FORTIMAIL Gateway mode - Not seeing email traffic in FortiMail VM

Question

Good day,I am new to Fortinet, I am use to the Cisco product line and wish to expand my knowledge further, using Fortinet products way forward.Mode chosen: Gateway modeDeployment type: Forti mail in the DMZ or Behind the FortiGateCould someone kindly assist me step by step(probably u did for your environment/similar if possible) how to carefully deploy a Forti mail VM to manage and monitor my email traffic in Gateway mode. I have read via the 7.4.1 admin guide, other admin guides, watched a few YouTube videos and NO real guidance, step by step solution, not even a workable template based setup for Forti mail, just a bunch of webinars, chatting and simple setups(telling/referring you to go read this entire document(admin guide), no real lab scenarios at all. I have configured/setup and deployed many devices, network solutions in infrastructure environments/datacenters, some all by myself, others with help of comrades, video guides and straightforward - coherent reading material. But I am stuck here and need your guidance Network Environment Details but not limited to below(If you need more information, such as a simple network diagram of the intended setup, let me know):1. One(1) email/exchange server  behind the firewall/internal LAN e.g. 192.168.5.62. One(1) HW FortiGate Firewall  (with both WAN, LAN, DMZ interface etc. setup)3. 1 Private DNS server/PDC behind the firewall/on internal LAN e.g. 192.168.5.24. One(1) mail relay server(VM) running Postfix in the DMZ in front of FortiGate e.g. on diff subnet 192.168.70.35. A public/WAN IP address already mapped to the email relay VM internal IP6. Firewall Policies for SMTP traffic to flow between email server, mail relay and internet(incoming-outgoing) Intention: Is to replace the email relay VM(putting it offline) with the newly installed Forti mail VM in DMZ  for email traffic flow/ protection or keep Forti mail behind firewall and continue using email relay. What I have done so far:1. Registered Forti mail license and VM in Fortinet Asset management2. Downloaded Forti mail VM3. Configured/setup VM via Hyper V successfully.4. Started VM and deployed successfully5. Configured VM nic1 interface via CLI with IP e.g. 192.168.5.76. Ran/followed via wizard, entered protected domain, DNS, Mail server settings, Admin credentials etc. input gateway IP so that Forti mail can ping externally.7. Applied Fortinet registered license to Forti mail VM successfully8.Connected Forti mail to Forti guard successfully. Now for the concerns/queries:1. I watched this video and it provided no real help. How did he even achieve to get mail event logs/email traffic, what am i missing, i copied all his steps but using my network details/IPs of course) - https://www.youtube.com/watch?v=4AAWRrryzX0 2. I watched this video and it is not fully informative, just superficial - https://www.youtube.com/watch?v=jdemC9cGvdM 3.  I am confused about some details on this page - https://docs.fortinet.com/document/fortimail/7.4.1/administration-guide/932807/gateway-mode-deployment#install_4107377314_1049174Such as: You must configure public DNS records for the protected domains and for the Forti Mail unit itself  Configuring DNS records for the protected domains? Configuring the firewall policies for email traffic (incoming and outgoing) between the Forti mail, FortiGate and Email Server.I know about DNS records on AD, creating/configuring them etc. But it says in this document public DNS etc. I do not have a public DNS server in front of the firewall/on the internetI only have a private DNS server For .e.g. in my environment, I have a "Batteries. Local" domain on the Domain Controller/s, but our users at the batteries company uses the "batteries.com.au" domain from the Local Email Server. In the admin document it refers to protected domain, what should I enter for protected domain during Forti mail wizard setup the .local or the .com.au domain?Also which Host A record on my private DNS should i use for the Forti mail VM, a wan/public IP or local/Lan IP for the Forti mail?On the FortiGate I see the address entry for the following :1. Email Relay VM(DMZ IP)2. Email Server(local/private IP)3. DMZ subnet4. LAN/Internal Subnet On the FortiGate I see IPv4 Policy entries as follows but not limited to:1. (WAN to DMZ)allow smtp to relay - (source: all  ,  destination: mail relay  , schedule: always   ,   service: smtp    ,    action: accept)2. (DMZ to LAN)  - (source: all,     destination: local mail server ,   schedule: always,  service: smtp,  action: accept) Please note:-On my DC, there are no mx records, so how is name resolution taking place? There is only a Host A record for the Exchange server.-Whenever I do a NSLOOKUP or PING on mail.batteries.com.au, I see the public/wan mapped IP of the mail relay(postfix VM) that is on the DMZ- There are no FortiGate entries for the Forti Mail VM Currently, the deployed Forti mail VM is just sitting there doing nothing. Anyone, please help!

AEK · Accepted Answer

Hi NeoRantYou did very well by reading these docs, you'll certainly master FML very quickly. I see you are doing much effort, so I'll try help from my side with the below info.Here are some recommendations that may help, summarizing from beginning to the end.Set all required DNS mentioned in my previous post. This is required mostly for functioning and delivrability purpose, otherwise you will not receive e-mails and your e-mails will be considered as spam86400 seconds TTL is recommendedStandard: MX public DNS name should start with 'mx', 'smtp', or 'mail'. E.g.: mail1.domain.comExample of a good SPF record: "v=spf1 +mx +a -all". Do not use "~all", always use "-all"Having 2 MX records (with 2 FML) is better for redundancySet all required firewall rules mentioned above. Additionally it is good security practice (and to preserve you delivrability as well) to deny all internal network to send anything to outside through port 25 and 465 except FortiMail. This will ensure that nothing from inside will send spam to external mail servers leading to block-list your FML public IPCheck if your MX public IP is not block-listed (you may use mxtoolbox.com), and unblock-list it if required, otherwise your e-mails can be considered as spam by some serversWhen you deploy your VM use one single interface and put it in the DMZRun quick wizard in FMLSet hostname & domain name exactly like rDNS, otherwise you will be considered as spammer, e.g.: mail1.domain.comRelay type: HostSMTP server: local IP of your mail serverInbound email scan: EnableOutbound email scan: EnableEmail relay for protected domain: YesThe wizard creates the required policies (IP policy, Access Ctrl and Recipient Policy) with almost everything configured with the recommended values, so you'll have very few things to modifyAccess Control: Purpose of this is to avoid open relay except for mail server. That means only your mail server can send to any domain other than your domain.comIP Policy: Should manage only session profile. The other profile are managed at Recipient Policy level, except if you are ISP. The top-most rule (created by wizard) applies "Outbound-Session" to the e-mails that are sent from your mail server to outside. In case this rule was not created by wizard then you have to create itRecipient Policy: Manages the other profiles (AV, Antispam, ...) and is sender/recipient aware, not like IP policyYou may ask why we don't use only IP Policy, in short because IP policy is aware of source and destination IPs and not aware of sender/recipient, while Recipient Policy is aware of the opposite. If you are ISP and you host multiple domains but you don't know the hosted mail addresses then you will use only IP policy managing all profilesGood practice is to clone profile (AV, Antispam, ...) instead of modifying directly the default profiles. This is particularly useful when you need to know what are the default values (which are actually good and recommended values)Enable Advanced View in top-right menuConfigure NTP and check if it is working wellGo to System > Configuration > Option, and harden the admin password policyConfigure nominative administrators (security good practice)Log setting: 30 days is usually goodSome useful tuning in your custom Outbound_Session profile:Restrict number of connections per client per 30 mn: 2000Max concurrent connections per client: 30Connection idle timeout: 30Cap message size (KB): 30000Remove received headerRemove headers inserted by this unitSome useful tuning in your custom AS_Inbound profile:Enable FortiGuard scan, enable IP reputation, enable URL filter "Default"Enable SPF fail and soft failEnable Behavior AnalysisEnable HeuristicLeave others with default valuesSome useful tuning in your custom AS_Outbound profile:Enable FortiGuard scan, enable URL filter "Default"Enable Behavior AnalysisEnable HeuristicLeave all others disabled Other tuningGo to Security > Bounce Verification > Setting, and enable Bounce VerificationDo this in CLi:    config system mailserver        set timeout-connect 60        set timeout-greeting 120    endConfigure trusted_hosts in order to restrict access to admin console Once all of this is done, test both sending and receiving e-mails.Test the delivrability so you ensure that you are not considered as spammer:Open in your browser: www.mail-tester.comCopy the mail address displayed on the pageSend a test mail (well formed) to this mail address from your mailbox hosted on your mail serverClick the "Check your score" buttonIf your score is 10/10 then you are ok, otherwise check what is wrong with your score in the report and fix it then redo the test until you have 10/10I think all is said, but feel free to ask any related question if needed.

AEK · Answer

HelloAre you deploying FML just in lab for internal test and usage or for sending/receiving emails to/from internet?If it is for internal lab the required DNS entries should be on your local DNS .local.In cas it is for email communication with internet then the DNS records must be on your public DNS server. E.g: if your public domain name is domain.com and your public email address is neorant@domain.com then the protected domain is domain.com, and you need to add the following dns records to your public DNS server of domain.com.spf record: to allow your SMTP gateway's public address to send on behalf of domain.commx record: to indicate to other mail servers that the SMTP gateway of domain.com is e.g. mail.domain.comA record: mail.domain.com will resolve to your SMTP gateway 's public IP addressrDNS/PTR record: your SMTP gateway's public IP address will resolve to mail.domain.comYou may read more on mx, rdns/ptr and spf records on wiki or any other DNS related documentation.Regarding firewall rules, the main required rules are:Allow SMTP/SMTPs from FML to your mail server and vice versaAllow SMTP/SMTPs from FML to internetAllow SMTP/SMTPs from internet to FMLAllow DNS queries from FML to DNS serverAllow ports 443 and 53 to FortiGuard serviceHope this helps.

Sign up

Login with SSO

Login to the community

Login with SSO