Technical Tip: FortiOS and Microsoft Exchange Server deployment

[Jonathan_Body_FTNT]

Description

This article gives an example on how to deploy Microsoft Exchange Server's 2003/2007/2010 with FortiGate UTM protection.

Scope

FortiOS all versions.

Solution

Network Scenario:

• Microsoft Exchange Server deployed on the DMZ interface of the FortiGate.
• SMTP deployment.

Configuration (CLI):

1. Create a Virtual IP to map external to internal traffic towards the Microsoft Exchange server.

config firewall vip
    edit "VIP_SMTP"
        set extip 172.31.224.58
        set extintf "wan1"
        set mappedip 10.160.0.10
    next
end

2. Create the appropriate Firewall Policies to allow SMTP traffic.

config firewall policy
    edit 1
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ANY"
        set nat enable
    next

    edit 2
        set srcintf "dmz1"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "SMTP"
    next

    edit 3
        set srcintf "dmz1"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ANY"
        set nat enable
    next
end

3. Create appropriate UTM profiles to enable features such as DLP for logging, antivirus for checking attachments, and some IPS signatures specific for protecting the Microsoft Exchange Servers. More information on this subject can be found in the 'FortiOS v4.0 MR3 UTM Guide' (Page 195).

4. Apply the UTM profile(s), to the appropriate Firewall Policies as created in step 2.

It should be noted that there is no best practice in terms of deploying a Microsoft Exchange Server with the FortiGate. The basic configuration steps given above will protect the Exchange Server for incoming and outgoing SMTP traffic. However, certain IPS signatures within the UTM profile specific to Exchange will be required to optimize Real-Time protection.  For more advanced VIP scenarios, see the related article 'Technical Tip: Configuration example of Policy Based Routing and VIP for SMTP services in Dual Wan scenario'.

Related article:

Technical Tip: Configuration example of Policy Based Routing and VIP for SMTP services in Dual WAN s...