Alias and Groups Webmail Quarantine Issues

[#1]

Hi All, I' m looking for some insight here as I' ve had my ticket opened with Fortinet Support for nearly 4 weeks and still haven' t found a resolution. The problem is that we have a lot of aliases and distribution groups in our Exchange environment. After moving to the Fortimail 400B, our users can only see the quarantined messages in their primary accounts when logging into their webmail. Messages that were caught in their alias accounts are not visible to them after logging in. When we configure " User Alias Options" in our LDAP profile we select Active Directory as our schema, add our base and bind dn' s, provide the bind password, and accept the remaining defaults. Page 333 of the Fortimail Admin Guide v4.0 Patch 1 states the following. " For some schemas, such as Microsoft ActiveDirectory-style schemas, this query will retrieve both the user’s primary email address and the user’s alias email addresses. If your schema style is different, you may want to also configure User Alias Options to resolve aliases." Page 336 " If you want to define a user alias query, enable User Alias Options, click the arrow to expand its options, and configure the query. Resolving aliases to real email addresses enables the FortiMail unit to send a single quarantine report and maintain a single quarantine mailbox at each user’s primary email account, rather than sending separate quarantine reports and maintaining separate quarantine mailboxes for each alias email address. For FortiMail units operating in server mode, this means that users need only log in to their primary account in order to manage their spam quarantine, rather than logging in to each alias account individually." Now my Fortimail is running in Gateway mode so does the above statement not apply? If it only works in Server mode, how do I get the Fortimail unit to display the quarantined message for my aliases in groups via webmail? Sorry for the long write up. Mike

[#2]

Hmm still doesn' t work. When I log in with my primary (mikek@domain.com) I don' t see the quarantined messages on my alias. Am I supposed to see it there? Or am I supposed to be able to log in with my alias (mike@domain.com.)

[romanr]

Hm, I never tried this until now... No -> I need to login with my primary mail address -> but there I will have ALL my quarantined mails to all email-addresses and all my consolidated black/white information! But do your aliases resolve to your primary email-address in the profile testing section?

[#4]

In the profile testing section... Query Type = Alias Mail address = mike@domain.com Result = Found mail alias mike@domain.com Query Type = Alias Mail address = mikek@domain.com Result = Found mail alias mike@domain.com

[#5]

Hm, I never tried this until now... No -> I need to login with my primary mail address -> but there I will have ALL my quarantined mails to all email-addresses and all my consolidated black/white information!

That' s what I want!! Haha. I' m going to delete my accounts on the Fortimail again and regenerate spam so that it quarantines in my alias again. Then I' ll log in as my primary to see if it' s all there.

[#6]

Still no luck. For some reason I am just unable to view the quarantined messages in my alias...

[romanr]

Still no luck. For some reason I am just unable to view the quarantined messages in my alias...

Is your alias within the same domain&policy configuration?

[#8]

Is your alias within the same domain&policy configuration?

Sorry, I' m not sure what you mean.

[#9]

After some additional testing, it appears that using the query options recommended by romanr do in fact work and keeps a central quarantine area for both the primary and alias smtp accounts ONLY IF the UPN matches the primary SMTP attributes. This really sucks because we have many users who' s UPN and primary SMTP accounts do not match. Here' s a hypothetical user as an example. First name: Mike Last name: Fort Login/UPN: mike.fort@domain.com Primary SMTP: mike@domain.com Alias SMTP: mikef@domain.com, mike.fort@domain.com, mfort@domain.com. Now being that Mike' s primary SMTP is mike@domain.com, this is where the bulk of quarantined messages on the Fortimail will reside. Unfortunately, Mike can only authenticate to the Fortimail Webmail' s interface using his UPN (mike.fort@domain.com). Once Mike logs in, he sees an empty quarantine inbox because all of his messages are stuck in mike@domain.com. There is no way for Mike to view these messages because mike@domain.com is not a valid UPN which the Fortimail uses for authentication. One tedious work around I did find was to add the primary SMTP (mike@domain.com) as a secondary account to (mike.fort@domain.com) via the admin web console. Having this method allows the user to pull a drop down in webmail that displays separate quarantined inboxes. Does anyone else have any experience with this? Am I missing something here?

[lmuir]

I' ve just been hit with this problem too. Any ideas on an more scalable workaround?

[#11]

hi lmuir. we' re making progress with Fortinet support. I will update this post again if we we find a viable solution. If no solution is found, we are going to resort to mapping user aliases manually.