Issue to send security policy forwarding log by email

[a.blanchard]

Hello everyone,

I have created a security policy that logs only IPv6 traffic, and I added a log forwarding profile to ensure I receive an email whenever the policy is triggered.

However, the issue is that when I send IPv6 packets, I don’t receive any emails.

My email server profile is working fine. When I test the connection, I receive the test email. Additionally, my security policy appears to be functioning correctly; when I send packets, they match the correct policy with the log forwarding option enabled.

Thanks for the help.

[JayGolf]

Hi @a.blanchard ,

Log forwarding and security policy logging looks fine. Can you confirm logs are being generated for the security policy in question? You can navigate to your security policy and click the drop down for Log Viewer. Once verified, I would try dumbing down the logic a bit. In your log forwarding policy, can you select only traffic logs. In the log setting security policy, can you uncheck log at session start and just have log at session end enabled. 

Any luck if you try that out? 

[a.blanchard]

Hello @jay,

Firstable, thanks for your reply.

You can check the attachment to see the logging that i get. (I use a kali linux for testing with atk-alive6 to generate logs)

I've made the changes you told me about and sent a few ICMPv6 requests, but unfortunately I'm still not receiving any mail.

Maybe it's because of the way I do my tests?

If you have any other suggestions let me know 🙂 

[BPry · Accepted solution]

@a.blanchard,

Do you have insight into whatever mail server you're attempting to route the notifications through? Traffic alerts like this can often be blocked my your email security solution (especially IPv6 traffic alerts) rather easily. If you're MGMT interface (or whatever you have configured as a service route for SMTP) routes through the firewall, you can potentially use that as an indicator of whether or not the firewall is attempting to send the alerts or not.

[a.blanchard]

Hi @BPry,

Thank you for your message and your suggestions.

I have already reviewed the mail server being used for routing the notifications. I have whitelisted the email address utilized by the firewall, and I am successfully receiving test emails without any issues.

That's really weird...

[JayGolf]

Great stuff @BPry !! 🎉