS #10 certificate request, uploading your certificate request.
• Follow your CA’s instructions to download their root certificate and Certificate
Revocation List (CRL), and then install the root certificate and CRL on each remote client. For details, see the documentation for each client.
5 When you receive the signed certificate from the CA, install the certificate on the
FortiMail unit. For more information, see
“Importing a certificate” on page 193
.
Importing a certificate
You can upload Base64-encoded certificates in either privacy-enhanced email (PEM) or public key cryptography standard #12 (PKCS #12) format from your management computer to the FortiMail unit.
Importing a certificate may be useful when:
• restoring a certificate backup
• installing a certificate that has been generated on another system
• installing a certificate, after the certificate request has been generated on the FortiMail unit and signed by a certificate authority (CA)
If you generated the certificate request using the FortiMail unit, after you submit the certificate request to CA, the CA will verify the information and register the contact information in a digital certificate that contains a serial number, an expiration date, and the public key of the CA. The CA will then sign the certificate and return it to you for installation on the FortiMail unit. To install the certificate, you must import it. For more information on
generating certificate requests, see “Generating a certificate signing request” on page 191
.
If the FortiMail unit’s local certificate is signed by an intermediate CA rather than a root
CA, before clients will trust the FortiMail unit’s local certificate, you must demonstrate a link with trusted root CAs, thereby proving that the FortiMail unit’s certificate is genuine.
You can demonstrate this chain of trust either by:
• installing each intermediate CA’s certificate in the client’s list of trusted CAs
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
193
Managing certificates System
• including a signing chain in the FortiMail unit’s local certificate
To include a signing chain, before importing the local certificate to the FortiMail unit, first open the FortiMail unit’s local certificate file in a plain text editor, append the certificate of each intermediate CA in order from the intermediate CA who signed the FortiMail unit’s certificate to the intermediate CA whose certificate was signed directly by a trusted root
CA, then save the certificate. For example, a local certificate which includes a signing chain might use the following structure:
-----BEGIN CERTIFICATE-----
<FortiMail unit’s local server certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 1, who signed the FortiMail certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 2, who signed the certificate of intermediate CA 1 and whose certificate was signed by a trusted root CA>
-----END CERTIFICATE-----
To import a local certificate
1 Go to System > Certificate > Local Certificate.
2 Click Import.
3 From Type, select the type of the import file or files:
• Local Certificate: The certificate is stored in a file (.pem) that does not require a password.
• PKCS12 Certificate: The certificate and private key are stored in a PKCS #12 (.p12) password-encrypted file.
• Certificate: The certificate file (.cert) and key file (.key) are stored separately. The private key is password-encrypted.
The remaining fields vary by your selection in Type.
4 Configure the following:
Figure 98: Uploading a local certificate (Local certificate)
Figure 99: Uploading a local certificate (PKCS12 certificate)
194
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System
Figure 100: Uploading a local certificate (Certificate)
Managing certificates
Certificate file
Key file
Password
Enter the location of the previously .cert or .pem exported certificate (or, for PKCS #12 certificates, the .p12 certificate-and-key file), or click
Browse to locate the file.
Enter the location of the previously exported key file, or click Browse to locate the file.
This option appears only when Type is Certificate.
Enter the password that was used to encrypt the file, enabling the
FortiMail unit to decrypt and install the certificate.
This option appears only when Type is PKCS12 certificate or Certificate.
5 Click OK.
Downloading a PKCS #12 certificate
You can export certificates from the FortiMail unit to a PKCS #12 file for secure download and import to another platform, or for backup purposes.
To download a PKCS #12 file
1 Go to System > Certificate > Local Certificate.
2 Click the row that corresponds to the certificate in order to select it.
3 Click Download, then select Download PKCS12 File.
4 In Password and Confirm password, enter the password that will be used to encrypt to exported certificate file. The password must be at least 4 characters long.
5 Click Download.
6 If your browser prompts you for a location to save the file, select a location.
Your web browser downloads the PKCS #12 (.p12) file. For information on importing a
PKCS #12 file, see
“Importing a certificate” on page 193
.
Managing certificate authority certificates
The CA Certificate tab enables you to view and import certificates for certificate authorities
(CA).
Certificate authorities validate and sign other certificates in order to indicate to third parties that those other certificates may be trusted to be authentic.
CA certificates are required by connections that use transport layer security (TLS), and by
S/MIME encryption. For more information, see
“Configuring TLS profiles” on page 370
and
“Configuring certificate bindings” on page 373
. Depending on the configuration of each
PKI user, CA certificates may also be required to authenticate PKI users. For more information, see
“Configuring PKI authentication” on page 248 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
195
Managing certificates
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of CA certificates, go to System > Certificate > CA Certificate.
Figure 101: Managing CA certificates
System
196
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the CA certificate (.cer).
Click to import a CA certificate.
The name of the CA certificate.
The Distinguished Name (DN) located in the Subject field of the certificate.
Managing the certificate revocation list
The Certificate Revocation List tab enables you to view and import certificate revocation lists.
To ensure that your FortiMail unit validates only certificates that have not been revoked, you should periodically upload a current certificate revocation list, which may be provided by certificate authorities (CA). Alternatively, you can use online certificate status protocol
(OCSP) to query for certificate statuses. For more information, see
“Managing OCSP server certificates” on page 197 .
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of remote certificates, go to System > Certificate > Certificate Revocation
List.
Figure 102: Managing certificate revocation lists
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the certificate revocation list (.cer).
Click to import a certificate revocation list.
The name of the certificate revocation list.
The Distinguished Name (DN) located in the Subject field of the certificate revocation list.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
System Managing certificates
Managing OCSP server certificates
The Remote tab enables you to view and import the certificates of the online certificate status protocol (OCSP) servers of your certificate authority (CA).
OCSP enables you to revoke or validate certificates by query, rather than by importing
.
Remote certificates are required if you enable OCSP for PKI users. For more information,
see “Configuring PKI authentication” on page 248
.
To be able to access this part of the web-based manager, your administrator account’s:
• Domain must be System
• access profile must have Read or Read-Write permission to the Others category
For details, see “About administrator account permissions & domains” on page 144 .
To view a the list of remote certificates, go to System > Certificate > Remote.
Figure 103: Managing OCSP server certificates
View
Download
Import
Name
Subject
Click the row of a certificate in order to select it, then click this button to display certificate details including the certificate name, issuer, subject, and the range of dates within which the certificate is valid.
Click the row of a certificate in order to select it, then click this button to download a copy of the OCSP server certificate (.cer).
Click to import an OCSP server certificate.
The name of the OCSP server certificate.
The Distinguished Name (DN) located in the Subject field of the certificate.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
197
Managing certificates System
198
FortiMail™ Secure Messaging Platform Version 4.0 Patch 2 Administration Guide
Revision 6 http://docs.fortinet.com/ • Feedback
دانلود
پیوند عمومی به روز شد
پیوند عمومی به چت شما به روز شده است. You may view and manage your chat links after registration here.
پیوند عمومی سند
تبلیغات