Fortinet black logo

CLI Reference

profile impersonation

profile impersonation

Email impersonation is one of the email spoofing attacks. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.

To fight against email impersonation, you can map high valued target display names with correct email addresses and FortiMail can check for the mapping. For example, an external spammer wants to impersonate the CEO of your company(ceo@company.com). The spammer will put "CEO ABC <ceo@external.com>" in the Email header From, and send such email to a user(victim@company.com). If FortiMail has been configured with a manual entry "CEO ABC"/"ceo@company.com" in an impersonation analysis profile to indicate the correct display name/email pair, or it has learned display name/email pair through the dynamic process, then such email will be detected by impersonation analysis, because the spammer uses an external email address and an internal user's display name.

You can also add empt entries to force the FortiMail to skip impersonation analysis.

There are two ways to do the mapping:

  • Manual: you manually enter mapping entries and create impersonation analysis profiles as described below.
  • Dynamic: FortiMail Mail Statistics Service can automatically learn the mapping.

Syntax

config impersonation

edit <name>

config entry

edit <entry>

set display-name

set display-name-type

set email-address

config exempt

edit <entry>

set display-name

set display-name-type

set email-address

end

Variable

Description

Default

<name>

Enter the profile name.

<entry>

Enter the profile entry

display-name

Enter the display name to be mapped to the email address. You can use the wildcard or regular expression.

display-name-type

Enter the display name pattern

email-address

Enter the email address to be mapped to the display name. The email address can be from protected/internal domains or unprotected/external domains.

profile impersonation

Email impersonation is one of the email spoofing attacks. It forges the email header to deceive the recipient because the message appears to be from a different source than the actual address.

To fight against email impersonation, you can map high valued target display names with correct email addresses and FortiMail can check for the mapping. For example, an external spammer wants to impersonate the CEO of your company(ceo@company.com). The spammer will put "CEO ABC <ceo@external.com>" in the Email header From, and send such email to a user(victim@company.com). If FortiMail has been configured with a manual entry "CEO ABC"/"ceo@company.com" in an impersonation analysis profile to indicate the correct display name/email pair, or it has learned display name/email pair through the dynamic process, then such email will be detected by impersonation analysis, because the spammer uses an external email address and an internal user's display name.

You can also add empt entries to force the FortiMail to skip impersonation analysis.

There are two ways to do the mapping:

  • Manual: you manually enter mapping entries and create impersonation analysis profiles as described below.
  • Dynamic: FortiMail Mail Statistics Service can automatically learn the mapping.

Syntax

config impersonation

edit <name>

config entry

edit <entry>

set display-name

set display-name-type

set email-address

config exempt

edit <entry>

set display-name

set display-name-type

set email-address

end

Variable

Description

Default

<name>

Enter the profile name.

<entry>

Enter the profile entry

display-name

Enter the display name to be mapped to the email address. You can use the wildcard or regular expression.

display-name-type

Enter the display name pattern

email-address

Enter the email address to be mapped to the display name. The email address can be from protected/internal domains or unprotected/external domains.