Configuring centralized administration

Maintenance > System > Central Management lets you use a FortiManager unit to manage your FortiMail unit’s configuration and firmware.

The latest FortiManager releases support centralized management of FortiMail v3.0 MR4 and

MR5 releases. For FortiMail v4.0 releases, centralized management will be supported in FortiManager v4.2 and later releases. Refer to FortiManager release notes for details about supported FortiMail versions. For information on configuring a FortiManager unit to manage or provide services to your other Fortinet brand devices, see the FortiManager Administration Guide.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To configure centralized administration

1. Go to Maintenance > System > Central Management.

Figure 94:Central Management tab

2. Configure the following:

Viewing generated reports

The Report tab displays the list of reports generated from the report profiles. You can delete, view, and/or download generated reports.

FortiMail units can generate reports automatically, according to the schedule that you configure in the report profile, or manually, when you select a report profile and click Generate. For more information, see “Configuring report profiles and generating reports” on page 676.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To view and generate reports

1. Go to Monitor > Report > Report.

Figure 87:Report tab

2. To view the report in PDF file format, mark the check box in the corresponding row and click On the pop-up menu, select Download PDF.
3. To view the report in HTML file format, you can view all sections of the report together, or you can view report sections individually.

• To view all report sections together, mark the check box in the row corresponding to the report, such as treportprofile-2011-06-27-1039, then click Download and select Download HTML. Your browser downloads a file with an archive (.tgz.gz) file extension to your management computer. To view the report, first extract the report files from the archive, then open the HTML files in your web browser.
• Each Query Selection in the report becomes a separate HTML file. You can view the report as individual HTML files. In the row corresponding to the report that you want to view, click + next to the report name to expand the list of sections, then double-click the file name of the section that you want to view, such as html. The report appears in a new browser window.

Figure 88:Viewing a generated report (HTML file format, Mail by Sender)

Viewing log messages

The Log submenu displays locally stored log files. If you configured the FortiMail unit to store log messages locally (that is, to the hard disk), you can view the log messages currently stored in each log file.

Logs stored remotely cannot be viewed from the web UI of the FortiMail unit. If you require the ability to view logs from the web UI, also enable local storage. For details, see “Configuring logging to the hard disk” on page 672.

The Log submenu includes the following tabs, one for each log type:

• History: Where you can view the log of sent and undelivered SMTP email messages.
• Event: Where you can view the log of administrator activities and system events.
• AntiSpam: Where you can view the log of email detected as spam.
• AntiVirus: Where you can view the log of email detected as infected by a virus.
• Encryption: Where you can view the log of IBE encryption. For more information about using IBE, see “Configuring IBE encryption” on page 357.

For more information on log types, see “FortiMail log types” on page 667.

Each tab contains a similar display.

The lists are sorted by the time range of the log messages contained in the log file, with the most recent log files appearing near the top of the list.

For example, the current log file would appear at the top of the list, above a rolled log file whose time might range from 2008-05-08 11:59:36 Thu to 2008-05-29 10:44:02 Thu.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To view the list of log files and their contents

1. Go to Monitor > Log.
2. Click the tab corresponding to the type of log file that you want to view (History, Event, AntiVirus, AntiSpam, or Encryption).

Figure 81:Antispam log tab

3. To view messages contained in logs:
   • double-click a log file to display the file’s log messages

To view the current page’s worth of the log messages as an HTML table, right-click and select Export to Table. The table appears in a new tab. To download the table, click and drag to select the whole table, then copy and paste it into a rich text editor such as Microsoft Word or OpenOffice Writer.

• click a row to select its log file, click Download, then select a format option

Alternatively, to display a set of log messages that may reside in multiple, separate log files:

• If the log files are of the same type (for example, all antispam logs), click Search. For details, see “Searching log messages” on page 212.
• If the log messages are of different types but all caused by the same email session ID, you can do a cross-search to find and display all correlating log messages. For details, see “Cross-searching log messages” on page 214.

For descriptions of individual log messages, see the FortiMail Log Message Reference.

Log messages can appear in either raw or formatted views.

• Raw view displays log messages exactly as they appear in the plain text log file.
• Formatted view displays log messages in a columnar format. Each log field in a log message appears in its own column, aligned with the same field in other log messages, for rapid visual comparison. When displaying log messages in formatted view, you can customize the log view by hiding, displaying and arranging columns and/or by filtering columns, refining your view to include only those log messages and fields that you want to see.

By default, log messages always appear in columnar format, with one log field per column. However, when viewing this columnar display, you can also view the log message in raw format by hovering your mouse over the index number of the log message, in the # column, as shown in Table .

Figure 82:Log messages

Table 19:Viewing log messages at Monitor > Log

When hovering your mouse cursor over a log message, that row is temporarily highlighted; however, this temporary highlight automatically follows the cursor, and will move to a different row if you move your mouse. To create a row highlight that does not move when you move your mouse, click anywhere in the row of the log message.

For information on individual log messages, see the FortiMail Log Message Reference.

Managing archived email

You can archive email according to criteria you specify. For details, see “Email archiving workflow” on page 656.

You can view and search archived email through the web UI. You can also download them, forward them to an email address, and use them to train the Bayesian databases.

For more information on Bayesian database training, see “Training the Bayesian databases” on page 645.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Others category

For details, see “About administrator account permissions and domains” on page 290.

To view archived email

1. Go to Monitor > Archive > Archive Accounts.
2. Select the email archive account you want to view and click View. For details about email archive accounts, see “Configuring email archiving accounts” on page 656.
3. From the Archive Folder drop-down list, select Inbox to view the good mail mailboxes, or select Bulk to view the spam mailboxes.
4. Double-click the name of the email archive mailbox that you want to view.

A list of archived email appears.

Figure 79:Contents an archive mailbox

To train Bayesian databases with archived mail

1. Go to Monitor > Archive > Archive Accounts.
2. Select the email archive account you want to view and click View. For details about email archive accounts, see “Configuring email archiving accounts” on page 656.
3. From the Archive Folder drop-down list, select Inbox to view the good mail mailboxes, or select Bulk to view the spam mailboxes.
4. Double-click the name of the email archive mailbox that you want to use to train the Bayesian databases.
5. In the check box column, mark the check box of each email that you want to use to train the Bayesian databases. To use all messages for training, select the check box above the first message to mark the check boxes of all email on the current page.
6. Click Train Bayesian Database.

Figure 80: Training a Bayesian database using archived email

7. Select whether to use the messages as spam or non-spam (known as innocent messages) email.
8. Select the database you want to train: global, per-domain (group), or personal.
   • Global requires no further information.
   • For per-domain database training, select the domain.
   • For personal database training, select the domain in Group database, then select the name of the user.
9. Click Apply.

Viewing the endpoint reputation statuses

Go to Monitor > Endpoint Reputation > Auto Blacklist to view the current list of carrier end points (by their MSISDN, subscriber ID, or other identifier) that were caught by FortiMail for sending spam. For general procedures about how to configure endpoint reputation, see “Configuring endpoint reputation” on page 639.

If a carrier end point has attempted to deliver during the automatic blacklisting window a number of spam text messages that is greater than the automatic endpoint blacklisting threshold, FortiMail unit adds the carrier end point to the automatic endpoint black list for the duration configured in the session profile. While the carrier end point is on the automatic black list and it does not expire, all text messages or email messages from it will be rejected. For information on configuring the automatic black list window, see “Configuring the endpoint reputation score window” on page 643. For information on enabling the endpoint reputation scan and configuring the automatic black list threshold in a session profile, see “Configuring session profiles” on page 482.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read or Read-Write permission to the Black/White List category For details, see “About administrator account permissions and domains” on page 290.

To view the automatic endpoint reputation black list, go to Monitor > Endpoint Reputation > Auto Blacklist.

Figure 77:Viewing endpoint reputation scores

Table 18:Auto Blacklist tab

Filtering automatic endpoint black list entries

You can filter automatic endpoint black list entries that appear on the Auto Blacklist tab based on the MSISDN, subscriber ID, or other sender identifier.

To filter the endpoint black list entries

1. Go to Monitor > Endpoint Reputation > Auto Blacklist.
2. Click Search.

Figure 78:A dialog appears.Search Dialog

3. Click Search.

The Auto Blacklist tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Auto Blacklist tab to refresh its view.

Viewing the sender reputation statuses

The FortiMail unit tracks SMTP client behavior to limit deliveries of those clients sending excessive spam messages, infected email, or messages to invalid recipients. Should clients continue delivering these types of messages, their connection attempts are temporarily or permanently rejected. Sender reputation is managed by the FortiMail unit and requires no administration.

Monitor > Sender Reputation > Display displays the sender reputation score for each SMTP client.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

For more information on enabling sender reputation and configuring the score thresholds, see “Configuring sender reputation options” on page 485.

To view the sender reputation scores, go to Monitor > Sender Reputation > Display.

Figure 75:Display tab

Table 17:Viewing the sender reputation statuses

Sender reputation is a predominantly automatic antispam feature, requiring little or no maintenance. For each connecting SMTP client (sometimes called a sender), the sender reputation feature records the sender IP address and the number of good email and bad email from the sender.

In this case, bad email is defined as:

• Spam
• Virus-infected
• Unknown recipients
• Invalid DKIM
• Failed SPF check

The sender reputation feature calculates the sender’s current reputation score using the ratio of good email to bad email. and performs an action based on that score.

The FortiMail unit calculates the sender reputation score using statistics up to 12 hours old, with more recent statistics influencing the score more than older statistics. The sender reputation score decreases (improves) as time passes where the sender has not sent spam. The score itself ranges from 0 to 100, with 0 representing a completely acceptable sender, and 100 being a totally unacceptable sender.

To determine which action the FortiMail unit will perform after it calculates the sender reputation score, the FortiMail unit compares the score to three score thresholds which you can configure in the session profile:

1. Throttle client at: For scores less than this threshold, senders are allowed to deliver email without restrictions. For scores greater than this threshold but less than the temporary fail threshold, senders are rate-limited in the number of email messages that they can deliver per hour, expressed as either an absolute number or as a percentage of the number sent during the previous hour. If a sender exceeds the limit and keeps sending email, the FortiMail unit will send temporary failure codes to the sender. See descriptions for Temporary fail in “Configuring sender reputation options” on page 485.
2. Temporarily fail: For scores greater than this threshold but less than the reject threshold, the FortiMail unit replies to senders with a temporary failure code, delaying delivery and requiring senders to retry later when their score is reduced.
3. Reject: For scores greater than this threshold, the FortiMail unit replies to senders with a rejection code.

If the SMTP client does not attempt any email deliveries for more than 12 hours, the SMTP client’s sender reputation entry is deleted, and a subsequent delivery attempt is regarded as a new SMTP client by the sender reputation feature.

Filtering sender reputation score entries

You can filter sender reputation score entries that appear on the Display tab based on the IP address of the SMTP client, the score, state, and date/time of the last score modification.

To filter the sender reputation score entries 1. Go to Monitor > Sender Reputation > Display.

2. Click Search.

A dialog appears.

Figure 76:Search dialog

3. Configure one or more of the following:

Blank fields match any value. Regular expressions and wild cards are not supported.

4. Click Search.

The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.

Viewing the greylist statuses

The Greylist submenu lets you monitor automatic greylisting exemptions, and email currently experiencing temporary failure of delivery due to greylisting.

Greylisting exploits the tendency of legitimate email servers to retry email delivery after an initial temporary failure, while spammers will typically abandon further delivery attempts to maximize spam throughput. The greylist scanner replies with a temporary failure for all email messages whose combination of sender email address, recipient email address, and SMTP client IP address is unknown. If an SMTP server retries to send the email message after the required greylist delay but before expiry, the FortiMail unit accepts the email and adds the combination of sender email address, recipient email address, and SMTP client IP address to the list of those known by the greylist scanner. Subsequent known email messages are accepted. For details on the greylisting mechanism, see “About greylisting” on page 624.

To use greylisting, you must enable the greylist scan in the antispam profile. For more information, see “Managing antispam profiles” on page 503.

Greylisting is bypassed if the SMTP client establishes an authenticated session (see “Bypass scan on SMTP authentication” on page 533, “Controlling email based on recipient addresses” on page 468, and “Controlling email based on IP addresses” on page 475), or if the matching access control rule’s Action is RELAY (see “Order of execution” on page 16).

You can configure the initial delay associated with greylisting, and manually exempt senders. For details, see “Configuring the grey list TTL and initial delay” on page 628 and “Manually exempting senders from greylisting” on page 630.

Viewing the pending and individual automatic greylist entries

The Display tab lets you view pending and individual automatic greylist entries.

• Pending greylist entries are those whose Status is not PASSTHROUGH. For email messages matching pending greylist entries, the FortiMail unit will reply to delivery attempts with a temporary failure code until the greylist delay period, indicated by Time to passthrough, has elapsed.
• Individual greylist entries are those whose Status is PASSTHROUGH. For email messages matching pending greylist entries, the greylist scanner will allow the delivery attempt, and may create a consolidated automatic greylist entry. For information on consolidated entries, see “Viewing the consolidated automatic greylist exemptions” on page 196.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read-Write permission to the Policy category

For details, see “About administrator account permissions and domains” on page 290.

To view the greylist, go to Monitor > Greylist > Display.

Figure 73:Display tab

Table 15:Viewing the list of pending and individual greylist entries

Table 15:Viewing the list of pending and individual greylist entries

Filtering pending and individual automatic greylist entries

You can filter the greylist entries on the Display tab based on sender email address, recipient email address, and/or the IP address of the SMTP client.

To filter the greylist entries 1. Go to Monitor > Greylist > Display.

2. Click Search.

A dialog appears.

Figure 74:Search dialog

3. Configure one or more of the following:

Use an asterisk (*) to match multiple patterns, such as typing user* to match user1@example.com, user2@example.net, and so forth. Blank fields match any value.

Regular expressions are not supported.

4. Click Search.

The Display tab appears again, but its contents are restricted to entries that match your filter criteria. To remove the filter criteria and display all entries, click the Display tab to refresh its view.

Viewing the consolidated automatic greylist exemptions

The Auto Exempt tab displays consolidated automatic greylist entries.

The FortiMail unit creates consolidated greylist entries from individual automatic greylist entries that meet consolidation requirements. For more information on individual automatic greylist entries, see “Viewing the pending and individual automatic greylist entries” on page 193. For more information on consolidation requirements, see “Automatic greylist entries” on page 627.

To access this part of the web UI, your administrator account’s:

• Domain must be System
• access profile must have Read or Read-Write permission to the Policy category For details, see “About administrator account permissions and domains” on page 290.

To view the list of consolidated entries, go to Monitor > Greylist > Auto Exempt.

Table 16:Auto Exempt tab options