FortiToken activation email fails: FortiGate SMTP local-out source IP

Problem

When requesting a FortiToken Mobile activation code for a Remote LDAP User, the FortiGate reports:

Failed to send alert email from notification.fortinet.net to (user@example.com)

In the observed environment, DNS resolved notification.fortinet.net but a TCP connection to its SMTPS endpoint timed out. Packet captures showed repeated outgoing SYN packets and no SYN-ACK.

The FortiGate was connected through a WAN VLAN with a carrier-grade NAT address as its primary IP and an operator-routed public address as a secondary IP /32. The SMTP daemon initially sourced packets from the primary address. Email delivery succeeded after setting the SMTP source IP to the public secondary address.

Evidence boundary: This establishes a working correction for this topology, not a universal conclusion that CGNAT always prevents SMTP or that the upstream operator was dropping packets.

1. Inspect the email configuration

show full-configuration system email-server

Relevant values seen before the fix:

set type custom
set server "notification.fortinet.net"
set port 465
set source-ip 0.0.0.0
set authenticate disable
set security smtps
set interface-select-method auto

Check the sender/service settings and DNS; do not send SMTP credentials to support chats.

2. Test name resolution and connectivity

execute ping notification.fortinet.net
execute telnet notification.fortinet.net 465

A failed ping does not prove SMTP is blocked; many services filter ICMP. However, a TCP/465 timeout together with failed email delivery identifies a transport reachability problem.

Do not expect a readable SMTP banner from port 465, because this port uses TLS from the start.

3. Observe the chosen outgoing interface and source

Use the IP actually returned by DNS in the session (example uses a documentation address):

diagnose sniffer packet any 'host 192.0.2.25 and tcp port 465' 4 0 a

In another authorized admin session, trigger the activation email or repeat the TCP connection test.

Illustrative, sanitized capture:

WAN-ISP out 100.67.22.238.6724 -> 192.0.2.25.465: syn
wan1    out 100.67.22.238.6724 -> 192.0.2.25.465: syn
WAN-ISP out 100.67.22.238.6724 -> 192.0.2.25.465: syn

The addresses are example values. A WAN VLAN and its physical parent may show the same packet twice in an any capture; this does not necessarily mean two Internet connections.

Interpretation:

4. Understand local-out versus forwarded NAT

Traffic generated by the FortiGate itself, such as alert email, is local-out traffic. It does not automatically inherit the source NAT of LAN-to-WAN forwarding firewall policies.

The observed device had:

• A single active physical WAN with a tagged WAN VLAN.
• A primary interface address in 100.64.0.0/10 (shared address space).
• An operator-routed, public secondary /32 assigned to the same WAN VLAN.
• A default source-ip 0.0.0.0 for SMTP, resulting in SYN packets sourced from the primary WAN address.

Critical prerequisite: Only set an alternate source-ip that is valid on the FortiGate and properly routed by the provider. Merely substituting a public IP that belongs to an unrelated NAT service can break the connection.

5. Apply the tested correction

After verifying that an operator-routed public secondary address is assigned to the WAN interface, change only the email service's source IP:

config system email-server
    set source-ip <YOUR-ROUTED-PUBLIC-SECONDARY-IP>
end

The placeholder is not literal FortiOS syntax; substitute the real, authorized IP.

Leave interface-select-method auto, routes, VPNs and general firewall policies unchanged.

Verify:

show system email-server

Trigger Send Activation Code Email again in the FortiToken user's GUI and confirm that the message arrives.

Observed outcome: the operator confirmed successful delivery immediately after changing the SMTP source-ip. This does not, by itself, prove the MFA VPN login was successful.

6. Capture the post-change connection

With a sniffer running, look for a SYN sourced from the routed public secondary IP and a reply from the remote service:

WAN-ISP out <PUBLIC-IP>.<EPHEMERAL-PORT> -> <SMTP-IP>.465: syn
WAN-ISP in  <SMTP-IP>.465 -> <PUBLIC-IP>.<EPHEMERAL-PORT>: syn ack

If emails arrive, transport and delivery are functionally confirmed even if a subsequent packet capture was not retained. Do not invent post-change trace evidence.

7. Optional SMTP diagnostics

If the TCP connection succeeds but activation emails still fail, enable a short SMTP debug:

diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application alertmail -1
diagnose debug enable

Trigger one test, then disable:

diagnose debug disable
diagnose debug reset

Redact recipient addresses, authentication secrets and token activation codes before sharing logs.

Rollback

To restore the previous automatic source selection:

config system email-server
    set source-ip 0.0.0.0
end

This affects SMTP local-out configuration, not firewall policy SNAT. Restore only if the modified sender configuration does not work for the approved topology.

Prevention

• Document primary and secondary WAN IPs and how the operator routes each address.
• Validate SMTP TCP reachability using the actual source IP used by FortiGate.
• Restrict email configuration changes to administrators.
• Monitor activation-email failures before onboarding multiple VPN users.
• Never publicize token serials, QR codes, activation codes or personal addresses.