Quick Start Wizard
Step 6: Configuring access control rules and outgoing antispam and antivirus settings
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
Revision 2
87
•
3
Repeat the previous step for any additional access control rules.
The access control rule appears at the bottom of the list of access control rules. As a
result, the FortiMail unit will evaluate it as a match for the SMTP session only if no
previous access control rule matches. If you want your new rule to be evaluated before
another rule, move your new access control rule to its intended position in the list. For
details, see the
FortiMail Administration Guide
.
Sender IP/Netmask
Enter the IP address and netmask of the SMTP client attempting to
deliver the email message. Use the netmask, the portion after the
slash (
/
), to specify the matching subnet.
For example, enter
10.10.10.10/24
to match a 24-bit subnet, or
all addresses starting with 10.10.10. This will appear as
10.10.10.0/24
in the access control rule table, with the
0
indicating
that any value is matched in that position of the address.
Similarly,
10.10.10.10/32
will appear as 10.10.10.10/32 and
match only the 10.10.10.10 address.
To match any address, enter
0.0.0.0/0
.
Reverse DNS Pattern
Enter a pattern to compare to the result of a reverse DNS look-up of
the IP address of the SMTP client delivering the email message.
Because domain names in the SMTP session are self-reported by
the connecting SMTP server and easy to fake, the FortiMail unit
does not trust the domain name that an SMTP server reports.
Instead, the FortiMail does a DNS lookup using the SMTP server’s
IP address. The resulting domain name is compared to the reverse
DNS pattern for a match. If the reverse DNS query fails, the access
control rule match will also fail. If no other access control rule
matches, the connection will be rejected with SMTP reply code 550
(
Relaying denied
).
Wildcard characters allow you to enter partial patterns that can
match multiple reverse DNS lookup results. An asterisk (
*
)
represents one or more characters; a question mark (
?
) represents
any single character.
For example, the recipient pattern
mail*.com
will match messages
delivered by an SMTP server whose domain name starts with “mail”
and ends with “.com”.
Note:
Reverse DNS queries for access control rules require that the
domain name be a valid top level domain (TLD). For example, “.lab”
is not a valid top level domain name, and thus the FortiMail unit
cannot successfully perform a reverse DNS query for it.
Regular
expression
Mark this check box to use regular expression syntax instead of
wildcards to specify the reverse DNS pattern.
Authentication Status
Select whether or not to match this access control rule based upon
client authentication.
•
any
: Match or do not match this access control rule regardless of
whether the client has authenticated with the FortiMail unit.
•
authenticated
: Match this access control rule only for clients that
have authenticated with the FortiMail unit.
Action
Select which action the FortiMail unit will perform for SMTP sessions
matching this access control rule.
•
BYPASS
:Relay or proxy and deliver the email,
but
, if the sender
or recipient belongs to a protected domain, bypass all antispam
profile processing. Antivirus, content and other scans will still
occur.
•
DISCARD
: Accept the email, but silently delete it and do not
deliver it. Do not inform the SMTP client.
•
RELAY
: Relay or proxy, process, and deliver the email normally if
it passes all configured scans.
•
REJECT
: Reject delivery of the email and respond to the SMTP
client with SMTP reply code 550 (
Relaying denied
).
Summary of Contents for FortiMail-100
Page 1: ...FortiMail Secure Messaging Platform Version 4 0 Patch 1 Install Guide...
Page 173: ...www fortinet com...
Page 174: ...www fortinet com...
