Fortigate doesn't send the alerts

[inferi]

Hi

My FortiGate 200D have some problems to send alert emails.

Have many failures in system events.

I already check the email service configuration and seems ok. The password is also ok.

The printer@fjbe.com.pt have SMTP enabled and 2FA deactivated.

This is the result of diag

[distillednetwork]

For the printer account have your setup SMTP AUTH in the office365 portal?  This blog article outlines a setup for office365.  The other item they had differently is the default reply to address was the same as the username.  You may need to verify permissions in office365 if that user can send as the is user.

https://aventistech.com/kb/email-alert-with-office-365-in-fortios-6-4/

[inferi]

I'm already use that account to send other alerts like backup reports and scanners from our printers

[inferi]

I changed "Default Reply To" from is@fjbe.com.pt to printer@fjbe.com.pt and activate a trigger to test but still not work.

In the past fortigate had a problem and can't resolve the ip adress of smtp.office365.com.

I fix this problem changing DNS from fortiguard servers to internal DNS, but I can't ping external address or ips. Perhaps this is the reason for not being able to send emails.

[distillednetwork]

Are you using SDWAN?  could be a local-out issue with sdwan or something upstream that is blocking it.

[Cajuntank]

Going to offer a possible alternative solution for now or future use. Due to our size and the amount of devices I had that needed to send email (i.e.. MFP copiers, various appliances for email alerting, etc...), I setup a internal mail relay (I use my old Barracuda SPAM firewall to do this but you can utilize whatever is more available to you). I have a VIP to this device and a corresponding egress policy for outbound SMTP traffic only. Office365 has a a rule for this public IP and that IP is in my SPF DNS record. I just point my devices to my internal relay host at port 25 and that's all that's needed. Leaving out a lot of steps, but you get the general idea.

[inferi]

I still not receive alerts from fortigate but saturday I received 3 alert emails.
The timestamp of emails matches exactly with another error with wan2 port.

Maybe the error is from static routes?

[distillednetwork]

I suspect an issue with SDWAN and the local out traffic picking the right interface.  What interfaces do you have setup for SDWAN? Do they all provide internet access?  Is there only one that is allowed to send emails through O365 by chance?

[inferi]

This is the SDWAN

[distillednetwork]

Try to see if you are able to ping from each interface: 

# exe ping-options source <wan2 IP>

# exe ping smtp.office365.com

# exe ping-options source <ONI>

# exe ping smtp.office365.com

This will source the ping from each interface separately and see if you are able to reach it on one port and not the other.