Whitelisting attachment filter for a specific e-mail address

[VladaFBiH]

Hi All, 

I'm working with a FortiMail 900F and am super happy with it so far but have a specific issue. I've got a user that receives password locked, possibly encrypted, pdf files with sensitive materials that are time sensitive. He generally receives these from a single email address, and they are constantly sent to quarantine with the Attachment filter classifier.

The current practice for this is that the user lets us know when he was supposed to get this email (usually they arrive after office hours so the email stays in quarantine until the next day) and we release it but because of the time sensitive nature we'd like to whitelist the attachment filter for this specific email address.

I've placed the email address in all the whitelists I could but the filter still applies. Is there a way for me to do this without disabling the filter on the whole system?

FortiMail 

[Anthony_E]

Hello VladaFBIH,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello VladaFBIH,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[cysaw]

Hi VladaFBiH,

Please refer to below admin guide, FML Block and Safe list cannot be used to bypass the content scanning which including the attachment filters.

https://docs.fortinet.com/document/fortimail/7.2.2/administration-guide/598555/configuring-the-block...

We would suggest you to follow the below steps to disable the attachment filter just for one sender.

1. Create a new Content profile and disable the attachment filter.

2. Create a new Inbound recipient policy just for one sender that you wish to disable the attachment filter.

3. Apply the new content profile that you created on Step 1.

4. Make sure you put this new rule on top of the existing inbound recipient policies because the Fortimail will check the policies from top to bottom.

5. Since the new policy only configured for one sender so only one sender will match to the new policy and the other senders will use the other existing policies.

Thanks

Regards

Wilson

[VladaFBiH]

Thanks for the suggestion, the user who is dealing with this issue is not currently in office and we cannot test this solution but I will update this post once we've tested it.