Skip to main content
dread
New Member
May 14, 2018
Question

SMTP Tracker

  • May 14, 2018
  • 2 replies
  • 5560 views

MOrning Team. 

I am new to this fortigate thing. Im using FTG300D. I have the following issues and i cannot have my Fortigate give me statistics. My fortigate is the last hop to the internet on a load balanced WAN links. My issues are as follows:

[ol]
  • Often both my public IPs are blacklisted because they feel there is a computer inside my LAN spamming. My thinking is that spam in most cases come out as SMTP service. I am failing to pin down that computer from my fortigate because forward reports are not easy to understand. Is there a way in which we can easily pick any computer that is spamming from my LAN. When i try to use filters to check SMTP, the service is not in the drop down list and it returns nothing.
  • Regards[/ol]
    • 2 replies

      Toshi_Esumi
      SuperUser
      SuperUser
      May 14, 2018

      I would just sniff traffic with port 25 and 587. If spamming is concerned, likely you would see many matches from specific sources within 5-10 min.

      Dave_Hall
      New Member
      May 14, 2018

      Create a simple firewall policy from lan to wan connection, set service to 25 (and ports 465, 587 if needed) - move this firewall rule up the firewall chain so it is triggered - note the Policy ID for this policy and use the Policy monitor to drill down to the sessions using this policy. 

       

      Alternately, on the CLI, you can try something like:

       

      diag sniffer packet any 'port 25' 4 0 a

       

      Press Control+C to stop.

      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
      Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!