FortiMail - Server Basic Configuration

 Problem

Nowhere is it written exactly how FortiMail must be configured in Server Mode to run a secure Basic Mail Server.

Here is a summary of most of the settings:

Solution

System

Network

1. Configure your Interfaces
2. Be sure that you have configured an default Gateway

Port Forwarding

FortiMail are able to forward Traffic from a the internet to the local LAN (DNAT). For more information: FortiMail Doc

FortiGate

The FortiGate are able to send SMTP traffic through an WCCP Tunnel to the FortiMail for scanning. See for more information: FortiDoc

Configuration

1. Set the correct Time Zone
2. Configure your Password Policy
3. Change the Admin Ports to non default ports
4. If you need configure the SNMP settings

Mail Settings

1. Set the Hostname and the Local domain name. Togther there are the FQDN of the FortiMail.
2. Activate the SMTP MA service (use other ports for mail submiting by clients as mail transfer to other Mail servers. 

Relay Host

If you run the FortiMail behind another Mailserver which acts as Mail relay you are able to configure under Outgoing Email the correct Relay host.

FortiGuard

1. Activate the License

Domain & User

Domain

1. Configure your Domain as new Domain and setup your settings. For basic functionality you do not need except the domain name.

User

Each Mailbox need a user. You have to create it locally on the FortiMail. You are able to connect the mailbox with LDAP or RADIUS Server. See here for more information

Policy

First, it is very important to understand how policies works. To be short:

• Access Control: Let you control the SMTP Traffic after the FortiMail accept the TCP/IP connection. This ACLs control what happen with the SMTP Traffic it self for receiving and delivery.
• IP-Policy: Control the IP Traffic in general. Who is allowed to connect to the FortiMail and with which limitations (Session Profile).
• Recipient Policy: This rules control the IP Traffic based on the Recipient in the SMTP Header "RCPT TO:". That the only place where you are able to assing the Ressource Profile.

Read the Manual for deep information. It is very important to understand how the polices works!

Link to the manual

TIPP:

• Use IP-Policy where is possible. Recipient Policies makes the evaluation complicate and is often not needed.

Order of execution of policies

1. The FortiMail unit looks for a matching IP-based policy
2. The FortiMail unit loosk for a matching Recipient policy
3. The FortiMail execute the Recipient policy first (except you enable Take precedence over recipient based policy match)
4. The FortiMail execute the IP-based policy (only if there some setting which are not set by the recipient policy. No override of settings!)
5. If traffic allowed: Go further with the Access-Control Policies

Important to now:

• If the connection not matching any IP-based policy or recipient policy it is allowed and no antivirus or antispam policies are applied!
• If the connection not matching any Access-Control Policies and the sender is a trusted domain the connection is allowed!

Examples

IP-Policy

To work secure Mailserver the following IP-Policies are needed:

Recipient Policy

Disable all Inbound and Outbound policies.

Access-Control

Profiles

With the different security profiles you have a lot of options. With the default profiles you can work securelly. Please red the guide to find more information about the different options. Link to the guide

More Options

In this post I focus to the important settings to run the FortiMail in Server Mode successfully. The FortiMail as a lot of more features, please read the guide to find out more. ;)