How to config authentication port 587 for Exchange 2013

Hi all,

My environment:

Fortimail 400E , firmware v5.3,build653,180328 (5.3.12 GA) , Operation mode : Gateway

2 Exchange server 2013 CU19 (both CAS + Mailbox roles)

Fortigate NAT port 587 to my exchange servers so external users (authenticated) can connect to my exchange servers.

Now I don't want to NAT port 587 to my exchange servers anymore, instead I will NAT port 587 to Fortimail and it will proxy request to my exchange servers.

I read Fortimail 5.3.0 Administrator Guide and I think it can be done via "configuring authentication profiles" , am I right ? If anyone has done this before please give me some advice.