system csf
Use this command to configure the FortiMail system as a FortiGate Security Fabric member.
Before you enable the Security Fabric on FortiMail:
-
On FortiGate, enable and configure the Security Fabric.
If devices must be pre-approved to join the Security Fabric, then download the currently active certificate from FortiMail and upload it to the list of authorized devices on FortiGate. Otherwise later, after you enable the Security Fabric on FortiMail and it tries to connect, then you must manually approve the connection.
On some FortiMail models, the Factory certificate does not contain a serial number in its common name (CN) field (for example,
CN=FortiMail), and therefore is not a unique identifier. Wild card certificates are also not unique identifiers. You can install a custom certificate if you need a unique identifier. -
If the FortiMail local certificate does not have a serial number in the CN field of the subject, then configure both sides to present and accept a different type of certificate.
-
On FortiGate, configure the following:
config system csf
set accept-auth-by-cert enable
config trusted list
edit <FortiMail_name>
set authorization-type certificate
next
end
end
-
On FortiMail, in
authorization-request-type {certificate | serial}, selectcertificate.
-
Syntax
config system csf
set authorization-request-type {certificate | serial}
set group-password <password_str>
set upstream-ip <address_ipv4>
set management-ip <address_ipv4>
set management-port <port_int>
set configuration-sync {local | sync}
end
|
Variable |
Description |
Default |
||
|
Indicate the type of local certificate that FortiMail will send to authenticate itself to the upstream FortiGate, either:
|
serial |
|||
| configuration-sync {local | sync} |
Select either:
|
local | ||
|
Enter the name for the Security Fabric group.
|
|
|||
|
Enter the password for the Security Fabric group. |
|
|||
|
Enter the IP address where the FortiMail system listens for Security Fabric connections from the upstream FortiGate. |
|
|||
|
Enter the listening port number where the FortiMail system listens for Security Fabric connections. Valid range is 1 to 65535. |
443 |
|||
|
Enable or disable Security Fabric connections to the upstream FortiGate in the Security Fabric. |
enable |
|||
|
Enter the IP address for the upstream FortiGate in the Security Fabric. This may be the root FortiGate in the Security Fabric or, if there are other firewalls, a firewall that is between FortiMail and the root. |
|
|||
| upstream-port <port_int> | Enter the listening port number for the upstream FortiGate in the Security Fabric. Valid range is 1 to 65535. | 8013 |
Related topics
certificate (execute commands)
system csf (diagnose commands)