Configuring FortiGuard services

FortiMail uses Fortinet FortiGuard antivirus, antispam, and URL protection services.

Go to System > FortiGuard > License to view your current licenses and service status, and go to System > FortiGuard > Licensed Feature to view the most recent updates to FortiGuard Antivirus engines, antivirus definitions, and FortiGuard antispam definitions (antispam heuristic rules).

FortiMail units receive updates from the FortiGuard Distribution Network (FDN), a world-wide network of FortiGuard Distribution Servers (FDS). FortiMail units connect to the FDN by connecting to the FDS nearest to the FortiMail unit by its configured time zone.

In addition to manual update requests, FortiMail units support two kinds of automatic update mechanisms:

scheduled updates, by which the FortiMail unit periodically polls the FDN to determine if there are any available updates
push updates, by which the FDN notifies FortiMail units when updates become available

You may want to configure both scheduled and push updates. In this way, if the network experiences temporary problems such as connectivity issues that interfere with either method, the other method may still provide your FortiMail unit with updated protection. You can alternatively manually update the FortiMail unit by uploading an update file by going to Dashboard > Status and click Update under License Information.

For FortiGuard Antispam and FortiGuard Antivirus update connectivity requirements and troubleshooting information, see Troubleshoot FortiGuard connection issues.

This section contains the following topics:

Configuring FortiGuard antivirus service
Configuring FortiGuard antispam service
Configuring licensed features

Configuring FortiGuard antivirus service

You can configure the FortiMail unit to periodically request updates from the FDN or override servers for the FortiGuard antivirus engine and antivirus definitions.

You can use push updates or manually initiate updates as alternatives or in conjunction with scheduled updates. If protection from the latest viral threats is a high priority, you could configure both scheduled updates and push updates, using scheduled updates as a failover method to increase the likelihood that the FortiMail unit always retrieves periodic updates if connectivity is interrupted during a push notification. While using only scheduled updates could potentially leave your network vulnerable to a new virus, it minimizes short disruptions to antivirus scans that can occur if the FortiMail unit applies push updates during peak volume times.

For example, you might schedule updates every night at 2 AM or weekly on Sunday, when email traffic volume is light.

Before configuring scheduled updates, first verify that the FortiMail unit can connect to the FDN or override server.

To configure FortiGuard antivirus options

Go to System > FortiGuard > AntiVirus.
Configure the following and then click Apply.

FortiGuard server port	FortiGuard uses either port 443 or 8890. The default port is 443.
Use override server	Enable to override the default FDN server to which the FortiMail unit connects for updates.
Override server IP address	Enter the IP address of the override public or private FDN server.
Allow push update	Enable to allow the FortiMail unit to accept push notifications (UDP 9443). If the FortiMail unit is behind a NAT device, you may also need to enable and configure Use override push IP. Push notifications only notify the FortiMail unit that an update is available. They do not transmit the update itself. After receiving a push notification, the FortiMail unit then initiates a separate TCP 443 connection, similar to scheduled updates, in order to the FDN to download the update.
Use override push IP	Enable to override the IP address and default port number to which the FDN sends push notifications. When enabled, the FortiMail unit notifies the FDN to send push updates to the IP address and port number that you enter (for example, a virtual IP/port forward on a NAT device that will forward push notifications to the FortiMail unit). When disabled, the FortiMail unit notifies the FDN to send push updates to the FortiMail unit’s IP address, using the default port number (UDP 9443). This is useful only if the FortiMail unit has a public network IP address. This option is available only if Allow push update is enabled.
Virus outbreak protection	When a virus outbreak occurs, the FortiGuard antivirus database may need some time to get updated. Therefore, you can choose to defer the delivery of the suspicious email messages and scan them for the second time. Disable: Do not query FortiGuard antivirus service. Enable: Query FortiGuard antivirus service. Enable with Defer: If the first query returns no results, defer the email for the specified time and do the second query.
Virus outbreak protection period	If you specify Enable with Defer in the above field, specify how many minutes later a second query will be done.
Virus database	Depending on your models, FortiMail supports three types of antivirus databases: Default: The default FortiMail virus database contains most commonly seen viruses and should be sufficient enough for regular antivirus protection. Extended: Some high-end FortiMail models support the usage of an extended virus database, which contains viruses that are not active any more. Extreme: Some high-end models also support the usage of an extreme virus database, which contains more virus signatures than the default and extended databases.
Scheduled update	Enable to perform updates according to a schedule, then select one of the following as the frequency of update requests. When the FortiMail unit requests an update at the scheduled time, results appear in Last Update Status. Every: Select to request to update once every 1 to 23 hours, then select the number of hours between each update request. Daily: Select to request to update once a day, then select the hour of the day to check for updates. Weekly: Select to request to update once a week, then select the day of the week and the hour of the day to check for updates.
Server location	Use FortiGuard servers either in US only or in any locations in the world.

Manually requesting updates

You can manually trigger the FortiMail unit to connect to the FDN or override server to request available updates for its FortiGuard antivirus packages.

You can manually initiate updates as an alternative or in addition to other update methods.

To manually request updates

Before manually initiating an update, first verify that the FortiMail unit can connect to the FDN or override server.

Go to System > FortiGuard > AntiVirus.
Click Update Now.

Updating FortiGuard Antivirus definitions can cause a short disruption in traffic currently being scanned while the FortiMail unit applies the new signature database. To minimize disruptions, update when traffic is light, such as during the night.

After a few minutes, click the System > FortiGuard > License tab to check the update status. If an update was available, new version numbers appear for the packages that were updated. If you have enabled logging, messages are recorded to the event log indicating whether the update was successful or not. For details, see Logs, reports and alerts.

Configuring FortiGuard antispam service

You can connect to FDN to use its antispam service. You can also use your own override server, such as a FortiManager unit, to get the antispam service.

About FortiGuard spam outbreak protection

This feature temporarily hold email for a certain period of time (spam outbreak protection period) if the enabled FortiGuard antispam check (block IP and/or URL filter) returns no result (see Configuring FortiGuard options). After the specified time interval, FortiMail will query the FortiGuard server for the second time. This provides an opportunity for the FortiGuard antispam service to update its database in cases a spam outbreak occurs.

FortiMail uses its internal algorithms to determine the suspicious level of an email. For example, the following email is treated as highly suspicious because it contains a phishing URL that might not be known to FortiGuard at the time.

Received: from linux-2543.local ([64.78.154.244])by mail.example.com with ESMTP id 31AmE8tP018352-31AmE8tQ018352 for <bob@example.com>; Fri, 10 Feb 2023 14:14:09 -0800

From: "American Express Online" <info@american-express.com>

To: bob@example.com

Reply-To: <spammer@gmail.com>

Subject: New secure email message from American Express

Date: 10 Feb 2023 15:14:08 -0700

Message-ID: <20230210151408.e4253c5C355132EB@givemeyourmoney.com>

MIME-Version: 1.0

Content-Type: text/plain

For your protection, the content of this message has been sent securely by American Express using encryption technology

To view the secure message, for your security reason

Copy paste below the link in your browser and follow the instruction

https://american.express.vds.xxxxxx.com/secure_email

The secure message expire on Feburary 15 .2023 @ 9:01 PM(GMT)!!!

Do not reply to the notification message, the message was auto generated by the sender's security system

To configure the FortiGuard antispam options

Go to System > FortiGuard > AntiSpam.
Under FortiGuard AntiSpam, verify that Enable service is enabled. Also specify the FortiGuard server port (53 or 8888. The default number is 53) and protocol (UDP or HTTPS).
Specify a spam outbreak protection level. Higher level means more strict filtering.
If you want to use an override server, such as a local FortiManager unit, instead of the default FDN server, specify it by enabling the option and entering the server address.
Optionally enable cache and specify the cache TTL time. Enabling cache can improve performance.
Use FortiGuard servers either in U.S. only or in any locations in the world.
Click Apply.

Configuring spam sample submission service

You can designate an email address to receive and review sample submissions of spam for an administrator to review, or send directly to FortiGuard. Spam submissions can be made using the Report Spam plugin within Outlook available for download at https://support.fortinet.com/.

To configure the spam sample submissions service

Go to System > FortiGuard > AntiSpam.
Under Sample Submission, verify that Enable submission service is enabled.
Select whether you want an administrator to manually review spam sample submissions or whether you want the submissions to be sent directly to FortiGuard.
Define a Retention period of between 0-60 days, after which the sample submission will be deleted.
Enter the email addresses to receive spam and non-spam (or ham) sample submissions.
Click Apply.

Consider the following when defining the email addresses:

The two email accounts cannot be the same.
The two accounts are reserved for spam and non-spam submissions; they cannot receive other email.
Therefore, you cannot use any email accounts in use for spam and non-spam submissions.

Emails that have been submitted can be reviewed under Monitor > Quarantine > Sample Submission. For more information, see Sample Submission.

To download report spam plugin for Outlook

Go to https://support.fortinet.com/ and login to your account.
Go to Support > Firmware Download.
Go to FortiMail > Plugins.
Double-click the appropriate install file to start the installation process, and follow the on-screen instructions.
After the plugin is successfully installed, restart Outlook.

Upon reopening Outlook, you can Report Spam to report any uncaught suspicious email, and use Not Spam to report any caught spam email that you wish to mark as not spam.

Manually querying FortiGuard antispam service

For testing or any other purposes, you may want to manually query the FortiGuard antispam service by entering an IP address, URL, or a Hash value of an email message.

To query FortiGuard antispam service

Go to System > FortiGuard > License.
Enter an IP, URL or hash value of an email message.
Click Query.

If the query is successful, the Query result field will display if the IP/URL is spam or unknown (not spam).

If the query is unsuccessful, the Query result field will display No response. In this case, you can use the following tips to troubleshoot the issue.

If the FortiMail unit can reach the DNS server, but cannot successfully resolve the domain name of the FDN, a message appears notifying you that a DNS error occurred.

DNS error when resolving the FortiGuard Antispam domain name

Verify that the DNS servers contain A records to resolve service.fortiguard.net and other FDN servers. To try to obtain additional insight into the cause of the query failure, manually perform a DNS query from the FortiMail unit using the following CLI command:

execute nslookup name service.fortiguard.net

If the FortiMail unit cannot successfully connect, or if your FortiGuard Antispam license does not exist or has expired, a message appears notifying you that a connection error occurred.

Connection error when verifying FortiGuard Antispam connectivity

Verify that:

this is no proxy in between FortiMail and the FDN server.
your FortiGuard Antispam license is valid and currently active
the default route (located in System > Network > Routing) is correctly configured
the FortiMail unit can connect to the DNS servers (located in System > Network > DNS) and to the FDN servers
firewalls between the FortiMail unit and the Internet or override server allow FortiGuard Antispam rating query traffic.

The default port number for FortiGuard antispam query is UDP port 53 in v4.0. Prior to v4.0, the port number was 8889.

To try to obtain additional insight into the point of the connection failure, trace the connection using the following CLI command:

execute traceroute <address_ipv4>

where <address_ipv4> is the IP address of the DNS server or FDN server.

When query connectivity is successful, antispam profiles can use the FortiGuard option.

You can use the antispam log to monitor for subsequent query connectivity interruptions. When sending email through the FortiMail unit that matches a policy and profile where the FortiGuard option is enabled, if the FortiMail cannot connect to the FDN and/or its license is not valid, and if Information-level logging is enabled, the FortiMail unit records a log message in the antispam log (located in Monitor > Log > AntiSpam) whose Log Id field is 0300023472 and whose Message field is:

FortiGuard-Antispam: No Answer from server.

Verify that the FortiGuard Antispam license is still valid, and that network connectivity has not been disrupted for UDP port 53 traffic from the FortiMail unit to the Internet.

Configuring licensed features

The following features are configurable with valid applicable licenses.

Configuring email continuity

When FortiMail is running in either Gateway or Transparent mode, with this feature enabled, end users are allowed to access inbound emails in instances where the email server behind the FortiMail unit goes offline. This feature is only available with a valid license from FortiGuard.

To configure email continuity

Go to System > FortiGuard > Licensed Feature.
Under Email Continuity, set Status to Enable.

You may also chose to Disable the feature, or Disable and Purge Email whereby the feature is disabled and all email is purged after the configured retention period expires.

Adjust the Retention period according to your requirements. The higher the number, the higher the number of days emails are kept before they are removed. The default setting is 30 and the valid range is 0-60.
Enable Authentication cache status to allow FortiMail to caches user's password, enabling users to authenticate in the event of an LDAP server outage.
Define the Authentication cache period in days. The default setting is 20 and the valid range is 0-60.

Note that the actual retention period is whichever is the smaller value of this setting and the email retention period set for incoming email when configuring a resource profile. See Configuring resource profiles for more information.

By default, this feature is disabled.

Configuring advanced management features (license required)

If you have the advanced management license, you can go to System > FortiGuard > Licensed Feature > Advanced Management and enable the following settings.

GUI item	Description
Centralized monitor	For details, see Centrally monitoring the HA cluster.
User management	For details, see Configuring user import profiles
Mailbox accounting service	For details, see Configuring mailbox statistics.
Domain group support	For details, see To view and configure domain groups.
History log access for domain level administrator	For details, see Configuring protected domains.
Domain mail statistics	For details, see Viewing mail statistics.
MTA advanced control	For details, see Configuring advanced MTA control settings.
Intra domain protection	Enable or disable applying both inbound and outbound policies when an email is sent between protected domains. When this setting is disabled, if an email is sent between two protected domains, then FortiMail only applies the matching inbound policy. This means that, for example, an inbound policy with antispam would apply, but not an outbound policy with DLP. This behavior may be correct if all protected domains belong to the same company. However for an MSSP with multiple tenants, both policies should apply. In that case, enabled this setting so that FortiMail applies both inbound and outbound policies.

Configuring adult image analysis

When you configure a content profile (see Configuring scan options), you can choose to scan for adult images in the email body and attachments.

To configure adult image analysis settings

Go to System > FortiGuard > Licensed Feature.
Under Adult Image Analysis, enable the analysis.
Adjust the rating sensitivity according to your requirements. The higher the number, the higher the sensitivity. The default setting is 75 and the valid range is 0-100.
Specify the minimum and maximum image size to scan.

Adjust the rating sensitivity properly to avoid false positives and false negatives.

Enabling this feature affects the FortiMail performance. And by default, this feature is enabled.