Skip to main content
NSC
NSC
New Member
May 27, 2024
Solved

O365/Exchange Online

  • May 27, 2024
  • 2 replies
  • 2682 views

We are in the process of moving from on prem Exchange to O365/Exchange Online hybrid deployment.

Can anyone advise which ports should be forwarded:

- From O365 to on prem Exchange.

- From O365 to on prem AD servers.

 

FG FMW is 7.4.4 (Not brave, forced by insurance to keep firmware up to date...)

 

I have all ports and FQDN listed in Microsoft white papers entered and policy from on prem servers to O365 in place.

 

I've been using all sorts of firewalls in the last 30 years but Fortigate's VIP is by far the weirdest thing ever. Good idea, but poorly implemented and very limited functionality.

 

Thank you for any suggestion you may have. (Yes I did search the forums but I hope I don't have to RTFM)

 

T

 

 

Best answer by Brunn3r

The only thing we opened is SMTP from a bunch of servers to the onprem Exchange.
104.47.0.0/17
40.107.0.0/16
40.92.0.0/15
52.100.0.0/14

 

you need a VIP as port-forwarder with your external IP of the WAN-Interface, the mapped IP of your Exchange Server and map the external Port 25 to internal Port 25.

something like this:

 

image.png

port forward in vip:

image.png

 

no need to open anything to your AD servers

2 replies

Brunn3r
Brunn3rAnswer
Explorer II
May 27, 2024

The only thing we opened is SMTP from a bunch of servers to the onprem Exchange.
104.47.0.0/17
40.107.0.0/16
40.92.0.0/15
52.100.0.0/14

 

you need a VIP as port-forwarder with your external IP of the WAN-Interface, the mapped IP of your Exchange Server and map the external Port 25 to internal Port 25.

something like this:

 

image.png

port forward in vip:

image.png

 

no need to open anything to your AD servers

NSC
NSCAuthor
New Member
May 30, 2024

Thanks for the reply!

 

I had to open in addition to 25, 80, and 443 as the exchange would error out when starting migration/copy of the mailboxes.

Created a VIP for 25, cloned twice to add remaining two ports and all was good for port forwarding...

Now, we are waiting for Microsoft level 3 support to tel us why so far two mailboxes cannot be migrated. To make things worse, I can't receive email from one " successfully " mailbox migrated.

 

Regards,

T

 

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!