Skip to main content
A
Anonymous_User
Contributor
September 21, 2009
Question

Firewall policy for mail server

  • September 21, 2009
  • 4 replies
  • 4726 views
Hi, Is it possible to create a firewall policy (or several policies) to do the following: 1. If the email message source IP detected as blacklisted IP then discard the message. 2. Else, tagged the message (Add header) so i can move the message to the Junk E-mail folder.

    4 replies

    laf
    laf
    New Member
    September 23, 2009
    Yep, it is. Just create two scanning profiles and add each to a firewall policy. Then order properly these two policies.
    A
    Anonymous_UserAuthor
    Contributor
    September 23, 2009
    Thanks laf! That' s interesting but fortigate 300A GUI allowed me to select only one protection profile for the specified firewall policy. Any idea?
    g3rman
    g3rman
    New Member
    September 23, 2009
    kobis, as laf said, you have to create multiple policy rules and apply the appropriate protection profile to each one.
    A
    Anonymous_UserAuthor
    Contributor
    September 23, 2009
    g3rman, Sorry but I missed something here. You mean that i need to create two firewall policies and two protection profiles. Then append each profile to each policy? But it is the same mail server, so if the first policy has the " Discard" option then every E-mail message will be catch and deleted by the first policy and it will never go to the next one, isn' t it? As far as I know, as soon as a session meets the first Allow or Deny policy, the Firewall does not looks for another policy. Am I right? Thank you guys for the help.
    g3rman
    g3rman
    New Member
    September 23, 2009
    Sorry, misread your original post. I' m not sure if the firewall is that sophisticated, that may require a Fortimail appliance.
    rwpatterson
    rwpatterson
    New Member
    September 24, 2009
    You scared me g3rman. I didn' t think it could do it either. I was waiting for some new information...
    abelio
    SuperUser
    abelio
    SuperUser
    September 24, 2009
    indeed, kobis' s proposal cannot be done if your incoming smtp traffic policy has ' all' as source address. Either with fortimail.
    A
    Anonymous_UserAuthor
    Contributor
    October 6, 2009
    Well it' s possible: Here how i did it: config spamfilter dnsbl edit 1 config entries edit 1 set action reject set server " bl.spamcop.net" next edit 2 set action reject set server " b.barracudacentral.org" next edit 3 set action reject set server " zen.spamhaus.org" next end set name " defined-rbl" next end config firewall profile edit " AV-AS" config log set log-av-block enable set log-av-oversize enable set log-av-virus enable set log-spam enable end set ftp splice unset http unset https set imap spamfssubmit set pop3 spamfssubmit set smtp scan spamfsip spamfschksum spamfsurl spamrbl splice set smtp-spamaction tag set smtp-spamtagtype header spaminfo set smtp-spamtagmsg " SPAM" set pop3-spamaction pass set imap-spamaction pass set spamrbltable 1 set nntp no-content-summary config app-recognition edit " http" set port 80 next edit " https" set port 443 next edit " smtp" set port 25 next edit " pop3" set port 110 next edit " imap" set port 143 next edit " nntp" set port 119 next edit " ftp" set port 21 next end unset im set comment " AV+As profile" set ftgd-wf-disable all next end The FG first check the dnsbl, if matched then discard the session and if not match it' s goes to the rest of the prtection profile and tagged the mail as SPAM if necessary...
    Terms & ConditionsAccessibility statement