#Configuration# Setting email alert on NGAF V8.0.85

  

1. Introduction

1.1 User Scenario

Identifying unauthorized access to firewall web UI is crucial. On this guide, we can see how to have an email alert when it happens on Sangfor NGAF.

1.2 Requirements

1). The user's network has NGAF device.

2). You have a working email account and smtp settings.

  

2. Configuration Guide

We will use an internal SMTP relay to send mail in this example.

  

2.1 NGAF Configuration

  

Step 1. Configure email server settings on NGAF.

  

To do this you have to go on NGAF web ui at this point:

  

System -> Email & SMS Server-> Specified Email Server

  

  

Here you can add the email settings (we use an internal smtp relay, but it works well with Microsoft 365) and perform a Send Test Email by clicking on it and specify a mailing address as recipient:

file:///C:/Users/SXF-AD~1/AppData/Local/Temp/msohtmlclip1/01/clip_image004.gif

Double check your antispam on this recipient.

Step 2. To specify the recipient address, on Sangfor NGAF web ui go to

  

Monitor > Settings > Alert Notification Settings > Notification Settings

file:///C:/Users/SXF-AD~1/AppData/Local/Temp/msohtmlclip1/01/clip_image006.gif

Here you can specify an email address as recipient, and you can specify the Email Subject (useful if you have some rule in your mailbox that put all the incoming mail that has this Subject to a specific folder).

  

Step 3. On the tab Event Settings, you can enable it globally by selecting Enable alert notifications.

Step 4. After that, select only the events that you really want to receive an alert. On this example we select Admin login failure as we want to get an alert when an unauthorized access happens with admin user:

  

2.2 Test admin login failure

Step 1. Now we can trigger this alert by performing a failed admin login on firewall web ui.

Step 2. You can check the failed admin logon on Sangfor web ui at this point:

Monitor -> System Logs-> Admin Operation Logs

You can perform a search using the predefined filter and see the failed admin login.

file:///C:/Users/SXF-AD~1/AppData/Local/Temp/msohtmlclip1/01/clip_image014.gif

3. Precaution

  

1. Keep in mind that if you want to use Microsoft 365 as smtp email relay, you have to configure these settings on firewall web ui at this point:

System -> Email & SMS Server-> Specified Email Server

file:///C:/Users/SXF-AD~1/AppData/Local/Temp/msohtmlclip1/01/clip_image018.jpg

This article is written by Enrico Vanzetto who is a technical engineer and has much experience and a better understanding of Sangfor network secure (NGAF), HCI, Endpoint Secure, VDI, and Cyber Command products. If you want to know more about him,

click here.

Good article

Thanks for your effort.

Thank you very much for the guidance

Thanks for sharing

Congratulations on getting 4000 coins.

If you want to share articles like troubleshooting cases or configuration guides, please click the link below to register for this event.

https://community.sangfor.com/forum.php?mod=viewthread&tid=9641

My guide :-D