A FortiGate 60 unit is configured for your small office. The DMZ interface is connected to a network containing a web server and email server. The Internal interface is connected to a network…

To enable internal users to send and receive email from the DMZ email server, a firewall policy allowing traffic from the Internal interface to the DMZ interface (Internal > DMZ) is necessary for the initial connection.

A DMZ > Internal policy would allow the DMZ server to initiate connections to the internal network, which is generally not required for users to simply send and receive email *to* the DMZ server (stateful firewall handles return traffic).

An Internal > WAN1 policy would allow internal users to access the internet, but not specifically the DMZ email server.

A WAN1 > Internal policy would allow traffic initiated from the internet to access internal users, which is generally undesirable and not requested for this scenario.

Additionally, for the DMZ email server to retrieve email messages from an email server hosted by your ISP using the POP3 protocol, it needs to initiate an outbound connection, requiring a policy from the DMZ interface to the WAN1 interface (DMZ > WAN1).

A WAN1 > DMZ policy would allow traffic initiated from the internet to the DMZ, which is needed for public inbound access to the email server, but not for the DMZ server to *retrieve* email from the ISP or for internal users to *access* the DMZ server as specified.