Skip to main content
Yoda1
Yoda1
New Member
June 13, 2023
Question

Email filter with FortiOS 7.4

  • June 13, 2023
  • 6 replies
  • 10251 views

I am new to Fortigate, until now we used Sophos and Watchguard FWs and several products for Antispam.

 

A read a little about email filtering with 7.2 and now I installed the demo with 7.4 and I am wondering about the reduced ruleset in contrast to 7.2. The documentation says now:

 

FortiGuard-based filters

The FortiGate consults FortiGuard servers to help identify spammer IP address or emails, known phishing URLs, known spam URLs, known spam email checksums, and others. For more information, refer to the FortiGuard website.

There are five FortiGuard spam filtering options:

 

I miss the option to deny SPF failed mails, as well options to configure quarantine, allowed attachment types and so on. Beyond that, happens email filtering only on the local appliance or will some emails be uploaded to fortigate cloud services?

 

Is let's encrypt certificate autoenrollment for SMTP available?

 

Finally, is this product capable to filter company emails from spam with good results or should I consider another solution for professional email filtering?

 

Thank you

6 replies

Stephen_G
Moderator
Stephen_G
Moderator
June 16, 2023

Hello Yoda1,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Stephen_G - Fortinet Community Team
Yoda1
Yoda1Author
New Member
June 16, 2023

thank you.

 

I played around a little and it looks to me like that:

 

- when I use protecting ssl server, own or let's encrypt certificates should be possible

- proxy mode is fine, more features for email filtering

- but deep inspection does not work in proxy mode, only in flow mode while using starttls

- in order to protect email servers with email filtering, starttls is a must have

- using flow mode for smtp reduces filtering options drastically

 

Maybe I did something wrong? Or is this a limitation?

 

If yes, email filtering for us would make not much sense at all...

Stephen_G
Moderator
Stephen_G
Moderator
June 16, 2023

I'm afraid I can't personally answer the specifics of your networking requirements and FortiGate setup as this is not my area, but as far as I'm aware, FortiMail is probably a better fit for your intentions: https://www.fortinet.com/products/email-security. It's more specialized in email security than FortiGate, which is intended for use more as a general firewall.

 

FortiGate only supports SMTP and basic filtering, and is not an SMTP server that can evaluate email content - so chances are it can't do what you need as well as FortiMail could. However, maybe somebody else here can help you with the email filtering capabilities of FortiGate. Some changes may have been made in 7.4. I can't see much new in documentation, but I will ask around.

 

Hope that helps,

Stephen_G - Fortinet Community Team
Yoda1
Yoda1Author
New Member
June 16, 2023

Hi Stephen, i tried several options now, deep inspection with starttls and smtp 25 works obviously only in flow mode.

 

Fortinet offers the utp bundle for fortigate with email filtering and it costs extra. But what is it good for, when the main purpose, robust anti spam with incoming mail to the internal mail system is not working in proxy mode? No external mailserver will deliver mails over SMTPS, only with STARTTLS. Intrernal Clients would use SMTPS with external mail servers, but this is not the use case here. Protecting internal mail systems would be the key feature for buying the utp bundle.

 

Fortimail would be an option with extra costs. This is the reason in buying an UTM solution for smb customers, bundling services on one appliance saves money.

 

If a key feature won't work, it should not be offered. On the other hand, if this would be stated out clearly, I could have saved a lot of time.

Faiza_Emam_Delhi
Faiza_Emam_Delhi
Visitor III
June 16, 2023

Hello Yoda 1,

 

FortiGate's email filtering feature is a powerful tool that can effectively filter out spam and other unwanted emails from your company's email system. Here are answers to your questions:

 

1. Ruleset: FortiGate's email filtering feature in FortiOS 7.4 has a reduced ruleset compared to 7.2, but it still offers advanced protection against spam, phishing, and other email-based threats. You can enable the FortiGuard-based filters to block spammer IP addresses, phishing URLs, known spam URLs, known spam email checksums, and others. Additionally, you can create custom filters to block emails that match specific criteria, such as attachment types or specific words or phrases.

 

2. Email filtering: Email filtering happens on the local appliance, and no emails are uploaded to FortiGate cloud services. You can configure quarantine options to hold suspicious emails for review, and you can also configure allowed attachment types and other settings.

 

3. SPF failed mails: FortiGate's email filtering feature does not have an option to deny SPF failed mails out of the box, but you can create a custom filter to block emails that fail SPF checks.

 

4. Let's Encrypt certificate: Yes, FortiGate supports auto-enrollment for SMTP with Let's Encrypt certificates.

 

5. Results: FortiGate's email filtering feature can effectively filter out spam and other unwanted emails from your company's email system. However, as with any email filtering solution, there is no guarantee that 100% of unwanted emails will be blocked. It's always a good idea to have multiple layers of protection, such as antivirus software, to ensure the highest level of protection.

 

I hope this helps! Let me know if you have any further questions.

    Yoda1
    Yoda1Author
    New Member
    June 16, 2023

    as I explained above, this all works only with unenrypted incoming email traffic. If you want deep inspection of incoming mail with STARTTLS (above 99% of all incoming transfers), you have to choose to flow mode, proxy mode with the full anti spam options (and these are the important key functions in 7.4) just won't work, mails are running just plain through to the email server behind the fortigate.

     

    As long as I did nothing wrong, but all tutorials and documentation I found, did not help. So to summarize it:

     

    - flow mode: just no real antipam options, but working with STARTTLS and inspection is possible (but with simply no meaningful antispam options)

     

    - proxy mode: works like a charm, but only with unencrypted incoming email <1% of all incoming mail would be inspected this way

     

    I tested forth and back and tried dozens of combinations, same result in all cases.

     

    gfleming
    Staff
    gfleming
    Staff
    June 21, 2023

    Hi Yoda1. It seems odd that proxy mode is not working while flow is. There is no reason as far as I'm concerned for proxy mode to break anything here.

     

    I would suggest contacting TAC to figure out if you are hitting a bug or some other configuration issue. It does sound like you are doing everything right, however. Note that 7.4 is a very new release (couple months old) and will have lots of bugs still. Mature release right now is 7.0.x which would be recommended for production use unless you need specific features only found in 7.2.x or 7.4.x.

     

    To note, the FortiGate is first and foremost a NGFW. Yes it has lots of other features packed into it like WAF and email filter. However these are basic when compared to full-fledged appliances. For instance the email filter is really only there to detect and block spam (hence "antispam" fortiguard service). It's not meant to be a full-on email security gateway (SPF checks, quarantine, content inspection, etc).

     

    If it fits your needs then absolutely let's keep trying to get the FortiGate working in proxy mode for you. TAC is your best bet at this point, IMO.

     

    If you'd like to, you are welcome to post the configurations of your mail filter profiles, firewall policies, certificates, etc and we can look here but again TAC will give best response.

    Yoda1
    Yoda1Author
    New Member
    June 22, 2023

    Thank you all for the replies. As I learned, Starttls with proxy mode would never work with 7.4 neither with 7.2. I should rely on 7.0 (did not verified it)

     

    I didn't expect this and also found no hint to this topic so far;-)

    How should one newcomer???

     

    So how long 7.0 would be supported?

     

    gfleming
    Staff
    gfleming
    Staff
    June 22, 2023

    Where did you learn that 7.0 will work and 7.2 and 7.4 won't work? That doesn't seem right to me...

     

    Have you spoken to TAC yet?

     

    You can review the LifeCycle document for support dates: https://support.fortinet.com/Information/ProductLifeCycle.aspx

    phillipevans
    phillipevans
    New Member
    January 25, 2024

    While there have been changes in the ruleset compared to 7.2, FortiGate's FortiGuard-based filters are quite effective in identifying spammer IP addresses, phishing URLs, and known spam. However, I understand your concern about missing options like SPF failed mail denial and attachment type configuration.
    To address these specific needs, you might want to consider using external tools like mail tester to complement FortiGate's filtering. MailTester can help you check SPF records and validate email addresses, adding an extra layer of email security.

    Terms & ConditionsAccessibility statement