Can I block all incoming/outgoing while still allowing email between users?

[Mbutler522010]

We have an exchange server which feeds into a Fortimail for High School students and staff but we don't allow email for middle school and under.

We are looking at google apps for education (GAFE) but want to still keeping our own email hosting. GAFE supports it and it works ok...but it really wants email between teacher and students and I am being asked if it is possible.

I can get it to work by pointing Google at our exchange server but then that opens the students up to spam. and because the email is coming in from the outside (google) instead of being created by our own exchange server, I can't simply deny access through the fortimail for those accounts, so...

My question - can I configure the Fortimail to prevent ALL incoming and outgoing email to anything besides google for some student accounts while still allowing email (via google) from the teacher to the students? Our parents are very skeptical and unwilling to permit email for their underage students so one Viagra spam to a middle school child and the entire thing will implode.

It appears the google email enters the Fortimail from multiple server ip addresses and the receiving policies want specific ip addresses, I can't see creating dozens of policies and trying to figure out when google adds another one.

Is there a better way?

[emnoc]

I 'm not following you  exactly 100% but i think you need to look at access_control and user define. You can provide rules from internal/external and a "action" such as reject

1:

You could allow wildcards like *@teacherdomain.com to *@yourdomains.com and reject everything else.

2:

You can even match on  PTR reversesal also.

This is probably what your looking for basic on my understanding of your  question. If you reject based on this, it would be simple to protect members and they will get a std undeliverable

  5.7.1 Access denied (in reply to RCPT TO command)

[Mbutler522010]

Thanks for the info!

I am worried about spoofing the source address though. I imagine it is easy to block everything that does not come from a specific email server, but am worried about spoofers. I will take a look at your suggestions!

Mark

[emnoc]

What do  you mean about spoof'ing? If the address is spoof'd externally, you would probably not really know, but the rating and look up should probably rate the sender very low and list it as possible spam. It would be very hard to spoof a tcp session but it could be hijacked or a MiTM.

I believe if you use a access-contol and wildcards *s for the sender/receive domain, you could probably filter off a lot of external domains. i did once when I was running benchmarks between just 2 domains but  needed the fortimail to perform dns lookups and use the internal. So I had companyA and companyB domains "trusted somewhat" and only allowed between the 2 units.