I85PREP
⌘ K
FCP FortiMail study materials
FCP FortiMail study resources

FCP FortiMail: High Availability, Backup, and Troubleshooting

FCP FortiMail · Work through your exam, one topic at a time.

All guide sections

High Availability, Backup, and Troubleshooting

This domain tests resilience and recovery: building an HA pair, backing up the right data, and isolating faults without guesswork. Questions often ask what fails over, what is synchronized, or which evidence to collect first.

HA

  • FortiMail HA pairs a primary and secondary unit behind a virtual IP. Configuration is synchronized so policies, domains, and profiles match.
  • Use a dedicated heartbeat link and monitor interfaces. Failover can trigger on heartbeat loss, link failure, or service failure.
  • Both units should run the same firmware and have compatible licensing; mismatched versions are a common cause of failed HA formation.
  • Test failover before production. Split-brain and stale sessions are the main risks; know which unit is active and why.

Backup

  • Back up the configuration after changes: domains, policies, profiles, admin accounts, and network settings.
  • GUI backup and CLI execute backup config are standard; restore with execute restore config.
  • Configuration backup does not automatically include all mail data or quarantine. If mail data matters, use the supported mail-data backup method and verify restoration.
  • Restore to a compatible firmware version and keep backups offline. A backup that has never been restored is unproven.

Troubleshooting

  • Start with get system status, interface status, routes, DNS, license, and FortiGuard connectivity.
  • Confirm SMTP reachability and policy matching before deep debugging. A relay-denied error is a policy or authentication problem, not antivirus.
  • Use packet capture (diagnose sniffer packet) to prove whether packets arrive, and SMTP daemon debug (diagnose debug application smtpd) to see session handling. Turn debug off afterward.
  • Check queue and disk usage when mail is delayed; a full disk can stop logging or mail processing.

Worked example

Users report outbound delay after a firewall change. Check get system status and interface status, then confirm the route to the smart host. Use a packet capture on port 25 to see whether FortiMail connects outbound. If connections time out, the firewall or DNS is the likely cause; if sessions complete but queue, check relay host settings and policy action. Reason: proving the packet path separates network faults from policy and application faults.

Traps

  • Assuming HA synchronizes mailboxes or quarantine data.
  • Restoring a config to a different firmware release.
  • Leaving debug enabled and filling logs or degrading performance.
  • Treating every delay as antispam when the queue or DNS is at fault.
  • Backing up only before changes and never after.