Security Events

An IP address living on the system has additionally been detected in the network.

The size of an email has exceeded the configured limit. This event is only reported when parameter Limit Mail Data Size is set to yes.

Notice

Invalid system user ID. See log for details.

Apple notification. Apple ID was used to sign in to a device.

A configuration file has been edited in the Barracuda Firewall Control Center configuration tree. "Config node change" events are only reported if event notification has been configured for configuration file changes (CC context menu entry Properties …). The following events apply:

• Normal Event - Event-ID 2400
• Notice Event - Event-ID 2401
• Alert Event - Event-ID 2402

Notice

An application has been granted administrative access to the system. Barracuda Networks applications generate "Barracuda Networks Subystem Login" notifications every time a user has successfully logged into an application that interacts with the graphical administration tool Barracuda Firewall Admin (for example: control, event, statistics, config). The severity level for notifications regarding access to box services is configurable in CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification. Notifications for other services may be customized per service.

Notice

NG Firewall Login Warning

FW Global Connection Limit Exceeded

The number of total sessions allowed for a request has been exceeded (see: General Firewall Configuration).

Security

A DHCP lease has been deleted from the database.

VPN Server On Demand Tunnel Deactivated

An on-demand VPN site-to-site tunnel has been deactivated. 

The collection of the Certificate Revocation List (CRL) has failed. Paths to CRLs are defined in the VPN Settings > Root Certificates > Certificate Revocation. Polling for CRL retrieval is defined through the parameter CRL Poll Time.

Security

Connection refused due to invalid VPN Client version.

The number of blocked requests has exceeded the port scan threshold within the configured port scan detection interval. Limit values can be customized in the Port Scan Policy section. Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > General Firewall Configuration > Operational. 

FW Flood Ping Protection
Activated

The minimum delay time for pinging defined in a firewall service object has been under-run and the connection has therefore been blocked by the FW.

Warning

FW Activating Perimeter
Defense (inbound mode)

The inbound mode threshold (%) value specified in the local firewall settings (see: Host Firewall) has been exceeded.

FW Pending TCP Connection
Limit Reached

The number of pending TCP sessions per source IP exceeds the allowed maximum. Requests initiating further pending sessions will be blocked. The threshold is configurable in the Firewall Forwarding Settings > Firewall tab (parameter Max. Pending Forward Accepts/Src).

FW UDP Connection per Source Limit Exceeded

The maximum number of UDP sessions per source IP has been exceeded. The thresholds can be configured in the Local Firewall Settings > Session Limits tab (parameter Max Local-In UDP/Src) and in the Firewall Forwarding Settings > Firewall tab (parameter Max. Forwarding UDP/Src).

Warning

FW UDP Connection Limit Exceeded

The maximum number of UDP sessions has been exceeded. The threshold can be configured in the Local Firewall Settings > Session Limits tab (parameter Max UDP (%)).

Security

FW Oversized SYN Packet
Dumped

An ICMP-ECHO packet larger than the configured maximum ping size (see: Service Objects) has been dropped by the firewall.

FW IP Spoofing Attempt Detected

FW Potential IP Spoofing Attempt

A SYN flooding attack has been identified (see: Best Practice - Protect Against TCP SYN Flooding Attacks with TCP Accept Policies).

FW Rule Connection Limit Exceeded

The maximum number of concurrent connections allowed per rule has been exceeded. The maximum value is defined by the parameter Max. Number of Sessions (see: General Firewall Configuration).

Warning

FW Rule Connection per Source
Limit Exceeded

The maximum number of concurrent connections allowed per rule and source has been exceeded. The maximum value is defined by the parameter Max. Number of Sessions per Source (see: General Firewall Configuration).

Warning

A firewall rule equipped with event generation has been processed. The severity level of the generated event is defined by the rule (see: How to Configure Event Notifications).

Notice

A firewall rule generating event log type `warning` has been processed.

A firewall rule generating event log type `alert` has been processed.

Source Limit Exceeded

The maximum number of concurrent connections allowed per source has been exceeded. The maximum value is defined by parameters Max Local-In Session/Src in the Local Firewall Settings and Max. Forwarding Session/Src in the Forwarding Firewall Settings.

Warning

Source Limit Exceeded

Warning

Limit Exceeded

Warning

Source Limit Exceeded

The maximum number of concurrent OTHER-IP connections (all IP protocols except TCP, UDP, and ICMP) allowed per source has been exceeded. The maximum value is defined by parameters Max Local-In Other/Src in the Local Firewall Settings and Max. Forwarding Other/Src in the Forwarding Firewall Settings.

Warning

FW OTHER-IP Session Limit
Exceeded

The maximum number of OTHER-IP sessions (all IP protocols except TCP, UDP, and ICMP) has been exceeded. The threshold can be configured in the Local Firewall Settings > Session Limits tab (parameter Max Other (%).

Warning

ARP has detected a MAC address change. 

FW ARP Ambiguous Duplicate
Reply

ARP has detected a duplicate MAC address. 

FW ARP Request Device
Mismatch

ARP has detected a device mismatch. 

FW ARP Reverse Routing Interface Mismatch

ARP has detected an interface mismatch. 

IPS Signature. An object of event log type `Notice' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

IPS Signature. An object of event log type `Warning' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

IPS Signature. An object of event log type `Alert' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

IPS Signature. An object of event log type `Drop Notice' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

IPS Signature. An object of event log type `Drop Warning' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

IPS Signature. An object of event log type `Drop Alert' referenced in the Intrusion Prevention System (IPS) database has been detected by the firewall.

A system login has been attempted with an unknown login ID (CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification, see: How to Configure Access Notifications).

Warning

A login attempt with a valid login ID has failed (CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification , see: How to Configure Access Notifications).

Notice

A login attempt with a valid login ID has failed the second time (CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification , see: How to Configure Access Notifications). The ACL does not match.

Warning

A login attempt with a valid login ID has failed at least three times (CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification , see: How to Configure Access Notifications).  Password authentication failure and/or unsuccessful command match.

Security

Informal event stating that a firewall session has been initiated.

A traced user has initiated an SSH connection.

A firewall session has been initiated. See log for details.

Remote Command Execution
Notice

Remote command execution has been triggered remotely by the Barracuda Firewall Control Center (in CC CONTROL > Remote Execution) or by an authorized user. Note that copying files with SCP also generates this event. Successful authentication and command are accepted. 

Notice

Remote Command Execution
Warning

Remote command execution of event log type 'warning' has been triggered.

Remote Command Execution
Alert

The quality of these event notifications is determined by the settings made in CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Access Notification ( see: How to Configure Access Notifications). The following notifications apply with default settings:

• Notice (not assigned)
• Warning (successful SSH and remote SSH login)
• Alert (successful console login). Login failure triggers events 4110, 4111, and 4112 (see above).

Notice

One or more entries have been deleted from the log database. See log for details.

One or more entries have been deleted from the statistics database. See log for details.

CC Statistics Collection has failed for a range, cluster, or box service. See statistics services, CC Control > Statistics Collection, and log for details.

Keyboard combination CTRL-ALT-DEL has been used on Barracuda Firewall Admin to shut down or reboot a firewall.

The system has been rebooted. The manual reboot will trigger this event just like the Watchdog repair binary (see: Watchdog).

The run level of the operating system has changed. Run levels change during system boot.

The system has been booted in Single User mode using the boot option "single".

Unusual behavior of the firewall during the bootup process. See log for details.

An emergency system boot has been executed. See log for details.

Bootloader Configuration
Change

A configuration change has been applied to the bootloader configuration. See log for details.

New kernels were installed during the update. See log for details.

New kernels were installed during the update. See log for details.

The kernel update has failed. See log for details.

Custom Bootloader or Kernel
Update

The bootloader or kernel was updated. See log for details.

Bootloader Test Activation
Failure

Bootloader test activation has errors or failures. See log for details.

Bootloader activation has failed. See log for details.

Bootloader disaster recovery was performed. See log for details.

A new configuration has been applied to the bootloader. See log for details.

A kernel update was performed. See log for details.

The kernel update is waiting for installation. See log for details.

Activate Pending Kernel
Update

The kernel update is waiting for activation. See log for details.

Bootloader Reconfiguration
Failed

The Bootloader configuration update has failed. See log for details.

The kernel update has failed. See log for details.

Access Control List (ACL) contains empty values. See log for details.

Access Control List (ACL) contains too many values. See log for details.

Password or key update failed. See log for details.

Subsystem Release Update
Succeeded

CloudGen Firewall successfully updated. See log for details.

Subsystem Release UpdateCanceled

Subsystem Release Update
Aborted

A software update has been aborted. See log for details.

A CloudGen Firewall release update has failed. See log for details.

Release Inconsistencies Detected

Incorrect RPM packages have been installed (for example: hotfixes intended for another Barracuda CloudGen Firewall release version) or Barracuda Networks files have been modified (for example: by manually editing a Barracuda Networks script).

Warning

An email has been discarded from the mail queue. This event is reported only when the parameter Admin Reception Commands is set to yes.

An email has been allowed or blocked manually (Processes Tab, Allow Mail Reception/Block Mail Reception). This event is reported only when the parameter Admin Discard Mail Cmd is set to yes.

Email delivery to a banned recipient has been refused. This event is reported only when the parameter Recipient Dropped is set to yes. 

Relaying of an email has been denied according to the content filter configuration. This event is reported only when the parameter Mail Denied is set to yes. 

These are customized events with corresponding customized descriptions, which are triggered when the action type 'Event' is used.

• Event-ID 0 = Severity Notice
• Event-ID 1 = Severity Warning
• Event-ID 2 = Severity Security

Events will be reported only when the parameter User Defined Rule Event is set to yes (default).

Firewall connection to the ATP Cloud - primary ATP server cannot be reached, switching over to the secondary server.