topic Re: Issue to send security policy forwarding log by email in General Topics

Issue to send security policy forwarding log by email

a.blanchard — Fri, 10 Jan 2025 07:49:38 GMT

Hello everyone,

I have created a security policy that logs only IPv6 traffic, and I added a log forwarding profile to ensure I receive an email whenever the policy is triggered.

However, the issue is that when I send IPv6 packets, I don’t receive any emails.

My email server profile is working fine. When I test the connection, I receive the test email. Additionally, my security policy appears to be functioning correctly; when I send packets, they match the correct policy with the log forwarding option enabled.

Thanks for the help.

Re: Issue to send security policy forwarding log by email

JayGolf — Wed, 15 Jan 2025 01:51:41 GMT

Hi @a.blanchard ,

Log forwarding and security policy logging looks fine. Can you confirm logs are being generated for the security policy in question? You can navigate to your security policy and click the drop down for Log Viewer. Once verified, I would try dumbing down the logic a bit. In your log forwarding policy, can you select only traffic logs. In the log setting security policy, can you uncheck log at session start and just have log at session end enabled.

Any luck if you try that out?

Re: Issue to send security policy forwarding log by email

a.blanchard — Wed, 15 Jan 2025 07:58:32 GMT

Hello @jay,

Firstable, thanks for your reply.

You can check the attachment to see the logging that i get. (I use a kali linux for testing with atk-alive6 to generate logs)

I've made the changes you told me about and sent a few ICMPv6 requests, but unfortunately I'm still not receiving any mail.

Maybe it's because of the way I do my tests?

If you have any other suggestions let me know 🙂

Re: Issue to send security policy forwarding log by email

BPry — Wed, 15 Jan 2025 15:45:25 GMT

@a.blanchard,

Do you have insight into whatever mail server you're attempting to route the notifications through? Traffic alerts like this can often be blocked my your email security solution (especially IPv6 traffic alerts) rather easily. If you're MGMT interface (or whatever you have configured as a service route for SMTP) routes through the firewall, you can potentially use that as an indicator of whether or not the firewall is attempting to send the alerts or not.

Re: Issue to send security policy forwarding log by email

a.blanchard — Fri, 17 Jan 2025 07:29:56 GMT

Hi @BPry,

Thank you for your message and your suggestions.

I have already reviewed the mail server being used for routing the notifications. I have whitelisted the email address utilized by the firewall, and I am successfully receiving test emails without any issues.

That's really weird...

Re: Issue to send security policy forwarding log by email

JayGolf — Fri, 17 Jan 2025 16:22:51 GMT

Great stuff @BPry !! 🎉