Configuring SMTP inspection with STARTTLS on port 25/587
DescriptionHow to inspect SMTP traffic on port 25 or 587 when the mail client uses STARTTLS.With STARTTLS, the mail session starts unencrypted and switches to TLS on the same connection. This is not the same as SMTPS on port 465, which is encrypted from the start and is not covered here.To scan the mail content after STARTTLS (antivirus, file filter, email filter), the policy needs proxy-based inspection and an SSL/SSH inspection profile with deep inspection. With certificate inspection only, the FortiGate cannot see the message or its attachments.ScopeFortiGate, FortiOS 7.4.x, 7.6.x, 8.0.x.SolutionIn the example below, internal mail clients on port2 send mail to the relay smtp.azurecomm.net on port1 using SMTP on port 587 with STARTTLS.All profiles are named 'STARTTLS'.Create the service object for port 587.The predefined service 'SMTP' covers TCP/25 only. Create a custom service for TCP/587:config firewall service custom
edit "SMTP-587"
set category "Email"
set tc
