topic Re: Setup email notification in Firepower in Network Security

Setup email notification in Firepower

tstrode01 — Fri, 21 Feb 2020 15:35:42 GMT

Hello,

I am having an issue setting up the email notifications in Firepower. Every time I test I get "Failed to send message, check your settings," but I am unsure which setting(s) are incorrect. I followed the steps in the system config guide.

Re: Setup email notification in Firepower

chenchq — Thu, 22 Nov 2018 08:01:01 GMT

Has the problem been solved

Re: Setup email notification in Firepower

Yordan1 — Fri, 24 Apr 2020 10:10:39 GMT

Hi,

How do you solved the issue.?

i have the same problem. I tried with all ports - without success

Re: Setup email notification in Firepower

Marvin Rhoads — Fri, 24 Apr 2020 12:52:27 GMT

Depending on your email server the FMC may need to be whitelisted as an accepted host.

Otherwise it's a straightforward setup and uses smtp (tcp/25).

Re: Setup email notification in Firepower

jasonwmartin — Mon, 15 Jun 2020 14:49:23 GMT

Q. Is FMC required for email notifications?

FYI, I'm managing from ASDM, no FMC...I would guess original poster & follow-up from April 2020 are the same.

Re: Setup email notification in Firepower

Marvin Rhoads — Tue, 16 Jun 2020 02:50:11 GMT

A Firepower service module on ASA doesn't have any built-in email capability. The parent ASA does and one can configure the Firepower service module related syslog events to trigger an email. That can be done in ASDM or from the cli.

FTD running on ASA and locally managed with Firepower Device Manager (or CDO) does not have email capabilities (as far as I know).

Both Firepower service modules and FTD software, when managed by FMC, can have events that trigger email notification and those are defined and configured completely in FMC.

Re: Setup email notification in Firepower

jasonwmartin — Wed, 17 Jun 2020 14:45:48 GMT

Thanks Marvin. I find it strange the option to configure e-mail notifications is available from the ASDM...if it doesn't have the ability, why include the option to configure?

Of course, everything about configuring & managing this module is strange to me. Have to upload a boot image to the disk first, start a console session from the boot image that then downloads & installs the package from somewhere else (in internal web server). The to manage, one slight configuration change has to be deployed...which takes forever.

IMHO, got to be better solutions out there...

Re: Setup email notification in Firepower

Marvin Rhoads — Thu, 18 Jun 2020 01:48:54 GMT

The email setup in ASDM I'm thinking of is for ASA syslog messages.(Configuration > Device Management > Logging > E-Mail Setup).

Or are you referring to another one?

Re: Setup email notification in Firepower

jasonwmartin — Fri, 19 Jun 2020 11:41:53 GMT

Configuration > ASA FirePOWER Configuration > Local > System Policy

Re: Setup email notification in Firepower

Marvin Rhoads — Sat, 20 Jun 2020 03:59:41 GMT

Ah OK - I see what you mean. I had forgotten they included that option since I almost never deploy ASDM-managed Firepower service modules. I think I've done it perhaps twice in the past 4 years.

Anyhow - you should be able to setup an email server there and test it. Is that not working for you? The source of the emails should be the Firepower service module address.

Re: Setup email notification in Firepower

jasonwmartin — Mon, 22 Jun 2020 11:47:17 GMT

"source of the emails should be the Firepower service module address" - meaning the From address? I've tried countless combinations though none have worked. Have open case with Cisco TAC but very, very slow response.

FYI, my internal SMTP relay server never shows an attempted connection from sfr. Relay server works, many other internal sources (UPS notices, temp/humidity monitors for server room, etc.) so it's not that...relaying allowed for all internal IPs.

Re: Setup email notification in Firepower

Marvin Rhoads — Mon, 22 Jun 2020 12:17:23 GMT

I as referring to the source IP address (in case you need to whitelist it in your server). You can check connectivity by accessing the mail server from the module cli (telnet to the server address on port 25 (smtp).)

Re: Setup email notification in Firepower

jasonwmartin — Mon, 22 Jun 2020 12:21:54 GMT

Source IP is whitelisted, whole internal 192.168.0.0/22 subnet is. Didn't know telnet client was on cli, thanks for tip...will test shortly.

Re: Setup email notification in Firepower

jasonwmartin — Mon, 22 Jun 2020 12:32:40 GMT

Telnet to SMTP relay worked fine...must be something within the sfr then.

Re: Setup email notification in Firepower

Marvin Rhoads — Mon, 22 Jun 2020 12:35:56 GMT

Indeed.

What you just did from cli is what it should be doing as a result of the "Test Mail Server Settings" in GUI setup you shared earlier.

Re: Setup email notification in Firepower

jasonwmartin — Mon, 22 Jun 2020 12:43:10 GMT

I'll keep playing around with it...ASDM is Java so maybe there's a debug setting in Java console or some other way to capture more advanced logs...not a Linux expert but since this is basically Cisco branded linux, I'm guessing there are ways to log from there as well. If I do resolve, I'll follow-up to this post for others to see.

Re: Setup email notification in Firepower

Marvin Rhoads — Mon, 22 Jun 2020 12:59:53 GMT

ASDM is just sending the commands to the module using an https connection.

As you noted, the module is Linux under the covers and most common Linux cli utilities are available there. I believe you can run tcpdump from the module.

Re: Setup email notification in Firepower

jasonwmartin — Mon, 22 Jun 2020 19:29:52 GMT

https = all the traffic is encrypted so I can't really tell much from packet captures. However, I can see traffic hitting the sfr from the PC running ASDM - see this in tcpdump on sfr and wireshark from PC side. But again, I can't really see anything in the packets because it's all encrypted.

Guess I'll just bite the bullet and setup FMC. The advantage of managing it all through ASDM though is anyone with ASDM can manage.

Re: Setup email notification in Firepower

jasonwmartin — Wed, 01 Jul 2020 11:18:18 GMT

Looks like issue is a bug where changes made on the ASDM appear to save but actually aren't - https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt41763. Mentions time but applies to any settings in system policy. Cisco's recommended version is 6.4.0.7 (may be 6.4.0.9 as of today) but this bug says to resolve, if I want to keep managing via ASDM, roll back to 6.2.3.15.

Unable to apply SFR System Policy via Onbox Management
Symptom:
System Policy Changes pushed from ASDM to SFR (FirePOWER) module are not applied

1. Go to configuration > ASA Firepower Configuration > local > system Policy
2. Edit any option available e.g Time Synchronization to Manual configuration
3. Click on Save Policy and Exit
4. Deploy changes. Deployment is successful
5. Go to configuration > ASA Firepower Configuration > Device Management > Device in System > Policy click on Default it will show Default System Policy without the changes applied

Conditions:
SFR module managed via Onbox

Workaround:
For avoiding this issue, the below is available;
- Using FMC for managing SFR module
or
- Using FTD instead of ASA w/ SFR module
or
- Using FirePOWER module version 6.2.3 release (e.g. 6.2.3.15) instead of 6.4 or later release

Re: Setup email notification in Firepower

Marvin Rhoads — Wed, 01 Jul 2020 15:19:10 GMT

Thanks for the update.

That's a terrible bug - there used to be a similar one with FMC several releases ago. Policy deploy reported success but the changes weren't in the running config.

Gotta love that modern software where everything is tracked as objects in a database vs. being a flat text file.