FCP FortiMail cheat sheet

FortiMail deployment modes: gateway (inline SMTP relay between MTA and mail server), transparent (bridge mode, no IP change on clients), server (full MTA/MDA with local mailboxes), and offload (FortiMail handles antispam/antivirus, then relays to a mail server).

Transparent mode requires the FortiMail to be placed as a Layer 2 bridge; management access is typically via a dedicated management port or a VLAN interface, not the bridged data path.

Default admin access: HTTPS on port 443 and SSH on port 22 on the management interface; the default admin account is 'admin' with no password, and the system forces a password change on first login.

Factory reset via CLI: 'execute factoryreset' (preserves nothing) or 'execute factoryreset keep-ips' to retain the current IP configuration; the device reboots after either command.

Initial config wizard collects: hostname, admin password, management IP/netmask/gateway, DNS servers, and the mail domain(s) the FortiMail will protect.

FortiMail requires a valid license for antispam/antivirus signature updates; the license is bound to the device serial number and is installed via System > Dashboard > Status > License.

Ports that must be permitted inbound: 25 (SMTP), 465 (SMTPS), 587 (submission), 110/995 (POP3/POP3S), 143/993 (IMAP/IMAPS), 443 (GUI), 22 (SSH).

HA and mail routing require consistent time; configure NTP servers under System > Configuration > Time so log timestamps and TLS certificate validation are accurate.

FortiMail firmware upgrade path: check the release notes for the required intermediate versions; upgrades from very old builds may need a stepped upgrade (e.g., 5.x to 6.0 to 6.2 to 6.4).

Access control rules (System > Mail Settings > Access Control) determine whether a connecting client is treated as a trusted relay, a protected-domain sender, or an untrusted sender; order matters, first match wins.

Recipient-based routing (Policy > Recipient Policies) selects the domain-level policy that applies to inbound mail for a protected domain; the policy then references an antispam/antivirus profile and a content action.

Relay hosts (Policy > Mail Setting > Relay Hosts) define the next-hop SMTP server for outbound or inbound mail; the relay host is selected by matching the recipient domain or by the default relay.

SMTP routing table (Policy > Mail Setting > Routing Table) maps a domain pattern to a specific relay host or IP; the most specific match is used.

In gateway mode, outbound mail from the protected mail server must be allowed to relay: add the mail server IP to a trusted access control rule or to the relay host configuration.

Bounce and delivery-failure handling is controlled by the per-domain 'bounce address' and the global 'system bounce' settings; undeliverable mail can be quarantined, returned, or dropped.

SMTP authentication (AUTH) is required for submission on port 587; FortiMail can authenticate against a local user DB, LDAP/AD, RADIUS, or POP3/IMAP server.

Domain-level routing can rewrite the envelope recipient (recipient mapping) so that mail addressed to an alias is delivered to the real mailbox or to an external address.

The mail queue (Monitor > Mail Queue) shows deferred messages; 'execute queue flush' retries delivery, and 'execute queue delete' removes stuck messages after troubleshooting.

Antispam techniques in FortiMail include: DNSBL/RBL lookups, SURBL/URI blacklists, Bayesian heuristics, greylisting, SPF/Sender ID, DKIM verification, DMARC, and FortiGuard antispam signature updates.

Greylisting temporarily rejects first-seen sender/recipient/IP triplets with a 4xx code; legitimate MTAs retry, while many spam bots do not. Greylisting is configured per antispam profile and can be bypassed for trusted hosts.

The antispam profile assigns a spam score per message; the score thresholds for 'tag' vs. 'quarantine' vs. 'reject' are set per profile, and actions are applied in the recipient policy.

Antivirus scanning uses FortiGuard AV signatures plus heuristic and grayware detection; scanning can be applied to SMTP, POP3, IMAP, and to attachments inside archives (zip, rar, 7z) with a configurable decompression depth and size limit.

Content filtering (Profile > Content) matches on message headers, body text, attachment filename/type, and message size; actions include tag, quarantine, discard, and replace.

FortiGuard antispam and antivirus licenses must be current; without a license, signature-based detection is disabled and only local heuristics remain.

Per-domain 'personal quarantine' vs. 'system quarantine': personal quarantine is visible to the end user via webmail, while system quarantine is admin-only.

SPF check results are evaluated in the antispam profile; DMARC policy (none/quarantine/reject) can be enforced when the DMARC check is enabled and the domain publishes a DMARC record.

Attachment filtering can block by file extension list or by true file type (MIME sniffing), which catches renamed executables that extension-only filters miss.

User authentication sources: local database, LDAP/Active Directory, RADIUS, POP3, IMAP, and PKI/certificate; multiple sources can be combined in an authentication profile with a defined order.

SMTP AUTH is offered on submission ports; the FortiMail can authenticate the sender and then apply per-user policies (e.g., different outbound scanning for authenticated vs. unauthenticated users).

TLS for SMTP is configured in two directions: inbound TLS (opportunistic or enforced) and outbound TLS (opportunistic, enforced, or per-domain). Certificate verification can be required for outbound TLS.

S/MIME and PGP: FortiMail can decrypt inbound S/MIME/PGP messages for scanning and re-encrypt on delivery, using user or domain certificates/keys stored on the device.

IBE (Identity-Based Encryption) uses a FortiMail-generated key server; the recipient retrieves the private key via a secure web portal after authenticating, so no pre-shared certificate is needed.

DLP (Profile > Data Loss Prevention) uses predefined and custom patterns (credit card numbers, SSNs, Canadian SIN, etc.) with actions: log, quarantine, block, or encrypt; DLP can inspect message body and attachments.

DLP sensors can be combined with content filters; the DLP profile is attached to a recipient policy so it applies only to the intended direction (inbound vs. outbound).

Certificate management: import CA-signed certificates under System > Certificate > Local Certificate for the SMTP/HTTPS services; the default self-signed certificate triggers browser warnings and should be replaced.

Log categories include: antispam, antivirus, content, encryption, DLP, system, and mail events; each can be enabled or disabled under Log & Report > Log Settings.

Local log storage is limited by disk size; for long-term retention, configure a syslog server, FortiAnalyzer, or a remote log server under Log & Report > Log Config > Remote Logging.

FortiView (Monitor > FortiView) provides real-time dashboards for top senders, top recipients, top spam senders, and message volume; data is aggregated from recent logs.

Quarantine views: Monitor > Quarantine > System Quarantine and Personal Quarantine; administrators can release, delete, or re-scan quarantined messages.

Reports (Log & Report > Report) can be scheduled (daily/weekly) and emailed to administrators; report content is drawn from the local log database or FortiAnalyzer.

The mail queue and delivery status are visible under Monitor > Mail Queue; per-message details show the SMTP conversation and the reason for deferral or rejection.

SNMP traps and queries can be enabled for monitoring device health (CPU, memory, disk, mail queue depth, HA state) under System > SNMP.

Log forwarding to a syslog server uses UDP/TCP 514 by default; FortiAnalyzer uses TCP 514 or the OFTP port 514 over an encrypted channel.

HA modes: active-passive (one primary, one or more secondaries) and active-active (load sharing across nodes); HA requires at least two FortiMail units with the same firmware and license.

HA heartbeat and synchronization use dedicated HA ports or a heartbeat interface; the HA group has a virtual IP (VIP) that clients use as the mail gateway, and the VIP moves on failover.

HA synchronization includes configuration, quarantine, and (optionally) the mail queue; queue synchronization reduces message loss during failover.

Backup options: full configuration backup (System > Maintenance > Backup) produces an encrypted or plain-text config file; restoring requires the same or compatible firmware version.

Scheduled backups can be sent to a TFTP/FTP/SFTP server; the backup file contains sensitive data (passwords, certificates) and should be protected.

Troubleshooting tools: 'diagnose debug' (e.g., 'diagnose debug application smtpd -1') enables SMTP daemon debugging; 'diagnose sniffer packet' captures traffic; 'execute tac report' collects a support bundle.

Common mail-flow issues: access control rule order (first match wins), relay host misconfiguration, DNS resolution failure for the next hop, and expired licenses disabling antispam/AV.

Log messages with 'reason=' fields (e.g., 'reason=spam', 'reason=virus', 'reason=content') identify why a message was quarantined, rejected, or tagged; use them to tune profiles.

Firmware and signature updates can be scheduled under System > Maintenance > FortiGuard; a failed update often indicates a DNS or outbound HTTPS (443) connectivity problem.