O365/Exchange Online

[NSC]

We are in the process of moving from on prem Exchange to O365/Exchange Online hybrid deployment.

Can anyone advise which ports should be forwarded:

- From O365 to on prem Exchange.

- From O365 to on prem AD servers.

FG FMW is 7.4.4 (Not brave, forced by insurance to keep firmware up to date...)

I have all ports and FQDN listed in Microsoft white papers entered and policy from on prem servers to O365 in place.

I've been using all sorts of firewalls in the last 30 years but Fortigate's VIP is by far the weirdest thing ever. Good idea, but poorly implemented and very limited functionality.

Thank you for any suggestion you may have. (Yes I did search the forums but I hope I don't have to RTFM)

T

[Brunn3r · Accepted solution]

The only thing we opened is SMTP from a bunch of servers to the onprem Exchange.
104.47.0.0/17
40.107.0.0/16
40.92.0.0/15
52.100.0.0/14

you need a VIP as port-forwarder with your external IP of the WAN-Interface, the mapped IP of your Exchange Server and map the external Port 25 to internal Port 25.

something like this:

port forward in vip:

no need to open anything to your AD servers

[NSC]

Thanks for the reply!

I had to open in addition to 25, 80, and 443 as the exchange would error out when starting migration/copy of the mailboxes.

Created a VIP for 25, cloned twice to add remaining two ports and all was good for port forwarding...

Now, we are waiting for Microsoft level 3 support to tel us why so far two mailboxes cannot be migrated. To make things worse, I can't receive email from one " successfully " mailbox migrated.

Regards,

T