Blocked port 25 on fortigate 60c

[oberguru]

Hello to all members

I have big problem with fortigate blocking port 25 I hope that someone will me able to help me. Since mail service is crucial for our company this is big problem for me.

I have mail server which s on interface 4 (basically DMZ interface) with let say address 10.10.10.1. VIP group is created and contains port forwarding for all necessary services for mail server SMTP(25), SMTPS(465), POP3S(995), IMAPS(993), NNTPS(563), HTTPS(443). Users are on interface 1.

Policy are in place

internal1 -->internal4

internal1 --> WAN2

internal4 -->WAN2

WAN2 --> internal4

set srcintf "wan2"         set dstintf "internal4"         set srcaddr "all"         set dstaddr "msgroupvip"         set action accept         set schedule "always"         set service "ALL"         set logtraffic all

where msgroupvip is VIP group containing fort forwarding for all necessary service.

Problem is with fortigate unit block port 25 (SMTP) from my external address (WAN 2 interface) to local interface - Mail server (Internal 4 interface), Because of that my company is unable to receive any email from external address for past two days. We are able to send email outside and receive and send emails within company internally (Local traffic) . Same issue happens about month ago. Problem resolved itself without my intervention. I was unable to determine what cause this problem. Yesterday problem arise again. Again port 25 on fortigate is blocked. All other port on VIP who forward traffic to mail server works without problem. All forwarded ports (SMTPS, HTTPS, NNTPS, IMAPS, POP3S) works as they should and only SMTP port is blocked. UTM feature is disabled. As far I know no attack is detected on our network and every other service works as they should except blocked port 25. Folowing instruction in some other post I even recreated VIP port forwarding for all port  again with no results. I even recreated a policy rule for WAN2 --> Internal4 policy with CLI with no result.

Firmware version is v5.0,build0305 (GA Patch 10). While we where on firmware 4.0 MR3 we never experienced this problem.

Sorry for the long post but I try to explain problem in detail.

[Dave_Hall]

Can you post a screenshot of the VIP for the port 25 forward?

[oberguru]

Hello

Thank you for your response.

External address has been changed.

[ede_pfau]

hello Oberguru,

could you please clarify: at the moment you have an isolated policy for port 25 alone, with the VIP as posted? If not, I would recommend to isolate this particular traffic from the other (xxxS, IMAP, POP3) as the latter is OK.

Then you can make use of some diagnostics. First, configure the policy table display to include the "Count" field. This shows roughly that the policy is hit at all (> 0 bytes). You can reset the count at any time by right clicking and choosing the option to do so in the context menu.

Next, are you familiar with the CLI? Get a command line to the FGT either using the Console widget (detach it if you like), or by using an ssh client (Putty or whatever) to the internal1 interface (well, depending where your PC is connected to, it really doesn't matter much). The ssh client allows you to open a number of command lines, each showing different traffic or being used for command input.

In the CLI, let's see if SMTP is coming in and where it is routed to:

diag deb ena

diag sniffer packet any 'port 25' 4 0 a If you generate an SMTP request you should see traffic coming in on one interface and being routed to internal4. Post the screen output if possible (not as a picture, just copy the text from the CLI).

To generate SMTP traffic (fake traffic) you can enter

telnet <IP of mailserver> 25

You should at least see a 'HELO' if you can reach the mailserver at all.

Next step would be to follow the packet flow through the interfaces, routing and policy. That's what 'diag deb flow' is for. You can get many (many many) examples of it's usage from the forums (search for 'flow' or just for 'emnoc' :-))

Post the output from this, it will clearly show where the traffic stops and why.

I always wonder who installed the FGT in your company, and left you in the ditch - the Fortinet dealer should be at your side in a situation like this. At least this is how I understand my relation with my customers. For a professional this should be solvable in a matter of hours, not days.

[oberguru]

Hello

Thank you ede_pfau for your quick response.

Beleive or not, this fortinet equipment was bought by my predecessors in company and dealer was just deliver this equipment without any installation whatsoever. Upon my arrival in company we did some reconstruction in IT infrastructure and this equipment is used for that. I did all configuration (we have pretty big network system), and even i can say that I am fairly experienced I never before dealt with fortinet equipment and this is first major problem that I have. .

OK, now back to problem. All VIP for particular port forwarding are grouped in one group (msgroupvip).and then associated with policy WAN2 --> internal4.

I will isolate policy only for SMTP VIP and do diagnostic as stated in your post. After that result will be posted. (I can handle CLI so that should't be problem)

Just to clarify things, local delivery (sending and receiving) of mail is ok and port 25 is accessible on local network. Problem exist only when

mail is sent from outside. (Mail server is on private subnet)

[oberguru]

Hello

as ede_pfau suggested two separete policy are created.

1. WAN2 ---> internal4

Incoming interface: WAN2

Source address: all

Outgoing interface: internal4 (Mail server)

Destination address: vipsmtp ---> VIP for SMTP port forwarding

Schedule: always

Service : ALL

2. WAN2 --->internal4

Incoming interface: WAN2

Source address: all

Outgoing interface: internal4 (Mail server)

Destination address: msgroupvip ---> VIP group for all other service port forwarding

Schedule: always

Service : ALL

As I can see Traffic doesn't hit policy 1 with SMTP and Count is always 0 on that policy.  all other policy are ok and have traffic.

Result for

diag deb ena diag sniffer packet any 'port 25' 4 0 a.

When I do telnet <public address:25> nothing happend (telnet from outside)

When I do telnet <private address:25> partial output is

d=13 trace_id=20 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:16552->192.168.210.2:25) from Roaming_0. flag , seq 2995053520, ack 0, win 8192"
id=13 trace_id=20 func=init_ip_session_common line=4467 msg="allocate a new session-0005d2e8"
id=13 trace_id=20 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.210.2 via internal4"
id=13 trace_id=20 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=21 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:16552) from internal4. flag [S.], seq 2802949049, ack 2995053521, win 14600"
id=13 trace_id=21 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005d2e8, reply direction"
id=13 trace_id=21 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=21 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-Roaming_0"
id=13 trace_id=21 func=esp_output4 line=885 msg="encrypting, and send to xx.xx.xx.xxx with source xx.xx.xx.xxx"
id=13 trace_id=21 func=ipsec_output_finish line=231 msg="send to xx.xx.xx.xxx via intf-wan2"
id=13 trace_id=22 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:16552->192.168.210.2:25) from Roaming_0. flag [.], seq 2995053521, ack 2802949050, win 260"

Result for

diag debug flow filter addr x.x.x.x diag debug flow filter proto 6 diag debug flow filter port 25 diag debug flow show console enable diag debug flow trace start 1000 diag debug enable

When I do telnet <public address:25> nothing happend (telnet from outside)

When I do telnet <private address:25> partial output is

id=13 trace_id=58 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:17924->192.168.210.2:25) from Roaming_0. flag , seq 714046965, ack 0, win 8192"
id=13 trace_id=58 func=init_ip_session_common line=4467 msg="allocate a new session-0005f7de"
id=13 trace_id=58 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.210.2 via internal4"
id=13 trace_id=58 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=59 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:17924) from internal4. flag [S.], seq 4075275284, ack 714046966, win 14600"
id=13 trace_id=59 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005f7de, reply direction"
id=13 trace_id=59 func=vf_ip4_route_input line=1600 msg="find a route: flags=00000000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=59 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-Roaming_0"
id=13 trace_id=59 func=esp_output4 line=885 msg="encrypting, and send to xxx.xxx.xxx.xxx with source xxx.xxx.xxx.xxx"
id=13 trace_id=59 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx via intf-wan2"
id=13 trace_id=60 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.2.40:17924->192.168.210.2:25) from Roaming_0. flag [.], seq 714046966, ack 4075275285, win 260"
id=13 trace_id=60 func=resolve_ip_tuple_fast line=4370 msg="Find an existing session, id-0005f7de, original direction"
id=13 trace_id=61 func=print_pkt_detail line=4311 msg="vd-root received a packet(proto=6, 192.168.210.2:25->192.168.2.40:17924) from internal4. flag [.], seq 4075275285, ack 714046966, win 115"

I will be very grateful if someone can help me with this weird problem.

[ede_pfau]

So you say that from internal1 -> internal4, using a different VIP, you have no problem with SMTP? Only the VIP used on the WAN port does not work?

Besides: would your mailserver respond to the alternative SMTP port as well (587 I think, or was it 465?)? So we could vary the VIP to do port translation in addition to address translation.

In the (far, far) back of my mind I have the suspicion that there once was a problem reported in the forums in which a VIP group was involved, where traffic was blocked when serviced by a VIP group but not when crossing a single VIP.

We'll see.

[ede_pfau]

Could you please post the sniffer output? You've posted the flow trace twice.

How did you contact the mailserver exactly via telnet?

[oberguru]

I am sorry for that mistake.

Regarding your question:

So you say that from internal1 -> internal4, using a different VIP, you have no problem with SMTP? Only the VIP used on the WAN port does not work?

Yes I have problem only with VIP on the WAN port

After activating

diag deb ena diag sniffer packet any 'port 25' 4 0 a

i do

telnet <xxx.xxx.xxx.xxx> 25 -----> Where xxx.... is fortinet public address . Telnet is done from computer outside company network

telnet 192.168.210.2 25 -----> Where 192... is mail server address on local network (private address). TElnet is done from company network.

Here is the sniffer output:

interfaces=[any]
filters=[port 25]
id=13 trace_id=69 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag , seq 23 21302015, ack 0, win 8192"
id=13 trace_id=69 func=init_ip_session_common line=4467 msg="allocate a new sess ion-00064870"
id=13 trace_id=69 func=vf_ip4_route_input line=1600 msg="find a route: flags=000 00000 gw-192.168.210.2 via internal4"
id=13 trace_id=69 func=fw_forward_handler line=685 msg="Allowed by Policy-20:"
id=13 trace_id=70 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [S.], seq 1 533851659, ack 2321302016, win 14600"
id=13 trace_id=70 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=70 func=vf_ip4_route_input line=1600 msg="find a route: flags=000 00000 gw-192.168.2.40 via Roaming_0"
id=13 trace_id=70 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=70 func=esp_output4 line=885 msg="encrypting, and send to 109.163 .164.237 with source xxx.xxx.xxx.xxx"
id=13 trace_id=70 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.387142 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: syn 2321302015
2015-02-07 22:39:54.387647 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: syn 2321302015
2015-02-07 22:39:54.387824 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: syn 1533851659 ack 2321302016
2015-02-07 22:39:54.388109 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: syn 1533851659 ack 2321302016
id=13 trace_id=71 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851660, win 260"
id=13 trace_id=71 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
id=13 trace_id=72 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [.], seq 15 33851660, ack 2321302016, win 115"
id=13 trace_id=72 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=72 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=72 func=esp_output4 line=885 msg="encrypting, and send to 109.163 .164.237 with source xxx.xxx.xxx.xxx"
id=13 trace_id=72 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.455099 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851660
2015-02-07 22:39:54.455382 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851660
2015-02-07 22:39:54.455787 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
2015-02-07 22:39:54.455984 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
id=13 trace_id=73 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.210.2:25->192.168.2.40:22356) from internal4. flag [.], seq 15 33851660, ack 2321302016, win 115"
id=13 trace_id=73 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, reply direction"
id=13 trace_id=73 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interf ace-Roaming_0"
id=13 trace_id=73 func=esp_output4 line=885 msg="encrypting, and send to xxx.xxx.xxx.xxx with source xxx.xxx.xxx.xxx"
id=13 trace_id=73 func=ipsec_output_finish line=231 msg="send to xxx.xxx.xxx.xxx v ia intf-wan2"
2015-02-07 22:39:54.723772 internal4 in 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
2015-02-07 22:39:54.723980 Roaming_0 out 192.168.210.2.25 -> 192.168.2.40.22356: psh 1533851660 ack 2321302016
id=13 trace_id=74 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851700, win 260"
id=13 trace_id=74 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
2015-02-07 22:39:54.762732 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700
2015-02-07 22:39:54.762969 internal4 out 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700
id=13 trace_id=75 func=print_pkt_detail line=4311 msg="vd-root received a packet (proto=6, 192.168.2.40:22356->192.168.210.2:25) from Roaming_0. flag [.], seq 23 21302016, ack 1533851700, win 260"
id=13 trace_id=75 func=resolve_ip_tuple_fast line=4370 msg="Find an existing ses sion, id-00064870, original direction"
2015-02-07 22:39:54.806487 Roaming_0 in 192.168.2.40.22356 -> 192.168.210.2.25: ack 1533851700

[oberguru]

Thank you for your response.

Is the fgt handing more than one public IP address? (e.g. one for the fgt and one for the mail server?)

No fortigate have only one public address. Mail server is on private subnet inside the network.

try a 3rd party/outside port scanner to see if port 25 is open on the fgt

Did that with 3 different port scaners all with same result. All report that port 25 on fgt is closed

confirm fgt's public IP address(es) are not on any spam block lists

No public addres isn't reported on any of major spam block list

send 2-3 test emails from gmail/hotmail/yahoo, etc. to an company email address to see if what errors pop up

Done that from gmail/yahoo with the same result. All bounce email and reported that port 25 is closed or busy

If the fgt is the only device with an outside IP address (e.g. mail server has no public IP), I would set the "External IP Address/Range" on the vip to 0/0 (e.g. wildcard).

I will try this and report result

Thank you and ede_pfau so much on your effort to solve this problem.