Skip to main content
maher
maher
New Member
December 26, 2016
Question

Mail traffic does not pass correctly via my FG100D

  • December 26, 2016
  • 2 replies
  • 8572 views

I just installed my Fortigate 100D in NAT mode, everything passes correctly except messaging traffic. I have my Exchange Server with the Modusgate antispam (in the same server) in my LAN. In Fortigate I created a policy for outbound messaging traffic by allowing all services from the Exchange server, I also created a policy for incoming traffic to the Exchange server and allowed smtp and https services. problem: All the emails I receive are blocked by my local Antispam, if I disconnect the Fortigate all come back correctly i normally receive emails. I even disable all security profiles in policy lan to wan and wan to lan, but the problem persists, I think the Fortigate makes modifications on my packets smtp that's why my Antispam considers them spam !! Please, how do I make the fortigate pass the email traffic without any modification. Is it necessary to create a NAT or Policy route to the Exchange server that is in my LAN or lets it only the Policy?

 

Regard,

    2 replies

    SCSIraidGURU
    SCSIraidGURU
    New Member
    December 27, 2016

    Did you configure virtual IP for all the ports of Exchange?   I use the Fortimail 200D.   The MX record traffic goes to the 200D first.  I changed the IP of the Exchange server by one.   The fortimail 200D forwards to the Exchange server.   How does SMTP route through your 100D to the Exchange server? 

    emnoc
    emnoc
    New Member
    December 27, 2016

    diag debug  flow is your  friend

     

     I have agreed to ensure that SNAT is disable, and monitor the origin ipv4-addr that's making the attempt to the mail-server 

     

    Ken

    maher
    maherAuthor
    New Member
    December 28, 2016

    Hi,

    zhunissov4, SC SlraidGURU, emnoc,

    Thank you for your answers The ISP sends all mail traffic to the WAN1 address of FG 172.16.1.2 FG WAN1 address: 172.16.1.2 / 24 FG LAN address: 112.112.112.1 / 24 Exchange Server Address 112.112.112.1 / 24 Address of the Antispam Modus gate 112.112.112.1 / 24 (in the same server with server exchange)

    In the FG, I created a VIP-based policy (without any security profile) to direct port 25 and 443 traffic to my exchange server Internal: VIP: 172.16.1.2> 112.112.112.1 port 25 VIP: 172.16.1.2> 112.112.112.1 port 443

    My Modusgate Antispam server puts all emails in the spam, and when I logged in Modus support, we found that the FG modifies the source address of the packets, In the normal case Modus must receive emails with the address of the sender of the mail as source address and not the address of the Fortigate.

    Unfortunately I can not do the tests right away because I disconnected the FG from the production, Please, in your opinion, disabling the NAT in the POLIcy will prevent the FG from modifying the source address of the packets ??

     

     

    Regard,

    maher
    maherAuthor
    New Member
    December 28, 2016

    Thank you very much zhunissov4,

    I will disable NAT and see what this gives...

     

     

     

    Regard,

    Terms & ConditionsAccessibility statement