I85PREP
⌘ K
FCP FortiMail study materials
FCP FortiMail study resources

FCP FortiMail: Deployment and Initial Configuration

FCP FortiMail · Work through your exam, one topic at a time.

All guide sections

Deployment and Initial Configuration

The Deployment and Initial Configuration domain tests whether you can choose the right FortiMail operating mode and build a working base configuration: interfaces, DNS, administrator access, mail domains, and the first policies. Expect scenario questions about gateway versus transparent versus server mode, and about which settings must exist before mail flows.

Operating modes

  • Gateway mode places FortiMail behind the firewall as an SMTP relay. It scans inbound mail and relays to an internal mail server; outbound mail can also relay through it. It is not a mailbox server.
  • Transparent mode inserts FortiMail as a bridge inline with an existing mail server, usually without changing MX records or IP addresses. A management IP is still required.
  • Server mode makes FortiMail the mail server, with local domains, mailboxes, POP3/IMAP, and webmail. Changing mode is disruptive; plan it before production and expect a reboot or service restart.

Base configuration checklist

  • Set a unique FQDN hostname and correct DNS A, MX, and PTR records. A mismatched PTR or HELO name hurts deliverability and can trigger rejections.
  • Configure interfaces, default gateway, NTP, and administrative access. Restrict admin protocols and use trusted hosts.
  • Register and license the unit and verify FortiGuard connectivity for antivirus and antispam updates.
  • Define mail domains: local domains for server mode; protected or relay domains for gateway and transparent mode.
  • Configure a relay host or destination server if outbound mail must use a smart host.
  • Create administrator profiles with least privilege, then take a configuration backup.

Worked example

A company keeps Exchange and wants inline scanning without changing MX records. The correct choice is transparent mode: place FortiMail in bridge mode between the firewall and Exchange, give it a management IP, define the protected domain, and let SMTP pass through. Gateway mode would also work but requires MX or firewall changes; server mode would add mailboxes that are not needed. The reasoning is that transparent mode preserves the existing mail flow and IP addressing while still allowing scanning.

Traps

  • Assuming gateway mode provides local mailboxes.
  • Forgetting PTR and HELO alignment, then blaming antispam.
  • Leaving admin access open to all interfaces.
  • Changing the operating mode after policies and domains exist without retesting mail flow.