mail being dropped by Fortigate

[#1]

Hi Fortigate users, are you aware that the fortigate drops email under certain conditions ??. If you are sending mail and the primary MX of the receiving domain is down the chances are that your mail sender will never switch to the secondary MX of the receiving domain. Its because the Fortigate completes the smtp handshake before establishing that the receiving MX is actually available. The same happens in reverse, if your primary MX is down for receiving, the Fortigate will complete the connection with the sender and you will never get your mail ! Fortinet say this is " working as designed" , I say its bad design at best and a full on code bug. ! Maybe you have wondered why 5% of your mail is not delivered or received. This is Fortinet supports comment: Problem is due to both the Fortigate SMTP transparent proxy server (used for AV scanning and spamfiltering) and SMTP client understanding of a failed exchange. When the SMTP client wants to start a transaction with domain A.com, it firsts issues a DNS request to retrieve the MX record for A.com. In case MX record contains several entries, it starts a TCP connection to the first entry (best priority), with the FGT acting as tranparent proxy. The 3-way handshake is like : Client Server __________________________________ ---SYN---> FGT <--s_ack-- FGT ---SYN---> --ack--> FGT FGT <--s_ack-- FGT ---ack---> Due to the asymetry in the above exchange, even if the server is not replying, 3-way handshake always succeed on the client side. For a SMTP client to skip to a secondary MX entry, the SMTP transaction to the main server must have failed. However, not all the mail servers (SMTP client) have the same definition of a failed transaction. - Some consider that a successful TCP establishment (3-way handshake) is a proof of remote server reachability and keep on retrying this server. - Other consider that only a " 250-Mail transfer completed" SMTP response is a proof of server readiness, and will switch to a secondary MX even if TCP session was established. Unfortunately, Qmail seems to belong to the first family and hosting it behind a Fortigate makes it stick to the first MX record, even if the remote server is unreachable. I would like to have some more comment from out there, if you have the same problem we can pressure Fortinet to fix the issue. Thanks

[#2]

We have qmail-servers behind FortiGate units. This feature is causing damage to our business too. Fortinet, please provide a fix for the problem!

[UkWizard]

if thats true, they should make people aware. However, in their defence, a firewall shouldnt really be an enterprise level av engine. Best for a mail filtering software to do that.

[#4]

Fortinet acknowledge the problem, but they have not had sufficient customer " complaints" to motivate for a code change. Maybe not all customers are aware that it is a problem. We have a firewall as well, we use the Fortigate for avs and ips.

[#5]

[Deleted by Admins]

[Adrian_Lewis]

Had a client with this exact problem. They were using a tumbleweed device but scanning using the fortigate as well. They ended up increasing the connection timeout on the tumbleweed to greater than that of the fortigate proxy and so when the connection was finally reset byt the Fortigate, the Tumbleweed then moved on the the next MX host. Pain of a fix but it worked. We complained to fortinet but got a very similar answer. Luckily for me, we use Exchange which does work well.

[#7]

that may be a work around for sending, but should your receiving mx fail the other sending domains will never go to your 2nd mx, so your mx redundancy is shot. !

[#8]

So I have same problem I think. Over 1 MB mails are blocking in general.. What did you about this problem?

[#9]

This doesn' t sound good at all. I am in planning phases of adding anti-spam and anti-virus filtering to our smtp traffic. In the near future we will also adding an alternate mail server to the mix. The main reason we purchased the FN was for an all-in-one solution so I really, really hope Fortinet starts listening to it' s users and fixes this before I roll anything out.