policy access-control receive
Use this command to configure access control policies that apply to SMTP sessions being received by the FortiMail system (initiated by SMTP clients).
Access control policies, sometimes also called the access control list or ACL, specify whether the FortiMail unit will process and relay/proxy, reject, or discard email messages in SMTP sessions.
When an SMTP client tries to send email through the FortiMail unit, the FortiMail unit compares each access control policy to the commands used by the SMTP client during the SMTP session, such as the:
-
sender email address in the SMTP envelope (
MAIL FROM:) -
recipient email address in the SMTP envelope (
RCPT TO:) -
domain name of the SMTP client that is delivering the email (
HELO/EHLO) -
authentication (
AUTH) -
session encryption (
STARTTLS)
If sender-option {envelope-from | header-from | envelope-or-header-from} is configured, then the sender email address in the message headers (From:) may also be compared.
Policies are evaluated for a match in sequential order, from top to bottom of the list. If all attributes of a policy match, then the FortiMail unit applies the action in the policy or TLS profile, and stops match evaluation. Remaining access control policies, if any, are not applied.
Only one access control policy is applied to an SMTP session.
|
If no access control rules exist, or none match, then the action varies by whether the SMTP client authenticated:
The default action varies by whether or not the recipient email address in the SMTP envelope (
See also domain. |
Rejecting unauthenticated SMTP clients that send email to unprotected domains prevents your email service from becoming an open relay. Open relays are abused by spammers, and therefore DNSBLs block them, so this FortiMail behavior helps to protect the reputation of your email server. Senders can deliver email incoming to your protected domains, but cannot deliver email outgoing to unprotected domains
If you want to allow your email users or email servers to send email to unprotected domains, then you must configure at least one access control policy. You may need to configure more access control rules if, for example, you want to discard or reject email from specified:
-
email addresses, such as ones that no longer exist in your protected domain
-
SMTP clients, such as a spammer that is not yet known to public blocklists
Like IP-based policies, access control policies can reject connections based on IP address.
Unlike IP-based policies, however, access control rules cannot affect email in ways that occur after the session’s DATA command, such as by applying antispam profiles. Access control rules also cannot be overruled by recipient-based policies, and cannot match connections based on the SMTP server (which is always the FortiMail unit itself, unless the FortiMail unit is operating in transparent mode). For more information on IP-based policies, or the sequence in which access control policies are used relative to other antispam methods, see the FortiMail Administration Guide.
|
Do not create an access control policy where:
This creates an open relay, which could result in other MTAs and DNSBL servers blocklisting your protected domain. |
Syntax
config policy access-control receive
edit <policy_name>
[set comment "<comment_str>"]
set sender-pattern-type {default | external | group | internal | ldap | ldap-query | regexp}
set sender-option {envelope-from | header-from | envelope-or-header-from}
set sender-pattern <sender_pattern>
set sender-pattern-group <group_name>
set sender-pattern-ldap-groupname <group_name>
set sender-pattern-ldap-profile <profile_name>
set recipient-pattern-type {default | external | group | internal | ldap | ldap-query | regexp}
set recipient-pattern <recipient_pattern>
set recipient-pattern-group <group_name>
set recipient-pattern-ldap-groupname <group_name>
set recipient-pattern-ldap-profile <profile_name>
set sender-ip-type {geoip-group | ip-group | ip-mask | isdb | ldap-query}
set sender-geoip-group <group_name>
set sender-ip-group <ip-group_name>
set sender-ip-mask <client_ipv4/mask>
set sender-ip-ldap-profile <profile_name>
set reverse-dns-type {ldap-query | regexp | wildcard}
set reverse-dns-pattern <client-fqdn_pattern>
set reverse-dns-ldap-profile <profile_name>
set forged-ip-check {any | fail | pass}
set authenticated {any | authenticated | not-authenticated}
set tls-profile <profile_name>
set action {discard | receive | reject | relay | safe | safe-relay}
end
|
Variable |
Description |
Default |
||
|
Enter the number that identifies the policy. The identifier number may be different from the order of evaluation. FortiMail units evaluate these policies in sequential order, starting at the top of the list. Only the first matching policy is applied. For example, if you enter: move 15 before 1 then policy 15 is evaluated for a match before policy 1. To show the order of evaluation for the list of policies, enter: get |
|
|||
|
action {discard | receive | reject | relay | safe | safe-relay} |
Select which action the FortiMail system will perform for SMTP sessions that match this policy:
|
reject |
||
|
Select whether to match this policy based upon whether SMTP clients have authenticated with the FortiMail system, either:
|
any |
|||
|
Enter a description or comment. |
|
|||
|
When the forged IP check is enabled, FortiMail will perform a reverse ( Select which of the following forged IP check results will be matched to this policy:
If the DNS queries fail, or the result does not match this setting, then the policy does not match.
|
any |
|||
|
Enter the group of recipient email addresses. This setting is available only if |
|
|||
|
Enter the group of recipient email addresses that is in the directory server. This setting is available only if |
|
|||
|
Select which LDAP profile to use. This setting is available only if
|
|
|||
|
recipient-pattern-type {default | external | group | internal | ldap | ldap-query | regexp} |
Select how you will define the recipient email addresses that match the policy. Options are the same as |
default |
||
|
Enter an email address or pattern. Formatting is the same as This setting is available only when |
* |
|||
|
Select which LDAP profile to use. This setting is available only if Note: Use |
|
|||
|
Depending on which pattern you selected in
This setting is available only if |
* |
|||
|
Select how you will define the FQDN of SMTP clients that match this policy, either:
Because the domain name in the SMTP session greeting ( Note: The domain name must be a valid top level domain (TLD). For example, “.lab” is not valid because it is reserved for testing on RFC 1918 private networks, not the Internet. Thus a reverse DNS query to public DNS servers on the Internet will always fail. |
wildcard |
|||
|
Select a geographic IP address group. This setting is only available if |
|
|||
|
Enter the IP group of the SMTP client attempting to send the email message. This option only appears if |
|
|||
|
Select which LDAP profile to use. This setting is available only if Note:Use |
|
|||
|
Enter the IP address and netmask of the SMTP client. For example, you can enter Similarly, if you enter To match any address, enter This setting is only available if |
0.0.0.0/0 |
|||
|
sender-ip-type {geoip-group | ip-group | ip-mask | isdb | ldap-query} |
Select how you will define the source IP address of SMTP clients that match this policy, either:
|
ip-mask |
||
|
Select a service name. The Internet Service Database (ISDB) from FortiGuard is an automatically updated list of IP addresses and subnets used by popular services such as 8x8, Akamai, Microsoft 365, and more. To display the list of options for currently known services, enter: set sender-isdb ? This setting is only available if |
8x8 |
|||
|
sender-option {envelope-from | header-from | envelope-or-header-from} |
Select which sender email addresses to compare for a policy match, either:
This setting is available only if |
envelope-from |
||
|
Enter the group of recipient email addresses. This setting is available only if |
|
|||
|
Enter the group of recipient email addresses that is in the directory server. This setting is available only if Note: Use |
|
|||
|
Select which LDAP profile to use. This setting is available only if |
|
|||
|
sender-pattern-type {default | external | group | internal | ldap | ldap-query | regexp} |
Select how you will define the sender email addresses that match the policy, either:
|
default |
||
|
Depending on your selection in
This setting is only available if |
* |
|||
|
Enable or disable the policy. |
enable |
|||
|
If you want to allow or reject the connection based on whether the session attributes matches TLS profile, then select the TLS profile.
|
|
