Install Guide. FortiMail Version 3.0 MR2.

Transcription

1 Install Guide FortiMail Version 3.0 MR2

2 FortiMail Install Guide Version 3.0 MR2 12 December Copyright 2007 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet, Inc. Trademarks ABACAS, APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGuard, FortiGuard-Antispam, FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. Regulatory compliance FCC Class A Part 15 CSA/CUS! CAUTION: Risk of Explosion if Battery is replaced by an Incorrect Type. Dispose of Used Batteries According to the Instructions.

3 Contents Contents Introduction... 7 Register your FortiMail unit... 7 About the FortiMail unit... 7 FortiMail FortiMail FortiMail-2000/2000A... 8 FortiMail-4000/4000A... 8 About this document... 8 Document conventions... 9 FortiMail documentation... 9 Fortinet Knowledge Center Comments on Fortinet technical documentation Customer service and technical support Concepts FortiMail modes Gateway mode Transparent mode Server mode protocols POP IMAP SMTP Definitions MX record A record MTA MUA White and Black lists Grey lists Bayesian scanning Heuristic scanning Installing Environmental specifications Cautions and warnings Grounding Rack mount instructions

4 Contents Mounting FortiMail FortiMail FortiMail-2000A and FortiMail-4000A Plugging in the FortiMail unit FortiMail FortiMail FortiMail-2000/A and FortiMail-4000/A Connecting to the network Turning off the FortiMail unit Connecting to the FortiMail unit Web-based manager Command line interface LCD front control buttons Configuring the FortiMail unit Management modes Quick Start wizard Configuring gateway mode Switching to gateway mode FortiMail Gateway behind a firewall Configuring the network settings Configuring the system settings Configuring the firewall Routing outgoing to the FortiMail Gateway Next Steps FortiMail Gateway in front of a firewall Configuring the network settings Configuring the system settings Configuring the firewall Routing outgoing to the FortiMail Gateway Next Steps FortiMail Gateway in the DMZ Configuring the network settings Configuring the system settings Configuring the firewall Routing outgoing to the FortiMail Gateway Next Steps Configuring transparent mode Switching to transparent mode

5 Contents Deploying in front of an server Configuring the network settings Configuring the system settings Configuring proxies Next Steps Deploying to protect an hub Configuring the network settings Configuring the system settings Configuring proxies Next Steps Configuring server mode Switching to server mode Configuring MX records to route incoming FortiMail Server behind a firewall Configuring the network settings Configuring the system settings Configuring the firewall Next Steps FortiMail Server in front of a firewall Configuring the network settings Configuring the system settings Configuring the firewall Next Steps FortiMail Server in DMZ Configuring the network settings Configuring the system settings Configuring the firewall Next Steps Advanced configuration Set the date and time Updating antivirus signatures Receiving regular antivirus updates Configuring push updates Scheduling antivirus updates Configuring antispam Black/White lists Bayesian scanning Heuristic scanning

6 Contents Create profiles Antispam profile Antivirus profile Applying profiles Create policies Add users (Server mode) Adding users Adding groups Adding user alias Firmware Backing up the FortiMail information Back up the configuration Back up the Bayesian database Back up the Black/White list database Back up the FortiMail mail queue Using the web-based manager Upgrading the firmware Reverting to a previous firmware version Using the CLI Upgrading the firmware Reverting to a previous firmware version Installing firmware images from a system reboot Testing a new firmware image before installing it Installing and using a backup firmware image Index

7 Introduction Register your FortiMail unit Introduction Welcome, and thank you for selecting Fortinet products for your real-time network protection. The FortiMail Secure Messaging Platform is an integrated hardware and software solution that provides powerful and flexible antispam, antivirus, archiving and logging capabilities to incoming and outgoing traffic. The FortiMail unit has reliable and high performance features for detecting and blocking spam messages and malicious attachments. Built on the Fortinet award winning FortiOS and FortiAsic technology, the FortiMail antivirus technology extends full content inspection capabilities to detect the most advanced threats. Register your FortiMail unit Before your begin, take a moment to register your FortiMail unit(s) by visiting and select Product Registration. To register, enter your contact information and the serial numbers of the FortiMail units that you or your organization have purchased. You can register multiple FortiMail units in a single session without re-entering your contact information. By registering your FortiMail unit, you will receive antivirus updates and will also ensure your access to technical support, as well as access to new firmware releases. For more information, see the Fortinet Knowledge Centre article Registration Frequently Asked Questions ( About the FortiMail unit The FortiMail family of appliances are designed for any business size and requirement, from a Small Business or Small Office Home Office (SOHO) to larger businesses, and deliver the same enterprise-class network-based antivirus and antispam features. FortiMail is an security system that provides multi-layered protection against blended threats comprised of spam, viruses, worms and spyware. To ensure up to date protection, FortiMail relies on Fortinet FortiGuard antivirus, antispyware and antispam security subscription services that are powered by a worldwide 24x7 Global Threat Research Team. FortiMail provides bi-directional routing, Quality of Service (QoS), virtualization and archiving capabilities with a lower total cost of ownership

8 About this document Introduction FortiMail-100 The FortiMail-100 is an easy-to-deploy and easy-to-administer solution that delivers exceptional value and performance for small office, home office and branch office applications. The FortiMail-100 delivers reliable and high performance features to detect, tag, and block spam messages and their malicious attachments. FortiMail-400 FortiMail-2000/2000A FortiMail-4000/4000A The FortiMail-400 is optimized for medium sized enterprise customers, delivering a wealth of reliable and high performance features to detect, tag, and block spam messages and their malicious attachments. The FortiMail-400 features a high-performance hardened operating system with RAID storage system for redundancy and supports a rich set of multi-layered spam detection and filtering technologies with global and per-user spam policies for maximum configuration flexibility. For larger installations where higher performance and better reliability is required, the FortiMail-2000/2000A system provides the same software features as the FortiMail-400, but with a modular chassis with hot swappable components. Ideal for the most demanding infrastructures, the FortiMail-2000/2000A system delivers high performance for large enterprises and service providers, which includes the performance capability to scan 6.8 million s per day, with six hot swappable disk drives with RAID for disk redundancy, and redundant power supplies and fans. Four 10/100/1000 Base-T interfaces, provides the flexibility to connect into many corporate or service provider environments. For larger installations where higher performance and better reliability is required, the FortiMail-4000/4000A system provides the same software features as the FortiMail Ideal for the most demanding infrastructures, the FortiMail-4000/4000A system delivers high performance for large enterprises and service providers, which includes the performance capability to scan 6.8 million s per day, with 12 hot swappable disk drives with RAID for disk redundancy, and redundant power supplies. Two 10/100/1000 Base-T interfaces, provides the flexibility to connect into many corporate or service provider environments. About this document This document explains how to install and configure your FortiMail unit onto your network. This document contains the following chapters: Installing Describes setting up, and powering on a FortiMail unit. Concepts Describes the three modes you can select from to operate the FortiMail unit and briefly describes some terminology for administrators and users new to administration and setup

9 Introduction FortiMail documentation Document conventions Configuring gateway mode Describes a number of network configuration scenarios and how to configure the FortiMail unit and network to operate in this mode. Configuring transparent mode Describes a number of network configuration scenarios and how to configure the FortiMail unit to operate in this mode. Configuring server mode Describes a number of network configuration scenarios and how to configure the FortiMail unit and network to operate in this mode. Advanced configuration Describes next step configurations you need to consider to ensure is scanned and protected from viruses. The following document conventions are used in this guide: In the examples, private IP addresses are used for both private and public IP addresses. Notes and Cautions are used to provide important information: Note: Highlights useful additional information.! Caution: Warns you about commands or procedures that could have unexpected or undesirable results including loss of data or damage to equipment. Typographic conventions FortiGate documentation uses the following typographical conventions: Convention Keyboard input CLI command syntax Document names Menu commands Program output Variables Example In the Host Name field, type a name for the remote server (for example, Central_Office_1). execute restore image <name_str> <tftp_ipv4> FortiMail Administration Guide Go to Mail Settings > Domains and select Create New. Welcome! <address_ipv4> FortiMail documentation Information about the FortiMail unit is available from the following guides: FortiMail QuickStart Guide Provides basic information about connecting and installing a FortiMail unit and configuring the unit for use on your network

10 Customer service and technical support Introduction Fortinet Knowledge Center FortiMail Administration Guide Describes how to install, configure, and manage a FortiMail unit in Transparent, Gateway, and Server modes, including how to configure the unit, create profiles and policies, configure antispam and antivirus filters, create user accounts, configure archiving, and set up logging and reporting. FortiMail Installation Guide Describes how to set up the FortiMail unit in Transparent, Gateway, and Server modes. It also provides information on how to use system settings to view FortiMail unit status and configure how the FortiMail unit connects to your network and to the Internet. FortiMail Online Help Provides a searchable version of the Administration Guide in HTML format. You can access online help from the web-based manager as you work. FortiMail Webmail Online Help Describes how to use the FortiMail web-based client, including how to send and receive ; how to add, import, and export addresses; how to configure message display preferences, and how to manage quarantined . Additional Fortinet technical documentation is available from the Fortinet Knowledge Center. The knowledge center contains troubleshooting and how-to articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at Comments on Fortinet technical documentation Please send information about any errors or omissions in this document, or any Fortinet technical documentation, to techdoc@fortinet.com. Customer service and technical support Fortinet Technical Support provides services designed to make sure that your Fortinet systems install quickly, configure easily, and operate reliably in your network. Please visit the Fortinet Technical Support web site at to learn about the technical support services that Fortinet provides

11 Concepts FortiMail modes Concepts If you are new to FortiMail, or new to the configuration and managing of an system, this chapter provides basic concepts and terminology and to configure your FortiMail unit. This chapter provides an overview of the FortiMail unit, the modes it supports and its key features. This chapter will also describe the key terms and concepts that you will use when configuring your FortiMail unit. If you are familiar with concepts and terminology, you can skip to the section FortiMail modes on page 11, which describes the modes of operation available with FortiMail. This chapter contains the following: FortiMail modes protocols Definitions FortiMail modes Gateway mode The FortiMail unit can run in one of three modes: Gateway mode Transparent mode Server mode. With Gateway and Transparent mode, the FortiMail unit sits between the firewall and server and acts as a filter for passing through it. Depending on how you choose to deploy the FortiMail unit, determines which of these modes best suits your environment. Of the three modes, Server mode functions very differently from Gateway and Transparent mode. With Server mode, the FortiMail unit is the server as well as the means of scanning the traffic. For all modes, the FortiMail unit scans traffic for viruses and spam, and can quarantine suspicious and attachments. In gateway mode the FortiMail acts as a fully functional mail relay server. Gateway mode does not provide local mailboxes but does provide a web user interface for managing spam filters (black/white list), auto white lists, and per-user Bayesian database management. In Gateway mode, the FortiMail unit receives incoming messages, scans for viruses and spam, then passes (relays) the to the server for delivery. In this mode, the FortiMail unit can effectively protect your server as your server is not visible to outside users. The FortiMail unit can also archive for backup and monitoring purposes. The FortiMail unit integrates into your existing network with only minor changes to your network configuration. You must also change your MX record to route incoming to the FortiMail unit for scanning

12 FortiMail modes Concepts Figure 1: Gateway mode topology Mail Users (POP3/IMAP/Web Mail) Mail Server Hub Internet Gateway Mode Transparent mode For example, an ISP deploys a FortiMail unit to protect their customers mail servers. Many customers do not want their mail servers to be visible to external users for security reasons. Therefore, the ISP installs the FortiMail unit in Gateway mode to satisfy the need of the customers. The ISP takes advantage of the Gateway mode deployment flexibility and places the FortiMail unit in the DMZ, while keeping the server safe behind the firewall. For sample configuration information, see the chapter Configuring gateway mode on page 29. In Transparent mode, the FortiMail unit acts as a bridge, providing seamless integration into existing network environments. In Transparent mode, the FortiMail unit provides a flexible and versatile scanning solution. You can place the FortiMail unit in front of the existing server without any changes to the existing network topology. This means that all of the FortiMail interfaces are on the same subnet. Transparent mode also provides a web user interface for managing spam filters (black/white list), auto white lists, and per-user Bayesian database management

13 Concepts protocols Figure 2: Transparent mode topology Transparent mode Router Internet Mail Server Mail Users (POP3/IMAP/Web Mail) For example, a company wants to install a FortiMail unit to protect its mail server. The company installs the FortiMail unit in Transparent mode to avoid changing its MX record to route to the FortiMail unit, and to simply act as a filter for spam and virus related . With this mode, the company s end users do not need to change the mail server setting on their client. The company also wants its mail server to be visible to the users to increase the company s popularity. For sample configuration information, see the chapter Configuring transparent mode on page 55. Server mode In server mode the FortiMail unit is a fully functional SMTP, IMAP, POP3 mail server with local mail boxes and an optional WebMail user interface. In addition, the FortiMail Server provides antivirus, antispam, archiving, and logging and reporting services. For sample configuration information, see the chapter Configuring server mode on page 65. protocols An protocol is a standard method for two ends of a communication channel to transmit and receive information. There are three standard protocols, POP3, IMAP and SMTP. Each has its own pros and cons, as well as application uses. POP3 The Post Office Protocol (version 3) enables users to retrieve their stored on a mail server. Once application retrieves the messages, the server removes the message from the server s hard disk. POP3 transmissions occur over port 110 by default. The advantage of POP3 is that users download their to their local machine, releasing hard disk space from the server. The disadvantage, is the mail resides on a single computer. Users who use an alternate computer to check cannot access the mail they viewed, and downloaded, previously

14 Definitions Concepts The FortiMail unit supports the POP3 protocol on port 110 in server mode only. If necessary, you can change the default port in the Mail Settings > Settings menu. IMAP SMTP Internet Message Access Protocol is a method of accessing messages kept on a remote mail server without downloading the messages to the user s local computer. All messages remain on the server s hard disk. With IMAP only the headers of messages are downloaded to the user s application inbox on their computer. The advantage of this is that it enables a user to access new and saved messages at any time from more than one computer. This is especially useful in situations where more than one person may need to look at an inbox, such as a technical support inbox where a number of technicians monitor for incoming questions. The disadvantage of IMAP storing messages is the large storage capacity required for storing and attachments. To free up disk space requires users to manually clean their inbox. The FortiMail unit supports the IMAP protocol on port 143 in server mode only. Simple Mail Transfer Protocol is the standard for sending between to servers using port 25. When a user sends an , a connection between the sending server and the receiving server is established. Both servers communicate to determine whether the recipient user exists, and if the can be sent. If the address is legitimate then the transfer of data/ message follows. FortiMail only supports SMTP authentication because it has no local user accounts. Instead, it uses external server types to authenticate such as POP3. SMTP authentication is enabled during the installation process in server mode only. FortiMail also supports SMTP over SSL/TLS which allows for the exchange of encrypted mail. This feature is available in all three modes. Definitions When you configure the FortiMail unit by following the steps in the subsequent chapters of this guide, there are a number of terms that you should be familiar with before preceding. MX record Mail Exchange Records are used to route s to specific destinations. It is an entry in a domain name database such as a Domain Name System or DNS server. A DNS server acts much like a phone book containing data on how to reach different domains and it is usually made accessible by internet server providers (ISP). If a local DNS server exists, MX Records can be added or changed on the DNS server using one of several user interfaces depending on the operating system used

15 Concepts Definitions In FortiMail, MX Records are configured by the administrator by going to Mail Settings > Domains. When gateway and server mode are used, the MX Records are changed so that s are routed to the FortiMail unit for scanning before they reach the mail server. In gateway and transparent modes, FortiMail can be set up to protect multiple domains. MX Records are used to identify these domains and are configured by going to Mail Settings > Domains. When an is sent out, the sender s mail server performs a DNS lookup using the recipients domain name, for example, user1@example.com and acquires the MX Record. Example of MX Record entry: (example.com 3600 IN MX 50 docs.example.com) The MX Record contains the domain and host names (docs.example.com). This information is used to send the to the recipients mail server which stores it until it is downloaded. A record MTA MUA The A record is an entry that assigns an internet protocol or IP address to a domain name. Much like a phone number is assigned to a specific name in a phone book entry. IP addresses are used to locate devices such as computers and servers. The A Records are stored and configured on DNS server. The administrator can configure these records using one of several user interfaces depending on the operating system used. Before is sent out, the server looks for the recipient s MX and A Records in the DNS server by the senders mail server. Then using the A record entry, the server sends the to the recipient using the corresponding domain name s IP address. Example of an A record: (docs.example.com IN A ) The Mail Transfer Agent is a software agent or mail server that transfers messages from one computer to another. It works in the background and in conjunction with clients. In order to deliver to the right recipient, the MTA looks up the MX Record and the corresponding A Records in the DNS server. FortiMail functions as an MTA or fully functional SMTP, IMAP, POP3 mail server when configured in server mode. It provides local mail boxes and optional Web Mail user interfaces. The Mail User Agent refers to a computer application or client such as Outlook Express that enables users to send and receive . FortiMail unit provides a web based client interface. However, FortiMail can be used with any other type of clients available as well as web based clients

16 Definitions Concepts White and Black lists Grey lists Bayesian scanning While the FortiMail unit and FortiGuard services maintain a large list of known spammers, it is not perfect. In some cases, some mail tagged as spam is an individual you want to receive mail from, while that is not caught by the spam filters or users you don t want to receive from gets through to your inbox. White lists and black lists enable you and users to maintain a list of addresses that you want (white list) or don t want (black list) to receive from. FortiMail enables you and your users to maintain these lists to meet their requirements. Addresses can be added or removed from lists as required. For details on adding a white list and black list, see Black/White lists on page 88. Grey listing is a means of reducing spam in a relatively low maintenance manner. There are no IP address lists, lists, or word lists to keep up to date. The only required list is automatically maintained by the FortiMail unit. When examining an message, the grey list routine looks at three message attributes: the sender address, the recipient address, and the IP address of the mail server delivering the message. More specifically, the grey list routine examines the envelope from (Mail From:), the envelope recipient (Rctp to:), and the sender IP. If the grey list routine doesn't have a record of a message with these three values, the message is refused and a temporary error is reported to the server attempting delivery. If the sending server sends the message again within a specific time frame, the FortiMail unit will consider the valid and add it as an accepted sender. If further attempts are not made, the FortiMail unit considers it a spammer. The grey list feature has two compelling attributes: Extremely low administrator maintenance. Spam detection routines do not have to be run on mail stopped by grey listing. This can save significant processing and storage resources. Bayesian scanning is a method of teaching the FortiMail unit what is a spam and what is not. Bayesian training uses Bayes' theorem of probability. Using this theorem the spam filters take into account the type of words used in spam messages versus those that are not. For every word in these messages, it calculates the probability of a scanned message being spam based on the proportion of spam occurrences. Bayesian training is a manual process by the admin or users. For each received, an user will tell the filter whether it is a good , spam, or a false positive. The more training, that is, the more a user sends indicating its status, the more efficient the spam filter will be. For details on setting up Bayesian training, see Bayesian scanning on page

17 Concepts Definitions Heuristic scanning While Bayesian training is a manual procedure of teaching the spam filters what to look for in messages for spam, the Heuristic filtering uses a scoring technique based on predetermined terms and words. The rules are broken down into 5 categories: header, body, raw body, URI, and metadata. Each rule has an individual score used to calculate the total score for an . To determine if an is spam, the heuristic filter looks at an message and adds the score for each rule that applies to get a total score for that . If the total is greater than or equal to the upper threshold, the mail is classified as spam and processed accordingly. For more information on configuring Heuristic scanning, see Heuristic scanning on page

18 Definitions Concepts

19 Installing Environmental specifications Installing This chapter provides information on mounting and connecting the FortiMail unit to your network. This chapter includes the following topics: Environmental specifications Cautions and warnings Mounting Plugging in the FortiMail unit Turning off the FortiMail unit Connecting to the FortiMail unit Environmental specifications Operating temperature: 32 to 104 F (0 to 40 C) If you install the FortiMail unit in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient temperature. Therefore, make sure to install the equipment in an environment compatible with the manufacturer's maximum rated ambient temperature. Storage temperature: -13 to 158 F (-25 to 70 C) Humidity: 5 to 90% non-condensing Air flow - For rack installation, make sure that the amount of air flow required for safe operation of the equipment is not compromised. For free-standing installation, make sure that the FortiMail unit has sufficient clearance on each side to allow for adequate air flow and cooling. Cautions and warnings Review the following cautions before installing your FortiMail unit. Grounding Ensure the FortiMail unit is connected and properly grounded to a lightning and surge protector. WAN or LAN connections that enter the premises from outside the building should be connected to an Ethernet CAT5 (10/100 Mb/s) surge protector. Shielded Twisted Pair (STP) Ethernet cables should be used whenever possible rather than Unshielded Twisted Pair (UTP). Do not connect or disconnect cables during lightning activity to avoid damage to the FortiMail unit or personal injury

20 Mounting Installing Rack mount instructions Elevated Operating Ambient - If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient temperature. Therefore, consideration should be given to installing the equipment in an environment compatible with the maximum ambient temperature (Tma) specified by the manufacturer. Reduced Air Flow - Installation of the equipment in a rack should be such that the amount of air flow required for safe operation of the equipment is not compromised. Mechanical Loading - Mounting of the equipment in the rack should be such that a hazardous condition is not achieved due to uneven mechanical loading. Circuit Overloading - Consideration should be given to the connection of the equipment to the supply circuit and the effect that overloading of the circuits might have on overcurrent protection and supply wiring. Appropriate consideration of equipment nameplate ratings should be used when addressing this concern. Reliable Earthing - Reliable earthing of rack-mounted equipment should be maintained. Particular attention should be given to supply connections other than direct connections to the branch circuit (e.g. use of power strips). If required to fit into a rack unit, remove the rubber feet from the bottom of the FortiMail unit. Mounting FortiMail-100 FortiMail-400! Adhere the rubber feet included in the package to the underside of the FortiMail unit, near the corners of the unit if not already attached. Place the FortiMail unit on any flat, stable surface. Ensure the FortiMail unit has sufficient clearance on each side to ensure adequate airflow for cooling. The FortiMail unit can be placed on any flat surface, or mounted in a standard 19-inch rack unit. When placing the FortiMail unit on any flat, stable surface, ensure the FortiMail unit has sufficient clearance on each side to ensure adequate airflow for cooling. For rack mounting, use the mounting brackets and screws included with the FortiMail unit. Caution: To avoid personal injury, you may require two or more people to install the unit in the rack

21 Installing Mounting To install the FortiMail unit into a rack 1 Attach the mounting brackets to the side to the unit so that the brackets are on the front portion of the FortiMail unit. Ensure that the screws are tight and not loose. The following photos illustrate how the brackets should be mounted. Note that the screw configuration may vary. Figure 3: Installed mounting brackets 2 Position the FortiMail unit in the rack to allow for sufficient air flow. 3 Line up the mounting bracket holes to the holes on the rack, ensuring the FortiMail unit is level. 4 Finger tighten the screws to attach the FortiMail unit to the rack. 5 Once you verify the spacing of the FortiMail unit and that it is level, tighten the screws with a screwdriver. Ensure that the screws are tight and not loose. Figure 4: Mounting in a rack FortiMail-2000A and FortiMail-4000A To mount the FortiMail unit on a 19 in rack or cabinet, use the slide rails included with the product.! Caution: To avoid personal injury or damage to the FortiMail unit, it is highly recommended a minimum of two people perform this procedure

22 Mounting Installing Mounting requires three steps: disassembling the slide rail from the slide housing attaching the slide rail to the sides of the FortiMail unit mounting the FortiMail unit to the rack or cabinet. Disassembling the slide rail The slide rail assembly has two moving rails within the housing. You need to remove the innermost rail. This rail will attach to the sides of the FortiMail unit. Figure 5: FortiMail side rail Rail housing Sliding Rail To remove the side rail 1 Open the slide rails package and remove the rails. 2 Extend the slide rail and locate the slide rail lock. Rail Lock

23 Installing Mounting 3 Push down on the lock while pulling the rail completely out of the slide rail assembly. 4 Repeat these steps for the other slide rail assembly. You will attach this part to the side of the FortiMail unit. Attaching the slide rail to the FortiMail unit Attach the disconnected slide rails from the previous step to the sides of the FortiMail unit. Use the screws provided with the slide rail package, being sure to securely fasten the rail to the FortiMail chassis. Mounting the FortiMail unit Mounting the FortiMail-2000A or FortiMail-4000A is a two step process. First, you must attached the slide rail housing to the rack or cabinet, then insert the FortiMail unit

24 Plugging in the FortiMail unit Installing To mount the FortiMail unit 1 Mount the slide rail housing to the rack or cabinet frame. Adjust the outside L-shaped brackets for a proper fit. Ensure that both housings are on the same level to ensure the FortiMail unit can easily glide into place and is level. 2 Use the screws and additional L-brackets if required to securely fasten the housing. 3 Position the FortiMail unit so that the back of the unit is facing the rack, and the slide rails affixed in the previous step line up with the slide rail housing. 4 Gently push the FortiMail unit into the rack or cabinet. You will hear a click when the slide rail lock has been engaged. 5 Push the FortiMail unit until it is fully inserted into the rack. Plugging in the FortiMail unit FortiMail-100 The FortiMail-100 does not have a power switch. To power on the FortiMail unit 1 Connect the AC adapter to the power connection at the back of the FortiMail unit. 2 Connect the AC adapter to the power cable. 3 Connect the power cable to a power outlet. The FortiMail unit starts and the Power and Status LEDs light up. The Status LEDs flash while the FortiMail unit starts up, and remain lit when the system is running. FortiMail-400 Use the following steps to connect the power supply to the FortiMail unit. To power on the FortiMail unit 1 Ensure the power switch, located at the back of the FortiMail unit is in the off position, indicated by the O. 2 Connect the power cord at the back of the FortiMail unit. 3 Connect the power cable to a power outlet. 4 Set the power switch on the back left of the FortiMail unit to the on position indicated by the I. After a few seconds, SYSTEM STARTING appears on the LCD. The main menu setting appears on the LCD when the system is running

25 Installing Turning off the FortiMail unit FortiMail-2000/A and FortiMail-4000/A The FortiMail unit does not have an on/off switch. To power on the FortiMail unit 1 Connect the power cables to the power connections on the back of the FortiMail unit. 2 Connect the power cables to power outlets. Each power cable should be connected to a different power source. If one power source fails, the other may still be operative. After a few seconds, SYSTEM STARTING appears on the LCD. The main menu setting appears on the LCD when the system is running. The FortiMail unit starts and the Power and Status LEDs light up. The Status LEDs flash while the FortiMail unit starts up, and remain lit when the system is running. Connecting to the network Note: If only one power supply is connected, an audible alarm sounds to indicate a failed power supply. Press the red alarm cancel button on the rear panel next to the power supply to stop the alarm. Using the supplied Ethernet cable, connect one end of the cable to your router or switch. Connect the other end to port 1 on the FortiMail unit. Turning off the FortiMail unit Always shut down the FortiMail unit properly before turning off the power switch to avoid potential hardware problems. This enables the hard drives to spin down and park correctly and avoid losing data. To power off the FortiMail unit 1 From the web-based manager, go to System > Status. 2 In the System Command display, select Shutdown, or from the CLI enter: execute shutdown 3 Turn off and/or Disconnect the power cables from the power supply. Connecting to the FortiMail unit There are three methods of connecting and configuring the basic FortiMail settings: the web-based manager the command line interface (CLI) the front control buttons and LCD (FortiMail-400 and FortiMail-2000A)

26 Connecting to the FortiMail unit Installing Web-based manager You can configure and manage the FortiMail unit using HTTP or a secure HTTPS connection from any computer using a recent browser. You can use the web-based manager to configure most FortiMail settings, and monitor the status of the FortiMail unit. Use the following procedure to connect to the web-based manager for the first time. Configuration changes made with the web-based manager are effective immediately, without interrupting service. To connect to the web-based manager, you require: a computer with an Ethernet connection any recent version of most popular web browser a crossover Ethernet cable or an Ethernet hub with two Ethernet cables To connect to the web-based manager 1 Set the IP address of the computer with an Ethernet connection to the static IP address with a netmask of Using the crossover cable or the Ethernet hub and cables, connect the internal interface of the FortiMail unit to the computer Ethernet connection. 3 Start the web browser and browse to the address (remember to include the s in To support a secure HTTPS authentication method, the FortiMail unit ships with a self-signed security certificate, and is offered to remote clients whenever they initiate a HTTPS connection to the FortiMail unit. When you connect, the FortiMail unit displays two security warnings in the browser. The first warning prompts you to accept and optionally install the FortiMail unit s self-signed security certificate. If you do not accept the certificate, the FortiMail unit refuses the connection. If you accept the certificate, the FortiMail login page appears. The credentials entered are encrypted before they are sent to the FortiMail unit. If you choose to accept the certificate permanently, the warning is not displayed again. Just before the FortiMail login page is displayed, a second warning informs you that the FortiMail certificate distinguished name differs from the original request. This warning occurs because the FortiMail unit redirects the connection. This is an informational message. Select OK to continue logging in. 4 Type admin in the Name field and select Login. Command line interface You can access the FortiMail command line interface (CLI) by connecting a management computer serial port to the FortiMail serial console connector. You can also use Telnet or an SSH connection to connect to the CLI from any network that is connected to the FortiMail unit, including the Internet. As an alternative to the web-based manager, you can install and configure the FortiMail unit using the CLI. Configuration changes made with the CLI are effective immediately, without interrupting service

27 Installing Connecting to the FortiMail unit To connect to the FortiMail CLI you require: a computer with an available communications port the DB-9 or RJ-45 to DB-9 cable included in your FortiMail package terminal emulation software such as HyperTerminal for Microsoft Windows Note: The following procedure uses Microsoft Windows HyperTerminal software. You can apply these steps to any terminal emulation program. To connect to the CLI 1 Connect the console cable to the communications port of your computer and to the FortiMail console port. 2 Start HyperTerminal, enter a name for the connection and select OK. 3 Configure HyperTerminal to connect directly to the communications port on your computer and select OK. 4 Select the following port settings and select OK: Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None 5 Press Enter to connect to the FortiMail CLI. The login prompt appears. 6 Type admin and press Enter twice. The following prompt is displayed: Welcome! Type? to list available commands. For information about how to use the CLI, see the FortiMail CLI Reference. LCD front control buttons You can use the front control buttons and LCD on the FortiMail-400 and FortiMail-2000A to configure IP addresses, default gateways and switch operating modes. The LCD shows you what mode you are in without having to go to the command line interface or the web-based manager. This configuration method provides an easy and fast method to configure your FortiMail unit. You can configure: IP addresses and netmasks default gateways operating modes restore factory default settings The front control buttons control how you enter and exit the different menus when configuring the different ports and interfaces. The front control buttons also enables you to increase or decrease each number for configuring IP addresses, default gateway addresses, or netmasks. The following table defines each button and what it does when configuring the basic settings of your FortiMail unit

28 Configuring the FortiMail unit Installing Table 1: Front control button definitions Enter Esc Up Down Enables you to move forward through the configuration process. Enables you to move backward, or exit out of the menu you are in. Allows you to increase the number for an IP address, default gateway address or netmask. Allows you to decrease the number for an IP address, default gateway address or netmask. Configuring the FortiMail unit Management modes Quick Start wizard Once the FortiMail unit is properly mounted, plugged in and connected to the network, you can configure it onto your network. The FortiMail unit can run in three different modes. Each mode has multiple configuration options depending on where you place the unit within your network infrastructure. Each configuration has unique options and settings.this Install Guide contains a chapter for each mode and their configuration options. FortiMail running version 3.0 MR2 and higher of the operating system includes two management modes: basic and advanced. Depending on your familiarity with configuring network or appliances, select the mode that best suits your abilities. You can switch between modes at any time without losing any settings. Basic mode enables you to configure the minimum settings to enable antispam and antivirus protection to your network . Advanced mode provides more robust options, including user configuration, and more detailed antispam and antivirus options. You can use either management mode in all the FortiMail operating modes. If you are new to FortiMail, and this is your first installation, you can use the Quick Start Wizard, available in basic management mode. The Quick Start wizard guides you through the settings necessary to configure the FortiMail unit onto the network, including network configuration, server configuration, and basic antispam and antivirus options. The Quick Start Wizard is available in all FortiMail operating modes. It is recommended that you select the operating mode before running the Quick Start Wizard, as some options are specific to the operating mode. If you switch operating modes after using the Quick Start Wizard, some configuration settings may be lost or be incomplete

29 Configuring gateway mode Switching to gateway mode Configuring gateway mode This chapter describes how to configure a FortiMail unit to operate in gateway mode. In gateway mode the FortiMail unit acts as a fully functional mail relay server. The FortiMail unit receives incoming messages, scans for viruses and spam, then passes (relays) the to the server for delivery. This chapter describes common deployment options for a FortiMail unit running in gateway mode. Use these deployment and configuration examples to install the FortiMail unit on your network, or use them as a guide for your own network topology. Additional configuration information and details are available in the Fortimail Administration Guide. All examples use a FortiGate firewall device. If you are using an alternate firewall appliance, consult the appliance s documentation for completing similar configurations. Note: This chapter uses the FortiMail unit in the advanced management mode. This chapter includes the following: FortiMail Gateway behind a firewall FortiMail Gateway in front of a firewall FortiMail Gateway in the DMZ Switching to gateway mode Use the web-based manager to complete the configuration of the FortiMail unit. You can continue to use the web-based manager for all FortiMail settings. Before you being configuring the FortiMail unit, ensure the mode is in gateway mode. To verify, go to System > Status and check the Operation Mode. To change the operation mode 1 Go to System > Status. 2 Select Change for the Operation Mode. 3 Select Gateway from the list and select OK

30 FortiMail Gateway behind a firewall Configuring gateway mode FortiMail Gateway behind a firewall The FortiMail unit is positioned behind a FortiGate firewall. With the FortiMail unit set up this way, the firewall blocks any attacks on the FortiMail unit and the server. Incoming and outgoing is routed through the FortiMail unit for scanning before being sent to the server or the Internet. Figure 6: FortiMail Gateway behind firewall Server Switch Internal External Internet Firewall Router Configuring the network settings Use the following table to gather the information you need to customize the gateway mode settings. Table 2: Gateway mode settings Administrator Password: DNS Server Port 1 Port 2 Port 3 Port 4 Port 5 Port 6 IP: Netmask: IP: Netmask: IP: Netmask: IP: Netmask: IP: Netmask: IP: Netmask:

31 Configuring gateway mode FortiMail Gateway behind a firewall Network settings Default Gateway: The management IP address and netmask must be valid for the network from which you will manage the Fortimail unit. Add a default gateway if the FortiMail unit must connect to a router to reach the management computer. Primary DNS Server: Secondary DNS Server: You must configure at least one network interface to connect the FortiMail unit to the network. Connect the Port 1 interface to your internal network hub or switch. The IP address of Port 1 must be on the same subnet (address range) as the network and cannot use the same address as another device or computer on the network. Configuring a static IP address To configure a network interface with a static IP address 1 Go to System > Network > Interface. 2 Select Modify for Port 1. 3 Select Manual Addressing Mode. 4 Enter the IP address and netmask. 5 Select OK. If you changed the IP address of the interface that you are connecting to manage the FortiMail unit, you must reconnect to the web-based manager using the new IP address. Configuring an interface for DHCP You can configure any FortiMail interface to acquire its IP address from a Dynamic Host Configuration Protocol (DHCP) server. Your Internet Service Provider (ISP) may provide IP addresses using one of these protocols. DHCP is used to obtain IP addresses from a DHCP server, such a from your ISP. Obtaining an IP address from a DHCP server ensures that the IP address for the FortiMail unit is unique and not assigned to another device, such as your FortiGate unit or other firewall device that is also connected directly to the Internet. When configured, the FortiMail unit automatically broadcasts a DHCP request. By default, the FortiMail unit also retrieves a default gateway IP address and DNS server IP addresses from the DHCP server. You can disable this option if required to configure them manually. To configure an interface for DHCP 1 Go to System > Network > Interface. 2 Select Modify for Port 1. 3 Select DHCP. 4 If required, select Retrieve default gateway and DNS from server to disable this option. 5 Select OK