Configuring The Ip-Based Policies - Fortinet FortiMail-100 Install Manual

Example 3: FortiMail unit for an ISP or carrier

Configuring the IP-based policies

136
Connection Settings
Hide this box from the
mail server
(transparent mode only)
Do not let client connect
to blacklisted SMTP
servers
(transparent mode only)
Endpoint
Reputation
Enable Endpoint
Reputation
Action
Auto blacklist score
trigger value
Auto blacklist duration
Session Settings
Prevent encryption of the
session
(transparent mode only)
Unauthenticated Session
Settings
Prevent open relaying
(transparent mode only)
5 Select OK.
Session profiles are applied to IP-based policies governing SMTP client connections.
Enable to preserve the IP address or domain name of the
SMTP client in:
• the SMTP greeting (HELO/EHLO) and in the Received:
message headers of email messages
• the IP addresses in the IP header
This masks the existence of the FortiMail unit.
Enable to prevent clients from connecting to SMTP servers
that have been blacklisted in antispam profiles or, if enabled,
the FortiGuard AntiSpam service.
Enable to accept, monitor, or reject email based upon endpoint
reputation scores.
This option is designed for use with SMTP clients with
dynamic IP addresses. It requires that your RADIUS server
provide mappings between dynamic IP addresses and
MSISDNs/subscriber IDs to the FortiMail unit.
Select either:
• Reject: Reject email and MMS messages from
MSISDNs/subscriber IDs whose endpoint reputation
scores exceed Auto blacklist score trigger value.
• Monitor: Log, but do not reject, email and MMS messages
from MSISDNs/subscriber IDs whose endpoint reputation
scores exceed Auto blacklist score trigger value. Log
entries appear in the history log.
Enter the endpoint reputation score over which the FortiMail
unit will add the MSISDN/subscriber ID to the automatic
blacklist.
The trigger score is relative to the period of time configured as
the automatic blacklist window. For more information on the
automatic blacklist window, see the
Guide.
Enter the number of minutes that an MSISDN/subscriber ID
will be prevented from sending email or MMS messages after
they have been automatically blacklisted.
Enable to block STARTTLS/MD5 commands so that email
connections cannot be TLS-encrypted.
Enable to prevent clients from using open relays to send email
by blocking sessions that are unauthenticated.
(Unauthenticated sessions are assumed to be occurring to an
open relay.)
If you permit SMTP clients to use open relays to send email,
email from their domains could be blacklisted by other SMTP
servers.
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
Transparent mode deployment
FortiMail Administration
Revision 2
http://docs.fortinet.com/ • Feedback