Troubleshooting Tip: Internal On-Prem Exchange unable to be connected to from External email

Traffic flow:

external users --> Microsoft mail servers (40.xx.xx.0/24) --> FortiGate WAN IP: 182.xx.xx.xx --> hits VIP policy --> end-user machines mail received IPs (192.168.xx.0/24)

• Attempts to migrate emails to the cloud using port 443 encounter issues.
• There are no issues with email delivery using port 25 (SMTP).

1. Run a sniffer on FortiGate for external IP (6 0 a).
   
   

    

2. Convert to Wireshark. It will show that the external server is sending a QUIT message and the Mail server is replying with '221 2.0.0. Service closing transmission channel'.

3. Test from an external user to trigger the FortiGate WAN IP with ports 25 and 443.

4. Check the Firewall policy and then update the information on the Address Group.

5. Test the connection ports are working properly.

Note:

To avoid connectivity issues for users, make sure that the following essential Exchange online addresses are included in the allow-list and that connectivity to these domains is not blocked.

Microsoft 365 URLs and IP address ranges.