Fortigate as Email relay gateway

[#1]

Dear all, I want to ask if someone has experience in setting up fortigate 110c firewall as email relay, to act as an antispam. i have a scenerio in which i have to use fortigate to accept incoming email for an organization, and filter it for spam before sending it to Hub transport server of exchange 2010. please check the attached diagram of the scenerio.

[ede_pfau]

Hi, and welcome to the Forums! First, congratulations, this is the first decent documentation that I' ve seen in the Forums in months. Really helps a lot. Second, my impression is that you might confuse the term " mail relay" with what you can achieve with a Fortigate. The FG will accept mail traffic from and to the Exchange server using the external IP and filter for spam if configured to do so. Mail will not be accepted by the FG itself but by the mailserver in your LAN. A mail relay on the other hand has different functions. It is a server that accepts mail (using mail protocols) and forwards it to another mail server. It might filter for spam as well but that is not included in the relay role itself. A Fortigate is just a firewall, a FortiMail is a mail server that can act as a mail relay (among other things). In your case you can use the Fortigate to - carry traffic from ISP1 to your Exchange server (firewall policy+NAT/port forwarding) - filter for spam (UTM/AS) - provide independent internet access for the rest of your LAN via ISP2 (policy routing) To get started, create a VIP (virtual IP) for your server: ext. interface: wan1 ext. IP: 185.15.2.1 mapped IP: 128.1.1.2 mapped interface: port X (this detail is missing) port forward: yes dest port: ...your choice...one of HTTP(S), IMAP(S), POP3(S), SMTP(S) you need one VIP for each port forwarded. If you have more than 1 VIP you can group them together in a VIP group and use just this group in the policy. firewall policy: from wan1, addr: all to port X, addr: VIP or VIP group for mailserver service: (service group created for mail services) NAT enabled Be aware that the 128.1.1.2 does not need to be public - this setup will use the wan1 IP for mail so your DNS MX record would point to the wan1 IP. This is half of the way. You have to take care of the other internet traffic to use wan2. This is done via policy routing. If you' re new to Fortigates you should have a preparation phase working through the documentation, namely the FortiOS Handbook, chapters on VIP, policies and UTM. If traffic to and from the mailserver runs smoothly and you receive mail you can set up the anti-spam.