Technical Tip: Resolving inconsistency in connecting to smtp.office365.com on Port TCP 587 using Policy ID (ID number)

[Umer221]

Description	This article describes how to resolve the issue where the policy that should allow traffic to smtp.office365.com on port TCP 587 is not working consistently, resulting in periods where the connection is blocked and periods where it is allowed.
Scope	FortiGate.
Solution	To solve this problem, the dynamic nature of the FQDN address of smtp.office365.com was identified as the root cause, which resolved to different addresses on FPMs and was addressed by increasing the cache TTL for the FQDN to 24 hours. Here are the step-by-step instructions to carry out this solution: Verify the Policy: Follow the link to verify/create a policy (Configure a Policy): Ensure Policy ID (Policy ID number) is correctly set up to allow traffic from the specific source to smtp.office365.com on port TCP 587. Port 587 is commonly used for SMTP (Simple Mail Transfer Protocol) for mail submission. It is designated for client-to-server communication, facilitating the sending of email messages to the mail server. It is technically possible to change the port number as long as the service/server communicating with it supports the port number change. Check DNS Settings: Follow the link to verify/create DNS (FortiGate DNS server:( Confirm that DNS settings are correctly synchronized between the firewall and the server. Adjust Cache TTL: Follow the link to adjust Cache TTL (Configure TTL Value:( Log in to the FortiGate firewall device. Navigate to the relevant policy settings for FQDN objects by following the path 'Policy & Objects -> Addresses -> Create an FQDN Object if not already created'. Locate the setting for smtp.office365.com. Increase the cache TTL for smtp.office365.com to 24 hours (86400 seconds) to maintain a consistent address resolution. This setting can only be configured through CLI: config firewall address     edit "SMTP-Office"         set type fqdn         set fqdn "smtp.office365.com"         set cache-ttl 86400     next end Test the Solution: After increasing the TTL, test the solution to ensure the connection to smtp.office365.com is now consistent. Alternative Solution: If the issue persists, remove the FQDN from the policy and configure the policy with a specific source IP address along with the SMTP service. Create an Internet Service Policy (ISDB) with the destination service as Microsoft Outbound Email, as shown in the following screenshot: Related article: Technical Tip: How to identify port 587 is open for smtp.office365.com