Help with routing external spam filter to internal email server.

[jcm05]

I'm currently setting up a 300D and having issues setting up a route for our mail. Our current firewall only accepts email from specific ip address range example 64.235.144.x - 64.235.159.x over port 25 to our internal mail server 192.168.12.12. I thought the first thing I needed to do is setup a vip. I go in and add the ip range of the firewall external IP to mail server internal IP port 25. Then create an address group with the range of address I will accept. Next create a rule saying incoming (external port) outgoing (internal port) source (address group creadted)Destination(VIP group setup) server exchange service. I hope this makes since really could you some help with this.

[MikePruett]

your VIP should map an external Address to an internal address or a port (on the fortigates WAN IP) to the internal address port accordingly.

From there you use your policy to restrict who can hit it. Do you have a sanitized screen shot of the rule you created and the VIPs?

[jcm05]

Below is a pic of the rule I created for spam service only email. Created a VIP of the external IP to internal address over port 25. Then created an address group with the range of IP-s to accept mail from. Then created a rule to accept mail only from that source.

[MikePruett]

What does the logs show for the traffic trying to hit? Is it getting denied, Ip conn error? etc

[slarabee]

So is the Barracuda able to send mail through now?

One thing I did when working to get mine working is to add my address to the Address List so I could test Telnet to port 25 on the mail server. That is how I found that the internal FW IP was being passed to the email server rather than the source address. I ran Netstat on the server and Diag sniifer on the FW as I tested telnet 25 to the server.

If you are using Exchange Server and have connection control entries set up on SMTP narrowing the allowed connections to only accept from the Barracuda you may still need to add the inside interface of the FW.

[jcm05]

I dont have the rule enabled yet as the firewall is not in production. Email is still be sent to old firewall until we cut over to our mlps network next month. I was trying to create rules in advanced so I was ahead of things. Currently the only live traffic we have going through it is Explicit proxy for some users and terminal servers and Exchange active-sync connection. I just wanted to make sure I understood the firewall and routing rules as I'm coming from a different firewall enviornment.

[slarabee]

I would add your own PC IP to the Fortigate Address List and the Group and test Telnet to port 25 on the email server (again you may need to add IP to the connection control of the SMTP on Exchange). If you reach the banner on the email server, your rules are working and you are all set. If not then there is a problem that may require further troubleshooting. Good luck. Let me know if you can reach the server.

[slarabee]

I am not Familiar with the 300D but I just set up the same set up for my client on a 100A.

Spam Filter Service -> Through Firewall -> Internal Email Server.

In my configuration only the spam filtering servers come through on Port 25.

So I created VIP Address mapping the Outside IP of my mail server to the Inside IP of my mail server.

Then I created Addresses for the Spam Filter Service's servers individually. Then add all the spam server's addresses to a new Address Group "Spam Filter Servers"

Then create a new firewall policy WAN -> Internal

Source Interface/Zone WAN# Address Name Your Spam Filter's Address Group you created

Destination Interface/Zone Internal 

Address Name The VIP you created for your email server

Schedule Always unless you have a schedule Service The port your email service is coming in on SMTP 25

Action = Accept

Also enable NAT on the policy.

One tip: I found that the Fortigate was passing the inside IP of the firewall onto the email rather than the Source IP, so if you are using connection control on your email server you will need to add the inside address of the firewall to the connection control's list of IP address.

I hope this helps,

Sean