Troubleshooting Tip: FortiMail Connector shown as down

Description

This article describes how to troubleshoot if the FortiMail connector shows as down under FortiAnalyzer v7.6, Incidents & Events -> Automation -> Active Connectors -> FortiMail Connector.

Scope

FortiAnalyzer and FortiMail.

Solution

Make sure the configuration is correctly configured as per below, where the credentials are the same as the user in FortiMail.

In FortiAnalyzer v7.6: Incidents & Events -> Automation -> Active Connectors -> FortiMail Connector -> Edit.

FortiMail: Domain & User -> User -> User Preference.

Run sniffer to ensure the connectivity between FortiAnalyzer and FortiMail:

diagnose sniffer packet any "host <FortiMail IP> and port 443" 4

Perform a debug as per the below command:

diagnose debug application fazsvcd 255
diagnose debug enable

Note: To get the debug output, proceed to click the Active Connectors.

Example output on the debug:

INFO - finding fml connector parameters [2026-04-29 15:14:41,595] {health_check:68} INFO - signing in fml [2026-04-29 15:14:41,595] {health_check:71} INFO - signing in fml at https:\/\/10.47.x.x\/api\/v1\/AdminLogin [2026-04-29 15:14:41,598] {faz_soar_utils:130} INFO - Creating connection to 10.47.x.x:443 for ADOM oid: 881 [2026-04-29 15:14:41,608] {health_check:79} ERROR - 403 Client Error: Forbidden for url: https:\/\/10.47.x.x\/api\/v1\/AdminLogin [2026-04-29 15:14:41,608] {health_check:107}

From the debug output, FortiAnalyzer is attempting to authenticate via API to FortiMail, but it is rejected and throws a 403 Client Error.

The 403 error is most related to the API user being either disabled, locked out, having incorrect credentials, the FortiMail server IP is not whitelisted in Trusted Hosts, or REST API Access is turned off on the account.

Proceed to check on FortiMail to enable the REST API configuration under System -> Configuration -> Web Service -> REST API -> Enabled.

Or configured on CLI:

config system web-service
set rest-api enable
end