High Availability of Exch 2016 - Fortinet 61E

ahsan · ‎01-24-2018

Hi,

I have Fortinet 61E deployed and I want to allow my exchange server to be able to send and receive emails and OWA.

WAN interface is 200.200.200.1

Exch-1 is 192.168.0.10

Exch-2 is 192.168.0.11

Internally I have have DNS round Robin and clients access the servers via URL and randomly assess both servers.

For WAN, I have VIP 200.200.200.1 -> 192.168.0.10 (25 -> 25)

I cannot create same VIP for other server as it says same already exists.

How can I achieve the following:

VIP 200.200.200.1 -> 192.168.0.10 (25 -> 25)

VIP 200.200.200.1 -> 192.168.0.11 (25 -> 25)

I need to open port 25 and 443 on WAN interface and forward traffic to both internal email servers. Exchange server is DAG.

Attached is the scenario.

Any help will be much appreciated.

Markus · ‎01-25-2018

Hi, You can achive this with loadbalancing. Maybe you have to enable it first -> System -> Feauture Visibility

Then create two virtual server (smtp(s) and https) and then add the real servers. I'm not quite sure, but for the low ends Fortigates, you need firmware 5.6.x to create https virtual servers. Best regards, Markus

________________________________________________________
--- NSE 4 ---
________________________________________________________

View solution in original post

romanr · ‎01-25-2018

Correct - But there won't be any Virtual Server with HTTPS on a desktop model.

So you will have to do Layer 4 Load Balancing - Meaning a TCP Port 443 LoadBalance....

Br,

Roman

View solution in original post

romanr · ‎01-26-2018

Hey,

I was just suprised to see it is actually really there on a 60E :) ... nice one!

@ahsan

Fortigate or VDOM Operation has to be in Proxy Mode!! Have a look in the "System Settings" Menu!

Br,

Roman

PS: I am not sure if Layer 7 LB with HTTPS offloading on a Fortigate will be supported with MS Exchange 2016. We ran into troubles even with FortiADC and L7 Load Balancing and are still under investigation with that one. Layer 4 seems supported and is preferred.

yoda · ‎05-19-2018

Hi, has anyone tested SSL offloading with AV profile in place? On my lab FG61E (firmware 5.6.4) I have configured a firewall policy for Exchange OWA with SSL offloading and default AV profile enabled. When sending a mail via OWA - with the EICAR text in the body of the mail - I see the traffic handled by the expected FW policy but the mail get rejected by the scanning engine of the Exchange server and NOT by the firewall. I would expect the traffic not hitting the Exchange server and have it being blocked by the firewall. Do i miss anything? Best, Yoda