FortiMail issue ip reputation

[Vital4eg]

Hi all. There is a problem with some MX servers from which we receive letters, for example magnit.ru, their IP address is replaced with the address of our fortigate, substituting the IP it disrupts the client reputation system by IP and we stop receiving letters from outside whose IP is resolved as our internal one. And the question is not how to enable IP reputation and set its restrictions. The problem is that when redirecting with nat turned off, the letter for fortimail receives the ip address of our fortigate, and not the sender’s source. In the case of nat enabled, all letters naturally take this form, which is incorrect from the point of view of ip reputation. If nat is turned off, only some (for example, magnit.ru). We also do not find a single way to clear the ip score for our fortigate IP address; the clear option is not functional in this case. It is necessary for #FortiMail to receive letters from the sender’s IP, and not the IP of our #FortiGate.

[AEK]

Hi @Vital4eg 

Are your saying that even when you disable NAT in the inbound firewall policy on FortiGate (from WAN to FortiMail) the source IP seen by FML remains the IP of FortiGate?

On the other hand, when you need to bypass a sender IP from sender reputation check, I think the solution is to create a new IP policy at top, like this:

• Source IP: The IP you want to exonerate
• Session profile: An inbound session profile where sender reputation option is disabled

[Vital4eg]

Hi @AEK 

Thanks, ill try it.

[AEK]

But the good solution is to fix the FortiGate's NAT issue. The original IP must reach FortiMail as source IP of the SMTP connection.

[Vital4eg]

@AEK The problem is that some (I emphasize some) counterparties send us mail.... and for some unknown reason our FG replaces the original IP with its own... And FM sees that a lot of letters are coming from our IP, it begins to increase the rating and cuts off receiving at 80. On FG, nat is turned off on ports 25,465... that is, access passes through without chanWe see 90 percent of original IPs and there are some exceptional cases.

[Vital4eg · Accepted solution]

Hello. The reason has been found. Briefly, the exhange server sends letters to one of our domains and resolves it as the IP address of our backup provider. Since we have SD-wan configured, the mail must go through the main provider, a masquerade is applied to it and it is sent to the backup one. Where it is redirected to FortiMail. All letters that Exchange sends to itself are service messages. Since there are a lot of such letters per unit of time and often, FortiMail adds the IP rating of our FortiGate until it blocks. Since the messages are service messages, it was decided to add IP FortiGate to the exception and not count its rating.

Thanks for the help.