Skip to main content
hlosin
New Member
November 6, 2019
Solved

[FortiMail] The mail message logs are showing the incorrect Client IP

Hi,

 

We have FortiMail in our setup which was installed by a 3rd party. In the message logs, the Client IP is showing our Router's private IP. Is there a setting in FortiMail to use the originating IP of the email?

 

Below are screenshots of the logs and a sample of one of the spam message headers.

 

Thank you,

 

 

 

 

abelio
abelioAnswer
SuperUser
November 7, 2019

Hello,

humm, that's a misconfiguration in the router; not directly related with fortimail.

You shouldn't see 192.168.20.1 as FEAS-CLIENT-IP header in such emails.

It is likely the router/firewall policy be NATting incoming traffic.

If your router is a FortiGate, check incoming firewall policy used to publish your fortimail. It shouldn't be NATted

 

 

2 replies

abelio
SuperUser
abelioAnswer
SuperUser
November 7, 2019

Hello,

humm, that's a misconfiguration in the router; not directly related with fortimail.

You shouldn't see 192.168.20.1 as FEAS-CLIENT-IP header in such emails.

It is likely the router/firewall policy be NATting incoming traffic.

If your router is a FortiGate, check incoming firewall policy used to publish your fortimail. It shouldn't be NATted

 

 

hlosin
hlosinAuthor
New Member
August 17, 2021

Thanks for that abelio. It was a router issue and has been sorted out.

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT