Unable to Establish StartTLS Connection

[Richard_Steiner]

Hello,

I have just installed on-premise exchange server and configured hybrid with office365. However, I noticed that I am not able to establish a StartTLS connection with office365 on port 25 and this causes email from on-premise user to a cloud user to fail. I have allowed all services on the firewall policy just to be sure that I am not blocking it but it still fails. I have attached a screenshot of failed connection test form behind fortigate and successful test from outside of Fortigate.

I am a self taught administrator on Fortigate FW and appreciate all the support I can get.

Cheers,

~Richard

[vokinko1]

Have you explored if your certs are using modern ciphers? Maybe the server you are connecting to has disabled accepting an older version you are using which causes your system to step down to plain text.

[pminarik]

Make sure to run the test through a firewall policy without UTM inspection. To rule out interference from that. Otherwise I'd suggest doing a packet capture of both sides, then check if the replies coming in on WAN differ from what the client sees. It's still plaintext, so it should be easy to read.