New Member

Solved

Alert emails are not sent from the firewall

Forum|Forum|3 months ago
April 24, 2026
17 replies
146 views

Firewall

Firmware: v7.4.11 build2878

We use a dedicated alert mailbox in our Microsoft 365 tenant for all device and system alerts, and it is already functioning correctly with multiple services.

I configured the FortiGate firewall to use this same mailbox, following the same SMTP settings used on our other devices. After triggering a test alert, no email was sent.

I reviewed Entra ID sign‑in logs and did not see any authentication attempts from the firewall. I also checked message trace and mail flow logs, with no record of an attempted send, while the previously configured devices continue to work normally.

I also set the email “From” address as recommended, but this did not change the behavior.

config:
config system email-server
set server "smtp.office365.com"
set port 587
set authenticate enable
set username "alerts@ourcomanyname"
set password ********************
set security smtps
end

Best answer by Toshi_Esumi

The filter to match specific event log needs to have exact match within the raw event log. For the interface status change logid:20099 should look like below.

date=2026-04-26 time=10:57:57 devid="FGT60FTK19033222" devname="LAB-FG60F" eventtime=1777226277211819739 tz="-0700" logid="0100020099" type="event" subtype="system" level="warning" vd="root" logdesc="Interface status changed" action="interface-stat-change" status="DOWN" msg="Link monitor: Interface dmz was turned down"

So you need to uncapitalize the “Status” to “status” to match it. You might blame the GUI. But it is what it is.

Toshi

Toshi_Esumi

SuperUser

“config system email-server” is defining the SMTP server, protocol, and auth if required. What is configured under “config alertemail setting”, where the destinations and what to alert are defined?

Toshi

S

saifsalahAuthor

New Member

config alertemail setting
end

Toshi_Esumi

SuperUser

Then, you shouldn’t expect any email alert to come out. Compare with a working one that should have some config there.

Toshi

S

saifsalahAuthor

New Member

is not this the same setting you are asking about?

S

saifsalahAuthor

New Member

i did the setting under cli again:

(setting) # show
config alertemail setting
set username "alerts@copmanyname.com"
set mailto1 "alerts@copmanyname.com"
end

still not working,

Toshi_Esumi

SuperUser

That’s not regular “alert email” feature of FGT. But an action part of automation stitches. I think the problem is the From address is the same with the To address. Since the from address doesn’t have to be a legit one, try changing it to something else.

Toshi

S

saifsalahAuthor

New Member

i did , same

but thanks for reply

Toshi_Esumi

SuperUser

What do you mean? I mean it still dowsn’t work? Then check your config in CLI.
Automation stitches consists of three parts.
1. defining triggers (config system automation-trigger)
2. defining actions (config system automation-action)
3. connect a trigger and an action to define an stitch (config system automation-stitch)

Below is my custom stitch in multi-vdom environment to detect IPsec tunnel down via log and send out email.
part 1.

config system automation-trigger
edit "vdom-a Tunnel Down"
set description "phase2 went down"
set event-type event-log
set logid 23102 37139
config fields
edit 1
set name "vd"
set value "vdom-a"
next
end
next
end

part2.
config system automation-action
edit "Email to Toshi"
set description "email to toshi"
set action-type email
set email-to "myname@company.com"
set email-from "vdom-a-tunnel-down@company.net"
set email-subject "SFO vdom-a Tunnel Down"
next
end

part3.

config system automation-stitch
edit "Email when tunel down"
set trigger "vdom-a Tunnel Down"
config actions
edit 1
set action "Email to Toshi"
set required enable
next
end
next
end

Toshi

sjoshi

Staff

Hi @saifsalah

You can test using automation stitch for admin login failure

refer the article below

Thanks, Salon

S

saifsalahAuthor

New Member

Message

Failed to send alert email from smtp.office365.com to (alerts@companyname.com)

sjoshi

Staff

Hi @saifsalah

In that case please share below output

diagnose debug reset
diagnose debug enable
diagnose debug console timestamp enable
diagnose debug application alertmail -1

After enabling the email, try to send the activation mail again or trigger a test mail.

diagnose log alertmail test

Capture all output before disabling debug:

diagnose debug disable
diagnose debug reset

Thanks, Salon

S

saifsalahAuthor

New Member

the email notification is fixed, I received email about admin failed login
this is my automation for network down:
trigger:

FortiOS Event Log

event: Interface link status changed

field: status, value: down

Action: i used the same email notification used in admin login

I can see the log when interface changes as follows:
Log Description Interface status changed
Action interface-stat-change
Status DOWN

Security Level Warning Event Message

Link monitor: Interface port1 was turned down

and no email sent !

sjoshi

Staff

Hi @saifsalah

Do you mean that you can see the trigger event but the email is not being received?

You can collect the debug while trigger the automation stitch and share the logs.

Thanks, Salon

S

saifsalahAuthor

New Member

from log:
event id 0100020099 which translates to Interface status changed
Action: interface-stat-change, Status: DOWN

from the automation:
Event: interface status changed
Field: Status,Value: DOWN

no email

Toshi_EsumiAnswer

SuperUser

The filter to match specific event log needs to have exact match within the raw event log. For the interface status change logid:20099 should look like below.

date=2026-04-26 time=10:57:57 devid="FGT60FTK19033222" devname="LAB-FG60F" eventtime=1777226277211819739 tz="-0700" logid="0100020099" type="event" subtype="system" level="warning" vd="root" logdesc="Interface status changed" action="interface-stat-change" status="DOWN" msg="Link monitor: Interface dmz was turned down"

So you need to uncapitalize the “Status” to “status” to match it. You might blame the GUI. But it is what it is.

Toshi

S

saifsalahAuthor

New Member

this solved it, thanks a lot!

Sign up

Login with SSO

Login to the community

Login with SSO