Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
NeoRant
Contributor

Fortimail DMZ login

Hello Fortinet family,

 

Can someone provide some insight and/or solution?

 

I just put my fortimail in the dmz, my mail server is behind the fortigate fwl, enabled smtp traffic on fortigate, mails are processed/flowing via the fortimail perfectly(a lot of false positives though, some inspection settings might need to be tweaked down)

I have to ethernet ports enabled on my fortimail hyperv vm:

eth0 -> internal

eth1 -> dmz

 

I can login to Fortimail web UI  via port1-internal lan(172.16.10.5) . However, i am unable to login to the web ui via port2-dmz(172.16.40.10).

 

What do i need to do to log in the fortimail web ui via the dmz port/IP?

 

ANY help would be great, thanks. 

1 Solution
AEK

Hi NeoRant

The idea I suggested is as follows:

  • disable port1 (internal)
  • remove the default gateway through port1 (internal)
  • keep port2 (DMZ)
  • add a default gateway through port2 (DMZ)

This has two benefits:

  • Good design
  • Your issue will be fixed

Then for more security you will add Trusted Hosts for admin access, so that you deny admin access from other than internal source.

AEK

View solution in original post

AEK
8 REPLIES 8
dbu
Staff
Staff

Hi @NeoRant ,

Is the Access for HTTPS GUI enabled on interface eth1? 

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
NeoRant

Hi DBU,

 

Yes it is. I ran traffic capture in fml, ran wireshark while attempting to connect to https://dmz ip/admin to retrieve/analysis etc. The fortigate has https enabled/allowed for the dmz ip so idk, smh

AEK
SuperUser
SuperUser

Hi NeoRant

If you enabled https access on DMZ and didn't work then I guess it is a routing issue.

As per my knowledge FortiMail doesn't have policy routes, so if you configure multiple interfaces you may have some issues when accessing from the interface on which the default route is not configured.

 

In your case I guess the default route is on port1. So if I'm not wrong, when you try connect to port2 the returning traffic may back from port1. You can sniff on FML CLI to confirm this.

 

From security prospective I think a better design for any VM is to attach it to one single VLAN/DMZ (except for firewalls, WAF and few others), this is also applicable for FortiMail, I mean to use one interface, put in DMZ, from which you manage it and in the same time for handling SMTP traffic. This will also avoid such routing issues.

AEK
AEK
NeoRant

Hi AEK,

 

So basically, i need to input the default gateway for the dmz ip in fortimail? Correct me if i am wrong.

 

The ip for management interface/port 1 has its default gateway configured in FML, i.e. only one default route is present so far, none for the dmz.

 

Observation:

- i can ping the dmz ip on the LAN perfectly.

- webadmin, https, ssh  enabled on  port2/dmz just like port.

- when i disconnect hyper v eth0 (port1 on fml) leaving only eth1(port2-dmz) on fml vm, i cant ping the dmz ip on lan. 

-dmz ip on fml port 2 is only pingable when port1/eth0 is connected in fml vm.

AEK

Hi NeoRant

The idea I suggested is as follows:

  • disable port1 (internal)
  • remove the default gateway through port1 (internal)
  • keep port2 (DMZ)
  • add a default gateway through port2 (DMZ)

This has two benefits:

  • Good design
  • Your issue will be fixed

Then for more security you will add Trusted Hosts for admin access, so that you deny admin access from other than internal source.

AEK
AEK
NeoRant

Hi AEK,

 

I will try your recommendation and get back to you as soon as i can.

 

Thanks alot

NeoRant

Hi AEK,

 

I followed your instruction but tweaked it a bit, using the cli to verify.

 

Steps i performed:

  1.  login to admin gui via port 1 with internal ip
  2. Change interface ip :Go to system->network-> changed port1(that had the internal IP) to dmz IP. I. ensured that webadmin, ssh, https was still enabled for port1)
  3. Deleted port2(that had the dmz ip previously)
  4. Change system route: Go to system->network->routing from internal to dmz gateway/system route IP
  5. Change to dmz interface on hyperv for Fortimail vm – N.B. 
  6. I successfully Logged in to fortimail via cli via dmz interface( I ran “show system interface” to verify that port1 is showing dmz ip details and that port 2 was removed.)
  7. Run “execute ping” on any dmz device to verify connectivity.
  8. Login to dmzip/admin to gain access - SUCCESSFUL
AEK

And keep in mind, in real world security guys will not let you connect a VM to more than one VLANs, since it will let you bypass the firewall for inter-VLAN communication.

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors