Fortimail DMZ login

[NeoRant]

Hello Fortinet family,

Can someone provide some insight and/or solution?

I just put my fortimail in the dmz, my mail server is behind the fortigate fwl, enabled smtp traffic on fortigate, mails are processed/flowing via the fortimail perfectly(a lot of false positives though, some inspection settings might need to be tweaked down). 

I have to ethernet ports enabled on my fortimail hyperv vm:

eth0 -> internal

eth1 -> dmz

I can login to Fortimail web UI  via port1-internal lan(172.16.10.5) . However, i am unable to login to the web ui via port2-dmz(172.16.40.10).

What do i need to do to log in the fortimail web ui via the dmz port/IP?

ANY help would be great, thanks. 

[dbu]

Hi @NeoRant ,

Is the Access for HTTPS GUI enabled on interface eth1? 

[NeoRant]

Hi DBU,

Yes it is. I ran traffic capture in fml, ran wireshark while attempting to connect to https://dmz ip/admin to retrieve/analysis etc. The fortigate has https enabled/allowed for the dmz ip so idk, smh

[AEK]

Hi NeoRant

If you enabled https access on DMZ and didn't work then I guess it is a routing issue.

As per my knowledge FortiMail doesn't have policy routes, so if you configure multiple interfaces you may have some issues when accessing from the interface on which the default route is not configured.

In your case I guess the default route is on port1. So if I'm not wrong, when you try connect to port2 the returning traffic may back from port1. You can sniff on FML CLI to confirm this.

From security prospective I think a better design for any VM is to attach it to one single VLAN/DMZ (except for firewalls, WAF and few others), this is also applicable for FortiMail, I mean to use one interface, put in DMZ, from which you manage it and in the same time for handling SMTP traffic. This will also avoid such routing issues.

[NeoRant]

Hi AEK,

So basically, i need to input the default gateway for the dmz ip in fortimail? Correct me if i am wrong.

The ip for management interface/port 1 has its default gateway configured in FML, i.e. only one default route is present so far, none for the dmz.

Observation:

- i can ping the dmz ip on the LAN perfectly.

- webadmin, https, ssh  enabled on  port2/dmz just like port.

- when i disconnect hyper v eth0 (port1 on fml) leaving only eth1(port2-dmz) on fml vm, i cant ping the dmz ip on lan. 

-dmz ip on fml port 2 is only pingable when port1/eth0 is connected in fml vm.

[AEK · Accepted solution]

Hi NeoRant

The idea I suggested is as follows:

• disable port1 (internal)
• remove the default gateway through port1 (internal)
• keep port2 (DMZ)
• add a default gateway through port2 (DMZ)

This has two benefits:

• Good design
• Your issue will be fixed

Then for more security you will add Trusted Hosts for admin access, so that you deny admin access from other than internal source.

[NeoRant]

Hi AEK,

I will try your recommendation and get back to you as soon as i can.

Thanks alot

[NeoRant]

Hi AEK,

I followed your instruction but tweaked it a bit, using the cli to verify.

Steps i performed:

1.  login to admin gui via port 1 with internal ip
2. Change interface ip :Go to system->network-> changed port1(that had the internal IP) to dmz IP. I. ensured that webadmin, ssh, https was still enabled for port1)
3. Deleted port2(that had the dmz ip previously)
4. Change system route: Go to system->network->routing from internal to dmz gateway/system route IP
5. Change to dmz interface on hyperv for Fortimail vm – N.B. 
6. I successfully Logged in to fortimail via cli via dmz interface( I ran “show system interface” to verify that port1 is showing dmz ip details and that port 2 was removed.)
7. Run “execute ping” on any dmz device to verify connectivity.
8. Login to dmzip/admin to gain access - SUCCESSFUL

[AEK]

And keep in mind, in real world security guys will not let you connect a VM to more than one VLANs, since it will let you bypass the firewall for inter-VLAN communication.