Fortinet FortiMail-100, Инструкция по установке

Страница: 128 / 174

Example 3: FortiMail unit for an ISP or carrier Transparent mode deployment
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
128 Revision 2
http://docs.fortinet.com/ • Feedback
Exceptions to SMTP connections that can be proxied or relayed include SMTP
connections destined for the FortiMail unit itself. For those local connections, such as
email messages from email users requesting deletion or release of their quarantined
email, you must choose to either allow or block the connection.
Proxy/relay pick-up is configured separately for incoming and outgoing connections.
In this deployment example, incoming connections arriving on port2 must be scanned
before traveling to the main email server, and therefore are configured to be
are proxied —
that is, picked up by the implicit relay.
Outgoing connections arriving on port1 will contain email that has already been scanned
once, during SMTP clients’ relay to the main email server. In addition, outgoing
connections by the main mail server will be encrypted using TLS. Encrypted connections
cannot be scanned. Therefore outgoing connections will be passed through, and neither
proxied nor implicitly relayed.
To configure SMTP proxy and implicit relay pick-up
1 Go to Mail Settings > Proxies > SMTP in the advanced mode of the web-based
manager.
2 Configure the following:
3 Select Apply .
Testing the installation
Basic configuration is now complete, and the installation may be tested. For testing
instructions, see
“Testing the installation” on page 159 .
For information on configuring additional features, see the FortiMail Administration Guide .
Example 3: FortiMail unit for an ISP or carrier
In this example, a FortiMail unit operating in transparent mode is positioned as an offshoot
from the backbone or other primary traffic flow between the internal and external network.
A router uses policy-based routes to redirect only SMTP connections to the FortiMail unit,
which scans the traffic before allowing legitimate connections to return the overall flow.
The FortiMail unit does
not receive non-SMTP traffic. (This would result in unnecessary
processing and resource usage.)
Note: For information on determining directionality, see “Incoming vs. outgoing
directionality” on page 15 .
Port 1
Incoming SMTP connections are dropped
Outgoing SMTP connections are passed through
Local SMTP connections are allowed
Port 2
Incoming SMTP connections are proxied
Outgoing SMTP connections are dropped
Local SMTP connections are not allowed