personal whitelist being ignored

[Patrick3]

Hello, I' m running firmware version 5.1.3 (happened with 5.1.1 as well) and I' ve been getting lots of complaints from end users that email is going into their quarantine despite the sending addresses being in the personal whitelist. Upon investigation I have verified this to be true. This happens with anything flagged by the DNSBL as well as IP addresses listed in the Fortiguard anti-spam IP service. I have a ticket open with Fortinet support but so far they aren' t sure. Just wondering if anyone else is seeing this. Kind regards,

[Patrick3]

ORIGINAL: emnoc So you have someone sending you a message from comcast? And your okay with this? or was this a test only? Now to your problem, in the ASprofile & the DNSBL setting action, I guess you have a policy set to quarantine if it matches the AS/DNSBL. Now do you have multiple recipient-policies? If so make sure they all have send quarantine reports enabled. You can also look at the logs to determine what recipient-policy-# that was matched.

A couple comments here. 1) I happen to know plenty of small businesses who run their own Exchange server on a Comcast business line and I don' t think they should be blocked for the simple fact they are coming from a Comcast net block. 2) The fact it is Comcast is irrelevant. The issue is that the sender is in my clients personal whitelist but getting quarantined regardless. I have a single AS policy per domain. All users receive quarantine reports but that doesn' t solve the problem. When my users release something from quarantine it whitelists the sender address. The users need to be able to trust that emails from those people will come in. According to Fortinet support they should be.

[Bromont_FTNT]

Patrick, I would say there is an issue there... push for escalation of your ticket

[Patrick3]

ORIGINAL: Bromont Patrick, I would say there is an issue there... push for escalation of your ticket

I' m on it. Was hoping someone else was having a similar issue and might be able to share the solution but it isn' t looking that way. Thanks,

[Bromont_FTNT]

Patrick, BTW what' s your system load/throughput when the issue happens?

[Patrick3]

ORIGINAL: Bromont Patrick, BTW what' s your system load/throughput when the issue happens?

It happens constantly and consistently throughout the day to hundreds of users. Any user who receives email from someone who is on the DNSBL, or fails deep header inspection, etc, has the email go to the quarantine despite being whitelisted. I received a new response from Fortinet support earlier and they suspect the issue is tied to a corrupted mail data db. The CPU utilization hovers around 5% and memory about 20-25%. The overall system load avg' s about 6%. The box is hardly working.