Skip to main content
A
Anonymous_User
Contributor III
February 17, 2010
Question

Alias and Groups Webmail Quarantine Issues

  • February 17, 2010
  • 16 replies
  • 7426 views
Hi All, I' m looking for some insight here as I' ve had my ticket opened with Fortinet Support for nearly 4 weeks and still haven' t found a resolution. The problem is that we have a lot of aliases and distribution groups in our Exchange environment. After moving to the Fortimail 400B, our users can only see the quarantined messages in their primary accounts when logging into their webmail. Messages that were caught in their alias accounts are not visible to them after logging in. When we configure " User Alias Options" in our LDAP profile we select Active Directory as our schema, add our base and bind dn' s, provide the bind password, and accept the remaining defaults. Page 333 of the Fortimail Admin Guide v4.0 Patch 1 states the following. " For some schemas, such as Microsoft ActiveDirectory-style schemas, this query will retrieve both the user’s primary email address and the user’s alias email addresses. If your schema style is different, you may want to also configure User Alias Options to resolve aliases." Page 336 " If you want to define a user alias query, enable User Alias Options, click the arrow to expand its options, and configure the query. Resolving aliases to real email addresses enables the FortiMail unit to send a single quarantine report and maintain a single quarantine mailbox at each user’s primary email account, rather than sending separate quarantine reports and maintaining separate quarantine mailboxes for each alias email address. For FortiMail units operating in server mode, this means that users need only log in to their primary account in order to manage their spam quarantine, rather than logging in to each alias account individually." Now my Fortimail is running in Gateway mode so does the above statement not apply? If it only works in Server mode, how do I get the Fortimail unit to display the quarantined message for my aliases in groups via webmail? Sorry for the long write up. Mike

    16 replies

    romanr
    romanr
    New Member
    February 17, 2010
    When we configure " User Alias Options" in our LDAP profile we select Active Directory as our schema
    I think I got working, what you want! The predefined AD Scheme from Fortinet didn' t wok for me! What I use is: Schema: User Defined Alias member attribute: mail Alias member query: (&(|(objectClass=User)(objectClass=Contact)(objectClass=Group)(objectClass=publicFolder)) (|(proxyAddresses=smtp:$m)(mail=$m))) Group member Attribute: member Group member query: (&(objectClass=group) (proxyAddresses=smtp:$m)) regards, Roman
    A
    Anonymous_UserAuthor
    Contributor III
    February 17, 2010
    Hi Roman, Thank you, I' ve modified my LDAP profile to match yours but it still does not seem to be working right. I' ve verified via ADSIedit that the proxyAddresses attribute contains my primary and alias SMTP accounts which makes your query string sound much more accurate than the Fortimail default. I' ve sent myself a test spam message to my alias mike@domain.com to trigger a quarantine. When I attempt to login via webmail with that alias it give me an invalid user error. So I log in with with my primary account (mikek@domain.com) and it takes it but my quarantine is blank. It seems that there are 2 separate quarantines (1 for my primary and 1 for my alias) and I have no way of viewing those items that get stuck in my alias. Thanks again for your help, this Fortimail is giving me headaches! Mike K.
    romanr
    romanr
    New Member
    February 17, 2010
    Hi Mike, what Fortimail Version do you use. I used this config quiet some time with V3 and now with V4 and don' t have a problem! Have you tried the " Test" option in the LDAP-profile section? What will alias-testing tell you there? To tell everything about LDAP config -> I also use a custom filter for user quering and I do not use the Fortimail default: " (&(|(objectClass=User)(objectClass=Contact)(objectClass=Group)(objectClass=publicFolder)) (|(proxyAddresses=smtp:$m)(mail=$m)))" cheers.roman
    A
    Anonymous_UserAuthor
    Contributor III
    February 17, 2010
    Fortimail 400B Firmware: v4.0,build0103,091223 (GA Patch 1) When I use the LDAP Query Test I receive strange results. Query type = User Both my primary and alias are found. Query type = Alias None of my accounts are found. Do you use a custom filter for your " User Query" options as well? My " User Query" is using the Fortinet Active Directory default. Thanks.
    romanr
    romanr
    New Member
    February 17, 2010
    Do you use a custom filter for your " User Query" options as well? My " User Query" is using the Fortinet Active Directory default.
    Yes! I just posted my filer in my last post! And I remember also light troubles getting this to run! I think I came across a situation, where I had to reboot the box before it worked! regards,roman
    A
    Anonymous_UserAuthor
    Contributor III
    February 17, 2010
    Strangely, my Fortinet default for " User Query Options" looks like our custom except for the (objectClass=Contact).
    romanr
    romanr
    New Member
    February 17, 2010
    ORIGINAL: mikek_cci Strangely, my Fortinet default for " User Query Options" looks like our custom except for the (objectClass=Contact).
    Yes, you will need this one for mails routed as external contacts! Otherwise your Fortimail wouldn' t accept them!
    A
    Anonymous_UserAuthor
    Contributor III
    February 17, 2010
    Ok, just so I' m clear on this the setup looks like this. User Query Options Schema: User Defined LDAP user query: (&(|(objectClass=User)(objectClass=Contact)(objectClass=Group)(objectClass=publicFolder)) (|(proxyAddresses=smtp:$m)(mail=$m))) User Alias Options Schema: User Defined Alias member attribute: mail Alias member query: LDAP user query: (&(|(objectClass=User)(objectClass=Contact)(objectClass=Group)(objectClass=publicFolder)) (|(proxyAddresses=smtp:$m)(mail=$m))) User group expansion in advance: *checked* Group member attribute: member Group member query: (&(objectClass=group)(proxyAddresses=smtp:$m))
    romanr
    romanr
    New Member
    February 17, 2010
    User group expansion in advance: *checked*
    Nearly, everything looks the same but, user group expansion is NOT checked... I remember this didn' t work!!
    A
    Anonymous_UserAuthor
    Contributor III
    February 17, 2010
    Hmm still doesn' t work. When I log in with my primary (mikek@domain.com) I don' t see the quarantined messages on my alias. Am I supposed to see it there? Or am I supposed to be able to log in with my alias (mike@domain.com.)
    romanr
    romanr
    New Member
    February 17, 2010
    Hm, I never tried this until now... No -> I need to login with my primary mail address -> but there I will have ALL my quarantined mails to all email-addresses and all my consolidated black/white information! But do your aliases resolve to your primary email-address in the profile testing section?
    A
    Anonymous_UserAuthor
    Contributor III
    February 18, 2010
    In the profile testing section... Query Type = Alias Mail address = mike@domain.com Result = Found mail alias mike@domain.com Query Type = Alias Mail address = mikek@domain.com Result = Found mail alias mike@domain.com
    A
    Anonymous_UserAuthor
    Contributor III
    February 18, 2010
    Hm, I never tried this until now... No -> I need to login with my primary mail address -> but there I will have ALL my quarantined mails to all email-addresses and all my consolidated black/white information!
    That' s what I want!! Haha. I' m going to delete my accounts on the Fortimail again and regenerate spam so that it quarantines in my alias again. Then I' ll log in as my primary to see if it' s all there.
    Show more replies
    Terms & ConditionsAccessibility statement