Setup email notification in Firepower

[tstrode01]

Hello,

I am having an issue setting up the email notifications in Firepower.  Every time I test I get "Failed to send message, check your settings," but I am unsure which setting(s) are incorrect.  I followed the steps in the system config guide.

[jasonwmartin]

I'll keep playing around with it...ASDM is Java so maybe there's a debug setting in Java console or some other way to capture more advanced logs...not a Linux expert but since this is basically Cisco branded linux, I'm guessing there are ways to log from there as well. If I do resolve, I'll follow-up to this post for others to see.

[Marvin Rhoads]

ASDM is just sending the commands to the module using an https connection.

As you noted, the module is Linux under the covers and most common Linux cli utilities are available there. I believe you can run tcpdump from the module.

[jasonwmartin]

https = all the traffic is encrypted so I can't really tell much from packet captures. However, I can see traffic hitting the sfr from the PC running ASDM - see this in tcpdump on sfr and wireshark from PC side. But again, I can't really see anything in the packets because it's all encrypted.

Guess I'll just bite the bullet and setup FMC. The advantage of managing it all through ASDM though is anyone with ASDM can manage.

[jasonwmartin]

Looks like issue is a bug where changes made on the ASDM appear to save but actually aren't - https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt41763. Mentions time but applies to any settings in system policy. Cisco's recommended version is 6.4.0.7 (may be 6.4.0.9 as of today) but this bug says to resolve, if I want to keep managing via ASDM, roll back to 6.2.3.15.

Unable to apply SFR System Policy via Onbox Management
Symptom:
System Policy Changes pushed from ASDM to SFR (FirePOWER) module are not applied

1. Go to configuration > ASA Firepower Configuration > local > system Policy
2. Edit any option available e.g Time Synchronization to Manual configuration
3. Click on Save Policy and Exit
4. Deploy changes. Deployment is successful
5. Go to configuration > ASA Firepower Configuration > Device Management > Device in System > Policy click on Default it will show Default System Policy without the changes applied

Conditions:
SFR module managed via Onbox

Workaround:
For avoiding this issue, the below is available;
- Using FMC for managing SFR module
or
- Using FTD instead of ASA w/ SFR module
or
- Using FirePOWER module version 6.2.3 release (e.g. 6.2.3.15) instead of 6.4 or later release

[Marvin Rhoads]

Thanks for the update.

That's a terrible bug - there used to be a similar one with FMC several releases ago. Policy deploy reported success but the changes weren't in the running config.

Gotta love that modern software where everything is tracked as objects in a database vs. being a flat text file.

[Petar Shopov]

Hello Marvin,

How do I check if the FMC IP is whitelisted as an accepted host?

I checked everything else and seems to be configured correctly.

When I hit "Test Mail Server Settings" it says success and I receive the email, but automated mails are not working for more than 2-3 weeks.

Thank you in advance.