Skip to main content
oholecek_FTNT
Staff
oholecek_FTNT
Staff
March 29, 2013

Technical Tip: Configuring email message relaying on the FortiMail system

  • March 29, 2013
  • 0 replies
  • 27975 views

Description

 

This article describes that in the context of an email message delivery, 'relaying' refers to the operation when an email message is being sent to a destination that is not 'local' (Gmail, Yahoo, another company, etc.).

By default, the FortiMail unit does not accept emails for any other domain than is locally configured (see the 'Mail Settings -> Domains' menu). Otherwise, SPAM senders would be able to abuse this functionality, to send unsolicited emails without the approval of the FortiMail unit owner.

Scope

 

FortiMail all versions.


Solution

 
Frequently, the company needs to allow its internal users to send emails to any remote server.
 
There are two ways to achieve this on a FortiMail system:
  1. Create an Access Control policy to specify the IP address and/or email addresses that are allowed to relay emails.
  2. Allow relaying from authenticated users.

Solution 1: Create an Access Control policy.
 
In the web admin GUI, navigate to the Policy -> Access control menu, create a new 'Receiving Policy', and modify the following fields:
  • Sender pattern: Internal.
  • Recipient pattern: External.
  • Source: IP address of the Mail Server or the trusted network.
  • Action: RELAY.
 

Note: It is possible to configure different options for the source IP address as required: see Configuring access control receiving policies.

 

Policy_list.JPG

 

With this policy in place, the FortiMail unit accepts and relays all email messages sent by users from the specified internal network (10.172.198.228/32 in this example), provided the sender belongs to the protected domain
 
Solution 2: Allow relaying from authenticated users.
 
When an authentication profile is created and used in the Policies -> Policies IP Policies or Policies -> Policies -> Recipient Policies menu, all users who can successfully authenticate will be able to send any email message. For authentication to work properly, there needs to be a backend server in the internal network that can verify provided usernames and passwords. In this simple example, an SMTP authentication is used.

To create an authentication profile, verified by the internal SMTP server, in the web admin GUI, navigate to the Profile -> Authentication menu, and enter the new profile as follows:
  • Profile name: Choose the name of the new profile.
  • Server name/IP: Fill in the IP address of the internal SMTP server that supports SMTP authentication.
  • Depending on the authentication server, it may be worth configuring options like Server, which requires a domain, and STARTTLS.

 

image (3).png

 

Then, apply this profile in the Policies -> Policies -> IP Policies or Policies -> Policies -> Recipient Policies menu, and enable the 'Use for SMTP authentication' checkbox.

 

From now on, every user whose credentials are verified by the internal SMTP server can send any email.

 

image (4).png

    Terms & ConditionsAccessibility statement