Fortinet FortiMail-100, Install Manual

Page: 111 / 174

Gateway mode deployment Example 3: FortiMail unit in DMZ
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
Revision 2
111
http://docs.fortinet.com/ • Feedback
For information on configuring additional features, see the FortiMail Administration Guide .
Example 3: FortiMail unit in DMZ
In this example, a FortiMail unit operating in gateway mode, a protected email server, and
email users’ computers are all positioned within a private network, behind a firewall.
However, the FortiMail unit is located in the demilitarized zone (DMZ) of the firewall,
separated from the local email users and the protected email server, which are located on
the internal network of the firewall. Remote email users’ computers and external email
servers are located on the Internet, outside of the network protected by the firewall. The
FortiMail unit protects accounts for email addresses ending in “@example.com”, which are
hosted on the local email server.
Figure 44: FortiMail unit in DMZ
The FortiMail unit has also been configured with an access control rule that allows local
and remote email users to send email to unprotected domains if they first authenticate:
To deploy the FortiMail unit in the DMZ of a firewall, you must complete the following:
•
Configuring the firewall
• Configuring the MUAs
• Testing the installation
Sender Pattern
*@example.com
Recipient Pattern
*
Sender IP/Netmask
0.0.0.0/0
Reverse DNS
Pattern
*
Authentication
Status authenticated
TLS < none >
Action RELAY
External
Em ail Server
Rem ote Em ail U sers
D N S Server
Internet
Sw itch
Local Em ail U sers
Internal Em ail Server
172.16.1.10
dm z
192.168.1.1
(virtual IP:
192.168.1.2)
w an1
10.10.10.1
port1
192.168.1.5
Protected D om ain:
@ exam ple.com
Em ail D om ain:
@ exam ple.com
exam ple.com IN M X 10 fortim ail.exam ple.com
fortim ail IN A 10.10.10.1
internal
172.16.1.1
(virtual IP:
172.16.1.2)