Fortinet FortiMail-100, Install Manual

Page: 125 / 174

Transparent mode deployment Example 2: FortiMail unit in front of an email hub
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
Revision 2
125
http://docs.fortinet.com/ • Feedback
3 Select Apply .
Testing the installation
Basic configuration is now complete, and the installation may be tested. For testing
instructions, see
“Testing the installation” on page 159 .
For information on configuring additional features, see the FortiMail Administration Guide .
Example 2: FortiMail unit in front of an email hub
In this example, a FortiMail unit operating in transparent mode is positioned between an
email gateway and other internal email servers.
When sending email with external recipients, the email servers (Relay A and Relay B) in
each WAN location are required to deliver through the main email server, which encrypts
outgoing SMTP connections. The firewall will only allow SMTP traffic from the main email
server.
Figure 47: Transparent mode deployment to protect an email hub
Local SMTP connections are allowed
Port 2
Incoming SMTP connections are proxied
Outgoing SMTP connections are dropped
Local SMTP connections are not allowed
Note: If Use client-specified SMTP server to deliver email is disabled, and an SMTP client
is configured to authenticate, you must configure and apply an authentication profile.
Without the profile, authentication with the built-in MTA will fail. Also, the mail server must
be explicitly configured to allow relay in this case
External
Email Server
Local Email Users
Remote Email Users
Main Internal Email Server
172.16.1.10
Router
port1
port2
Internal SMTP
Relay B
Internal SMTP
Relay A
Internet
WAN
Protected Domain:
@example.com
Email Domain:
@example.com