Firewall policy for mail server

[#1]

Hi, Is it possible to create a firewall policy (or several policies) to do the following: 1. If the email message source IP detected as blacklisted IP then discard the message. 2. Else, tagged the message (Add header) so i can move the message to the Junk E-mail folder.

[laf]

Yep, it is. Just create two scanning profiles and add each to a firewall policy. Then order properly these two policies.

[#3]

Thanks laf! That' s interesting but fortigate 300A GUI allowed me to select only one protection profile for the specified firewall policy. Any idea?

[g3rman]

kobis, as laf said, you have to create multiple policy rules and apply the appropriate protection profile to each one.

[#5]

g3rman, Sorry but I missed something here. You mean that i need to create two firewall policies and two protection profiles. Then append each profile to each policy? But it is the same mail server, so if the first policy has the " Discard" option then every E-mail message will be catch and deleted by the first policy and it will never go to the next one, isn' t it? As far as I know, as soon as a session meets the first Allow or Deny policy, the Firewall does not looks for another policy. Am I right? Thank you guys for the help.

[g3rman]

Sorry, misread your original post. I' m not sure if the firewall is that sophisticated, that may require a Fortimail appliance.

[rwpatterson]

You scared me g3rman. I didn' t think it could do it either. I was waiting for some new information...

[abelio]

indeed, kobis' s proposal cannot be done if your incoming smtp traffic policy has ' all' as source address. Either with fortimail.

[#9]

Well it' s possible: Here how i did it: config spamfilter dnsbl edit 1 config entries edit 1 set action reject set server " bl.spamcop.net" next edit 2 set action reject set server " b.barracudacentral.org" next edit 3 set action reject set server " zen.spamhaus.org" next end set name " defined-rbl" next end config firewall profile edit " AV-AS" config log set log-av-block enable set log-av-oversize enable set log-av-virus enable set log-spam enable end set ftp splice unset http unset https set imap spamfssubmit set pop3 spamfssubmit set smtp scan spamfsip spamfschksum spamfsurl spamrbl splice set smtp-spamaction tag set smtp-spamtagtype header spaminfo set smtp-spamtagmsg " SPAM" set pop3-spamaction pass set imap-spamaction pass set spamrbltable 1 set nntp no-content-summary config app-recognition edit " http" set port 80 next edit " https" set port 443 next edit " smtp" set port 25 next edit " pop3" set port 110 next edit " imap" set port 143 next edit " nntp" set port 119 next edit " ftp" set port 21 next end unset im set comment " AV+As profile" set ftgd-wf-disable all next end The FG first check the dnsbl, if matched then discard the session and if not match it' s goes to the rest of the prtection profile and tagged the mail as SPAM if necessary...