60E 6.0.4 - email alerts to custom SMTP server giving "illegal syntax" error

[train_wreck]

The 60E device is configured to use an internal SMTP server. The server has IP address 192.168.220.2 is running Postfix on Linux. The Fortigate is 192.168.220.1. Here is the output of "config system email-server":

config system email-server
    set reply-to "user@domain.com"
    set server "192.168.220.2"
end

Here is the output of "config system alertemail settings":

config alertemail setting
    set username "user@domain.com"
    set mailto1 "user@domain.com"
    set antivirus-logs enable
    set FDS-license-expiring-warning enable
    set FDS-license-expiring-days 30
end

The Postfix mail server is reporting the following in its logs when the Fortigate tries to send an email:

Jun 03 21:35:08 MX-VM postfix/smtpd[18619]: connect from _gateway[192.168.220.1]
Jun 03 21:35:08 MX-VM postfix/smtpd[18619]: warning: Illegal address syntax from _gateway[192.168.220.1] in MAIL command: <noreply@192.168.220.2>
Jun 03 21:35:08 MX-VM postfix/smtpd[18619]: disconnect from _gateway[192.168.220.1] ehlo=1 mail=0/1 quit=1 commands=2/3

Seems like the Fortigate is trying to use "noreply@192.168.220.2" as the From: value.

Whats going on?

[live89]

Hi

please post the output of those commands:

di deb reset

di deb di

diagnose debug application alertmail -1

diagnose debug enable

diagnose log alertmail test

[Hosemacht]

Hey there,

try this: unset reply-to under 'config system email-server'

or set 'source -ip' under 'config system email-server' (to the ip of the "email sending" interface)

Regards

[train_wreck]

Here is the config with the requested changes:

MYFORTINET # show system automation-action 
config system automation-action
    edit "alert-conf-change_email"
        set action-type email
        set email-to "MYEMAILADDRESS"
        set email-from "MYEMAILADDRESS"
        set email-subject "Fortigate Config Changed"

        set message "test"
    next
end

MYFORTINET # show system automation-destination
config system automation-destination
    edit "0"
        set destination "SERIALNUMBER"
    next
end

MYFORTINET # show system automation-stitch
config system automation-stitch
    edit "alert-conf-change"
        set trigger "alert-conf-change"
        set action "alert-conf-change_email"
    next
end

MYFORTINET # show system automation-trigger
config system automation-trigger
    edit "alert-conf-change"
        set event-type config-change
    next
end

MYFORTINET # show system email-server
config system email-server
    set server "MAIL_SERVER_IP"
    set source-ip FORTINET_IP
end

Here is the output of the requested commands. The test email from these commands arrives successfully, but the emails notifying a config change fail with the "illegal syntax" error:

Arrived msg(type 4, 91 bytes):Alert Mail Test
Message body (log level = 1):
1st Line
2nd Line
(2020-06-18 02:25:50)

mail_info:
        from:MAIL_SERVER_IP user:MYEMAILADDRESS
mail_info:
        reverse path:MYEMAILADDRESS
        user name:admin
to[0]:MYEMAILADDRESS
to[1]:
to[2]:
<==_init_mail_info
create session
resolve MAIL_SERVER_IP to 1 IP
==> send mail
connecting to MAIL_SERVER_IP port 25
send mail 0x5406908 session 0x541ba08
session: 0x541ba08, rsp_state: greeting, code: 220
session: 0x541ba08, rsp_state: ehlo, code: 250
session: 0x541ba08, rsp_state: mail, code: 250
session: 0x541ba08, rsp_state: rcpt, code: 250
session: 0x541ba08, rsp_state: data, code: 354
=== send: Alert Mail Test
Message body (log level = 1):
1st Line
2nd Line
(2020-06-18 02:25:50) 

session: 0x541ba08, rsp_state: data2, code: 250
session: 0x541ba08, rsp_state: quit, code: 221
session finined
_session_on_destroy
<== send mail success, m = 0x5406908 s = 0x541ba08

I have tried deleting all the "config automation" entries and re-adding them with the CLI instead of the GUI, but this changed nothing.

[train_wreck]

Here is the debug output during a failure:

Arrived msg(type 9, 129 bytes):MYEMAILADDR;

Fortigate 1176 Config Changed
FGT[SERIALNUMBER] Automation Stitch:alert-conf-change is triggered.
test

mail_info:
        from:MAIL_SERVER_IP user:noreply
mail_info:
        reverse path:noreply@MAIL_SERVER_IP
        user name:noreply
to[0]:MYEMAILADDR
<==_init_mail_info
create session
resolve MAIL_SERVER_IP to 1 IP
==> send mail
connecting to MAIL_SERVER_IP port 25
create session
resolve MAIL_SERVER_IP to 1 IP
==> send mail
connecting to MAIL_SERVER_IP port 25
send mail 0x541beb8 session 0x541ea40
session: 0x541ba08, rsp_state: greeting, code: 220
session: 0x541ba08, rsp_state: ehlo, code: 250
session: 0x541ba08, rsp_state: mail, code: 501
session: 0x541ba08, rsp_state: quit, code: 221
session finined
_session_on_destroy
<== send mail failed, m = 0x5405e90 s = 0x541ba08

[poundy]

this is a mail failure. This is not a firewall question really, its an SMTP question.

Your test and the real message are different. One has your email address, one has a noreply email address. It's entirely possible that they're going to behave differently. 

Your message generated a 501. See "session: 0x541ba08, rsp_state: mail, code: 501".  Do you have access to the mail server side logs, so you can see more detail behind what the error was ?  My initial guess is that this is an issue with the server not permitting an invalid sender to submit a message - try using your email in the triggered message