Is it possible to change the IP address the FortiGate presents for its AntiSpam proxy?

[neonbit]

Hi guys,

Does anyone know if there's a way to disable/change the IP address that gets presented by the FortiGates AntiSpam proxy? 

For some reason it keeps on showing the internal IP address of the FortiGate. Ideally I'm trying to change it to the external VIP that the MX records would be pointing to (or at a minimum the WAN IP address of the FGT interface).

220 mail.domain.com ESMTP Smtpd; Wed, 3 Dec 2014 00:00:00 +0000
EHLO test.com
250-mail.domain.com Hello [192.168.1.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE 10485760
250-DSN
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP

[Bromont_FTNT]

Disable NAT on the firewall policy which contains the VIP for the SMTP server.

[Carlos_A_Almeida]

Hi,

Try to config in the rule that your smtp use a dynamic  ip pool nat entry, like this:

config firewall policy
    edit <RULE ID>
        set uuid <YOUR RULE UUID>
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "<YOUR SOURCE ADDR>"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "<YOUR SERVICES>"
        set nat enable
        set ippool enable
        set poolname "<YOUR IP POOL>"
    next

Remember, your ip pool have to be your public IP.

Try this and let me know about it.

Sorry about language mistakes,

Carlos - Brazil

neonbit wrote:

Hi guys,

Does anyone know if there's a way to disable/change the IP address that gets presented by the FortiGates AntiSpam proxy? 

For some reason it keeps on showing the internal IP address of the FortiGate. Ideally I'm trying to change it to the external VIP that the MX records would be pointing to (or at a minimum the WAN IP address of the FGT interface).

220 mail.domain.com ESMTP Smtpd; Wed, 3 Dec 2014 00:00:00 +0000
EHLO test.com
250-mail.domain.com Hello [192.168.1.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE 10485760
250-DSN
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP

[Bromont_FTNT]

In this case it is the external (VIP)--> internal  firewall policy.... NAT needs to be disabled so the internal mail server can see the real internet addresses for incoming mail. 

[Dave_Hall]

How I see it...depending on the direction of the traffic:

[ol]

If going from WAN->internal, NAT should be disabled if you want to see the source "outside IP address". 

If direction is from Internal->WAN, NAT should be enabled (using an IP pool if internal server has a different "outside" IP address than the Fortigate's own WAN IP).[/ol]

For 2, you may need to bind the server's outside IP address as a secondary IP to the Fortigate's WAN interface.  (edit: assuming the internal server(s) have internal IP addresses.  I have come across some cases where it looked like the mail servers were setup internally with "public" IP addresses, in which case the company just piped the connection through the fgt strictly for spam/virus protection, with no NATting involved.)

[neonbit]

Thanks guys, that did the trick! Didn't realise the NAT would affect the SMTP address it presented (always assumed it was the interface the SMTP connection was accepted on).

Disabled NAT and it's looking good now!