Block Traffic from IP address range for port 25

Welcome to the forums. Basically, since the default action of any Fortigate is to block, simply allow port 25 to the IP range for those Postini servers. Create an address entity with the IP range (xxx.xxx.xxx.[starting number-ending number]). Create a second entity for your Exchange server. If the mail is outbound, create a policy allowing traffic from the Exchange server to the Postini server range, and select SMTP for the service. A caveat here. FGT processes policies from the top of the list to the bottom, so place the more restrictive policies at the top of the list, and the more general near the bottom. If the service is inbound, you' ll need to create a Virtual IP for the Exchange server, because the FGT will need to know what outside IP will point to the server. Go to Firewall - Virtual IP - Create New. Here select the external IP address, the internal server address, and set the port to 25. If you do not select a port here, all traffic for that IP address will now be pointed to your Exchange server. Not good. Makes troubleshooting a real pain later. Then just as above, create the policy, source all, destination that VIP rule just created, and service again 25. Good luck.

Thanks for the quick reply. I just want to make sure I' m doing this right. I' m configuring inbound traffic now. Can I do the following: Under Firewall>Address, I created an IP range for the Postini servers (named " Postini" ) and also for our internal exchange server (named " Exchange" ). The interface is set to " Any" . Under Firewall>Policy, I have inserted a new policy using " Postini" as the Source Address Name, " Exchange" as the Destination Address Name, the service is set to " SMTP" , and the Action is set to " ACCEPT" . This policy has been inserted above the existing policy routing traffic to our mail server. Regarding your comments configuring the inbound service: Under Firewall>Virtual IP, I find that I cannot enter a range for the External IP Address/Range when trying to create a new Virtual IP. I can only enter a single IP address. I not sure why. Thanks again. --- Will

Ah. My mistake. I was so focused on the IP addresses of the Postini servers that I forgot about the role that our IP addresses played. It makes sense now. Anyway, I already have a Virtual IP setup for my exchange servers so that I got an message that an duplicate exists already. So would the following work: I created an IP range for the Postini servers (named " Postini" ) and also for our internal exchange server (named " Exchange" ). The interface is set to " Any" . Under Firewall>Policy, I have inserted the new policy using " Postini" as the Source Address Name, " Exchange" as the Destination Address Name, the service is set to " SMTP" , and the Action is set to " ACCEPT" . This policy has been inserted above the existing policy routing traffic to our mail server. Thanks.