policy access-control receive
Use this command to configure access control rules that apply to SMTP sessions being received by the FortiMail unit.
Access control rules, sometimes also called the access control list or ACL, specify whether the FortiMail unit will process and relay/proxy, reject, or discard email messages for SMTP sessions that are initiated by SMTP clients.
When an SMTP client attempts to deliver email through the FortiMail unit, the FortiMail unit compares each access control rule to the commands used by the SMTP client during the SMTP session, such as the envelope’s sender email address (MAIL FROM:), recipient email address (RCPT TO:), authentication (AUTH), and TLS (STARTTLS). Rules are evaluated for a match in the order of their list sequence, from top to bottom. If all the attributes of a rule match, the FortiMail unit applies the action selected in the matching rule to the SMTP session, and no subsequent access control rules are applied.
Only one access control rule is ever applied to any given SMTP session.
For protected domains, the default action is RELAY.
For unprotected domains, the default action is REJECT.
Without any configured access control rules, the FortiMail unit’s access control prevents SMTP clients from using your protected server or FortiMail unit as an open relay: senders can deliver email incoming to protected domains, but cannot deliver email outgoing to unprotected domains.
If you want to allow SMTP clients such as your email users or email servers to send email to unprotected domains, you must configure at least one access control rule.
You may need to configure additional access control rules if, for example, you want to:
- discard or reject email from or to some email addresses, such as email addresses that no longer exist in your protected domain
- discard or reject email from some SMTP clients, such as a spammer that is not yet known to blocklists
Like IP-based policies, access control rules can reject connections based upon IP address.
Unlike IP-based policies, however, access control rules cannot affect email in ways that occur after the session’s DATA command, such as by applying antispam profiles. Access control rules also cannot be overruled by recipient-based policies, and cannot match connections based upon the IP address of the SMTP server (by the nature of how the ACL controls access to or through the FortiMail unit, the SMTP server is always the FortiMail unit itself, unless the FortiMail unit is operating in transparent mode). For more information on IP-based policies, see the FortiMail Administration Guide.
Syntax
config policy access-control receive
edit <rule_id>
set action {bypass | discard | reject | relay}
set authenticated {any | authenticated | not-authenticated}
set comment <string>
set recipient-pattern <pattern_str>
set recipient-pattern-type {default | group | regexp}
set recipient-pattern-regexp {yes | no}
set recipient-pattern-group <group_name>
set reverse-dns-pattern <pattern_str>
set reverse-dns-pattern-regexp {yes | no}
set sender-ip-group <ip_group_name>
set sender-ip-mask <ip&netmask_str>
set sender-ip-type {ip-group | ip-mask}
set sender-pattern <pattern_str>
set sender-pattern-type {default | group | regexp}
set sender-pattern-group <group_name>
set sender-pattern-regexp {yes | no}
end
|
Variable |
Description |
Default |
|
Enter the number identifying the rule. |
|
|
|
Enter the action the FortiMail unit will perform for SMTP sessions matching this access control rule.
|
relay |
|
|
Enter a value to indicate whether this rule applies only to messages delivered by clients that have authenticated with the FortiMail unit.
|
authenticated |
|
|
Enter any comments for access control rules for receiving email. |
|
|
|
Enter a pattern that defines recipient email addresses which match this rule, surrounded in slashes and single quotes (such as |
* |
|
|
Enter the pattern type.
|
default |
|
|
Enter This option is available only when recipient-pattern-type {default | group | regexp} is |
no |
|
|
Enter the group name to specify the recipient pattern. This option is available only when recipient-pattern-type {default | group | regexp} is |
|
|
|
Enter a pattern to compare to the result of a reverse DNS look-up of the IP address of the SMTP client delivering the email message. Because domain names in the SMTP session are self-reported by the connecting SMTP server and easy to fake, the FortiMail unit does not trust the domain name that an SMTP server reports. Instead, the FortiMail does a DNS lookup using the SMTP server’s IP address. The resulting domain name is compared to the reverse DNS pattern for a match. If the reverse DNS query fails, the access control rule match will also fail. If no other access control rule matches, the connection will be rejected with SMTP reply code 550 ( Wildcard characters allow you to enter partial patterns that can match multiple reverse DNS lookup results. An asterisk ( For example, the recipient pattern Note: Reverse DNS queries for access control rules require that the domain name be a valid top level domain (TLD). For example, “.lab" is not a valid top level domain name, and thus the FortiMail unit cannot successfully perform a reverse DNS query for it. |
* |
|
|
Enter |
no |
|
|
Enter the IP group of the SMTP client attempting to deliver the email message. This option only appears if you enter ip-group in sender-ip-type {ip-group | ip-mask}. |
|
|
|
Enter the IP address and netmask of the SMTP client attempting to deliver the email message. Use the netmask, the portion after the slash ( For example, enter Similarly, To match any address, enter |
0.0.0.0 0.0.0.0 |
|
|
Select the method of the SMTP client attempting to deliver the email message. Also configure sender-ip-mask <ip&netmask_str> and sender-ip-group <ip_group_name>. |
ip-mask |
|
|
Enter a pattern that defines sender email addresses which match this rule, surrounded in slashes and single quotes (such as This option is only available if you enter |
* |
|
|
Enter the pattern type.
|
default |
|
|
Enter the group name to match any email address in the group. |
|
|
|
Enter This option is only available if you enter |
no |
|
|
Enter |
enable |
|
|
Enter a TLS profile to allow or reject the connection based on whether the communication session attributes match the settings in the TLS profile. If the attributes match, the access control action is executed. If the attributes do not match, the FortiMail unit performs the Failure action configured in the TLS profile. For more information on TLS profiles, see the FortiMail Administration Guide. |
|
Related topics
policy access-control delivery