Hi,

After installing Exchange 2013 with SSL certificate with OWA, Active Sync and outlook anywhere. I observed that if someone from external network can telnet to my server is able to connect. I checked it and find that port 25 and 587 is open and bypass my Fortinet firewall.

I would like to know how can I block these ports and don't allow anyone can telnet on my Exchange server from externally. Please assist.

You can't block an application from making a connection to a specific port as long as that port is opened.  If you have a smarthost (something like mimecast or messagelabs) you can tell the firewall to only allow traffic from the IPs of the smart host. 

Yes I have configured smart host and the traffic coming from smart host IP. But the problem is when telnet from external side it directly comes to my Exchange CAS server which means if some try to send test email through telnet can send easily. How can I prevent this from External access that no one connect on telnet on port 587.

But if you set the ACLs on the firewall to only allow traffic between your smarthost and your mail servers then unless the source IP is from your smarthost then the connection should fail.

If that's not happening then you need to talk to your firewall admin and make sure his rule is configured properly.

Hi,

As Hinte mentioned, we cannot block telnet on port 25. Its the way SMTP works. If you want to mitigate Spoofed Senders, then implement SPF/Sender ID and have your SMTP gateway anti-spam solution check for that and block or mark unauthenticated messages.
Exchange Network Port Reference and Exchange 2010 Security Guide, for your reference:
https://technet.microsoft.com/en-us/library/bb331973(v=exchg.141).aspx
https://technet.microsoft.com/en-us/library/bb691338(v=exchg.141).aspx#NetworkPortandFirewall

Additional, I find an similar thread about your question, please refer to:
https://social.technet.microsoft.com/Forums/office/en-US/551abe70-cadf-40c4-8f3b-46983e1858a3/how-to-block-send-email-by-telnet-using-exchange-2010?forum=exchange2010

Thanks