Need Help with FortiMail and Mail Server Configuration

[rabbito]

I'm currently setting up an email infrastructure with FortiMail acting as our gateway, and I could use some guidance to refine my configuration for better security and functionality. Here's a brief overview of my setup and the issues I'm facing:

Setup Overview:

• No private DNS server or LDAP.

• Backend testing with CWP (Postfix, Dovecot, Roundcube + Outlook, Thunderbird as mail client).

• Two domains to manage.

• SMTP authentication created on the same mail server.

• FortiMail in gateway mode with a DNAT VIP redirecting mail.

• Can send and receive emails inbound and outbound.

Issues:

1. Firewall Policies:

   • I need help configuring firewall policies to ensure that SMTPS and HTTPS traffic goes to FortiMail, while IMAP, POP3S, and other services (webmail, etc.) go to the backend mail server.

   • I have only one public IP, so any recommendations for port forwarding at FortiGate to manage services better would be appreciated.

2. SMTP Authentication and Relay:

   • I want to use the SMTP authentication created on the same mail server as FortiMail.

   • The auth proxy cannot save mailboxes in gateway mode, so I need to ensure successful authentication.

3. FortiMail Policies:

   • I prefer IP-based access control for now.

   • My main objectives are anti-spam, antivirus, CDR, and DLP.

My Questions:

• How can I make my firewall policies specific so that SMTPS and HTTPS traffic goes to FortiMail, and other services go to the backend mail server?

• What are the best practices for authentication and general FortiMail policies, especially for anti-spam, antivirus, CDR, and DLP?

I've configured the mailserver host file, set the domain as relay as host, and set the mail server settings in FortiMail. However, I'm still facing challenges with traffic routing and authentication.Any advice or recommendations from your experiences would be greatly appreciated. Thank you in advance for your help!

[funkylicious · Accepted solution]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati... 

for smtp(s) and http(s) to go towards fortimail, you would need to create a VIP for this, map Public IP:Public Port to Private IP:Port ( ex: 1.1.1.1:587 > 192.168.100.1:587 )  , then use these VIPs in the firewall rules, WAN > LAN and the same for the other ports/services to the backend with the observation that the services/ports mapped cannot overlap/use the same public ip:port for 2 different destinations.

https://docs.fortinet.com/document/fortimail/7.6.3/administration-guide/489667/best-practices-and-fi... 

[rabbito]

Thanks buddy i will surely give it a try, have you ever implemented the smtp based authentication or not?

[funkylicious]

havent gotten the chance to work with FortiMail so far unfortunately :( 

[abelio]

Hello rabbito
you shouldn't have any problem with smtp authentication. 
Just define an authentication profile against your backend email server and refer it  in your incoming recipient policies (or IP policies if need to)
This is well documented in FML admin guide too.

hope it helps

[stevenholt34]

Helpful Information