Technical Tip: FortiToken Activation Email not received at the Office 365 Email

[kgeorge]

Description

This article describes how to troubleshoot when the FortiToken activation email is not received by the email via the Office 365 SMTP Server.

Scope

FortiGate, FortiToken.

Solution

Using the codes from 'diag debug application alertmail -1', the root cause can be identified. 

Sample output of the debug below,

2024-11-14 12:50:40 create session
2024-11-14 12:50:40 resolve smtp.office365.com to 1 IP
2024-11-14 12:50:40 ==> send mail
2024-11-14 12:50:40 connecting to 40.99.34.162 port 25
2024-11-14 12:50:40 session: 0xabeebf0, rsp_state: greeting, code: 220
2024-11-14 12:50:40 session: 0xabeebf0, rsp_state: ehlo, code: 250
2024-11-14 12:50:40 session: 0xabeebf0, rsp_state: starttls, code: 220
2024-11-14 12:50:40 rsp_starttls: creating ssl structure for session 0xabeebf0
2024-11-14 12:50:40 create_ssl: 0x7fb21a5000
2024-11-14 12:50:40 sessionn 0xabeebf0, SSL connected
2024-11-14 12:50:40 session: 0xabeebf0, rsp_state: ehlo, code: 250
2024-11-14 12:50:40 session: 0xabeebf0, rsp_state: auth, code: 334
2024-11-14 12:50:46 session: 0xabeebf0, rsp_state: auth2, code: 535
2024-11-14 12:50:46 session: 0xabeebf0, rsp_state: auth, code: 334
2024-11-14 12:50:46 session: 0xabeebf0, rsp_state: auth2, code: 334
2024-11-14 12:50:51 session: 0xabeebf0, rsp_state: auth2, code: 535 <----- Client Authentication Failure to Server.
2024-11-14 12:50:56 session: 0xabeebf0, rsp_state: mail, code: 530 
2024-11-14 12:50:56 _session_on_destroy
2024-11-14 12:50:56 <== send mail failed, m = 0xabe2630 s = 0xabeebf0

code 535 means 'Authentication credentials are invalid'. This needs to be checked with the Office 365 Team to isolate the issue further and fix it accordingly.

Some sample codes are below:

• 220  SMTP Service ready: The receiving server is ready for the next command.
• 250  Requested mail action okay, completed: Success! The email was delivered.
• 334 Response to email authentication AUTH command when the authentication method is accepted: Authentication has been successful.
• 535  Authentication credentials are invalid: There is an issue with client authentication with the email server. This may be because of incorrect credentials, invalid authentication methods, or invalid encryption settings.

Related article:

Email alert