Transparent mode deployment
Example 3: FortiMail unit for an ISP or carrier
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
Revision 2
129
•
Service providers often fundamentally require transparent mode. Requiring subscribers to
explicitly configure a mail relay can be problematic, and in the case of 3G mobile
subscribers, impossible. Therefore gateway mode is not suitable. Transparent mode
makes SMTP scanning possible without configuration by the subscriber.
A dual-arm attachment is used. This provides natural isolation of traffic before and after
inspection, which can be useful if traffic requires further analysis such as packet traces by
a sniffer. (If you use a load balancer and it does not support the same session on two
different ports, deploy the FortiMail unit using a single-arm attachment instead. For
example, Foundry IronServer has been known to require single-arm attachment.)
Figure 48: Transparent mode deployment at an ISP or carrier (with HA cluster)
Each network interface in the dual-arm attachment (port2 and port3) is removed from the
Layer 2 bridge, and is configured with its own IP address. This reduces the possibility of
Ethernet loops and improves compatibility with other filtering devices.
Because port1 cannot be removed from the bridge, and the management IP is accessible
from any bridging network interface, port1 is reserved for direct connections from the
administrator's computer. (If the administrator’s computer is not directly connected but is
instead part of a management LAN, a route must also be configured for port1.)
Note:
For increased session-handling capacity, multiple FortiMail units could be clustered
into a config-only HA group and deployed behind a load balancer that is attached to the
router. Connections to the same source IP address would be handled by the same FortiMail
unit to avoid sessions split among multiple units, and to maintain the accuracy of IP
statistics. Otherwise, attach a single FortiMail unit to the router.
Administrator
TRANSPARENT MODE
CONFIG-ONLY HA
External MTA
Internet
SMTP SESSIONS
TO INTERNAL
IPs
SMTP SESSIONS
TO EXTERNAL
IPs
port1
port2
Subscsriber
Network
port3
Router
RADIUS
Server
GGSN
DSLAM
SGSN
DSL modem/
router
DSL Subscriber
3G Subscriber
Load Balancer
RADIUS ACCOUNTING
NOTICES OF
CURRENT SUBSCRIBER
IP ADDRESSES
Summary of Contents for FortiMail-100
Page 1: ...FortiMail Secure Messaging Platform Version 4 0 Patch 1 Install Guide...
Page 173: ...www fortinet com...
Page 174: ...www fortinet com...
