Skip to main content
rezafathi
Explorer III
December 30, 2023
Question

Automation Email not working

  • December 30, 2023
  • 11 replies
  • 4497 views

Hi

 

I have configured email setting on fortigate and created a snitch,Trigger and action for sending admin login failure to my gmail account but it does not work. here is my configuration:

 

config system email-server     set type custom     set reply-to "itcuoka@gmail.com"     set server "smtp.gmail.com"     set port 587     set source-ip 0.0.0.0     set source-ip6 ::     set authenticate enable     set validate-server disable     set username "itcuoka@gmail.com"     set password ENC KMGGpKG6YFSg3M3v4JuNq+4ugOkNNAjuqgdy53MmtXDIRpBDkwnR98Rpjkaig==     set security starttls     set ssl-min-proto-version default     set interface-select-method auto end   config system automation-action     edit "Email_Tupa"         set description ''         set action-type email         set forticare-email disable         set email-to "terfi@gmail.com"         set email-from ''         set email-subject "Fortigate Alerts"         set minimum-interval 0         set message "%%log%%"         set replacement-message disable     next end  config alertemail setting     set username "itcuoka@gmail.com"     set mailto1 ''     set mailto2 ''     set mailto3 ''     set filter-mode category     set email-interval 5     set IPS-logs disable     set firewall-authentication-failure-logs disable     set IPsec-errors-logs disable     set PPP-errors-logs disable     set sslvpn-authentication-errors-logs disable     set antivirus-logs disable     set webfilter-logs disable     set configuration-changes-logs disable     set violation-traffic-logs disable     set admin-login-logs disable     set FSSO-disconnect-logs disable     set ssh-logs disable end

11 replies

mpeddalla
Staff
Staff
December 30, 2023

Hello  @rezafathi ,

 

Thank you for contacting the Fortinet Forum portal.

-Additional steps along with my colleague's suggestions. Under the alert email settings enable admin-login-logs and  firewall-authentication-failure-logs.

 

config alertemail setting
set IPS-logs disable
set firewall-authentication-failure-logs disable
set IPsec-errors-logs disable
set PPP-errors-logs disable
set sslvpn-authentication-errors-logs disable
set antivirus-logs disable
set webfilter-logs disable
set configuration-changes-logs disable
set violation-traffic-logs disable
set admin-login-logs disable
set FSSO-disconnect-logs disable
set ssh-logs disable
end

 

-Please make sure the below settings as well from the article admin login failure.

article :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-an-automation-stitch-to-get-an-email/ta-p/285814

 

Best regards,

Manasa.

 

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

rezafathi
rezafathiAuthor
Explorer III
December 30, 2023

Hi

 

Thanks. Why should i disable all logs in cli? 

 

mpeddalla
Staff
Staff
December 30, 2023

As suggested earlier please enable them , which ever settings you need as alert

 

config alertemail setting
set IPS-logs disable
set firewall-authentication-failure-logs enable
set IPsec-errors-logs disable
set PPP-errors-logs disable
set sslvpn-authentication-errors-logs disable
set antivirus-logs disable
set webfilter-logs disable
set configuration-changes-logs disable
set violation-traffic-logs disable
set admin-login-logs enable
set FSSO-disconnect-logs disable
set ssh-logs disable
end

akanibek
Staff
Staff
December 30, 2023

Could you enable some debugs, and send test email. We can verify if email is been sending or not:

 

diag debug console timestamp enable

diag debug app forticldd -1

diag debug app alert -1

diag fortitoken debug enable

diag debug enable

 

abbeb
New Member
December 31, 2023

@akanibek wrote:

Could you enable some debugs, and send test email. We can verify if email is been sending or not:

 

diag debug console timestamp enable

diag debug app forticldd -1

diag debug app alert -1

diag fortitoken debug enable

diag debug enable

 


I got this,...

vbandha
Staff
Staff
December 31, 2023

@rezafathi 

Are you able to ping 208.91.114.151 from fortigate?

exec ping 208.91.114.151

 

If it doesn't work then try this:
exec ping-options source <WAN IP>

exec ping 208.91.114.151

 

Also run this command to capture the traffic for mail not sending:

diag sniffer packet any 'port 465' 4 0 l

 

Regards,

Varun

rezafathi
rezafathiAuthor
Explorer III
January 3, 2024

I got the logs which says email sent to gmail account failed. On logs , there is ssl errors i think. What can i do to be able to send emails to gmail?

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.