It is recommended to modify the default configuration for the events. You can modify the severity, notification, event propagation, and persistence of each event. Events are identified by ID numbers and classified by severity class as security or operational events.
Security Events – ID 6, 7, 8
Operative Events – ID 1, 2, 3, 9
Before You Begin
Look up the event IDs you want to change. For more information, see Operational Events and Security Events.
Step 1. Configure Basic Settings
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Eventing.
Click Lock.
Click on the Basics tab.
To disable forward events to a Control Center, clear the Send Event to CC check box.
Click Silent Box to collect events, but do not send notifications.
Enter the maximum number of events in the Max Event Records. Records exceeding this limit are dropped.
Click Send Changes and Activate.
Step 2. Configure Event Notification Settings
Five notification IDs are available. Configure the notification types that each notification ID sends. To avoid being flooded by notifications, configure thresholds.
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Eventing.
Click Lock.
Click on the Notifications tab.
Double-click the notification ID you want to edit. The Detail window opens.
(optional) Modify the Description.
Click the Event must be confirmed check box to require the admin to acknowledge and mark the event as read in the EVENTS tab.
In the Server Action tab, configure the event notifications carried out by the firewall:
Select and configure the sever action Types:
Mail – It is possible to send notifications with email to multiple recipients. When using multiple recipients, separate them with a semicolon or a space character.
For sending notifications with email, the following configuration options are available:
"Legacy" Mode – If the edit fields for email are configured at Configuration Tree > Box > Administrative Settings > Notifications only and the check box STARTTLS is not selected, then notifications are sent unencrypted to the specified email receiver.
"Override" Mode – If you want to have your notifications to be sent to a different recipient as configured at Configuration Tree > Box > Administrative Settings > Notifications:
Go to Configuration Tree > Box > Infrastructure Service > Eventing, tab Server Action.
Activate the check box Mail.
Fill out the edit fields From:, To:, and Mail Server: with the required email configuration information.
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
Execute Program – Executes a script or other executable on the firewall. Enter the executable including the full path as the Parameter.
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
SNMP – To send SNMP traps to a SNMP server, configure up to two SNMP servers and the SNMP Community and Spec Type settings.
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
Apple Push Notification Service – To send push notifications to your iOS device running Barracuda Firewall Remote Control, enter the Device token shown on the Remote Control display. You can add multiple iOS devices.
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
Slack Notification – To send a Slack notification, enter the name of your Slack channel and the name of the incoming web-hook.
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
MS Teams Notification – To send a notification via MS Teams, enter the web-hook URL of your MS Teams:
If this server action must be performed repeatedly, activate the Repeat Every check box and adjust the interval.
Click OK.
For a Control Center, add an access rule to permit traffic on port 2195 TCP to the Apple APN servers. For more information about how to add an Access Rule, see How to Create a Pass Access Rule.
(optional) Click the Client Action tab. The EVENTS tab on Barracuda Firewall Admin must be set to LIVE for these notifications to be executed.
Click the Enable check box.
Select the Type:
Popup – A pop-up window opens for each notification on the client running Barracuda Firewall Admin.
Audio Alert – A WAV audio file is played.
Click OK.
Click the Thresholds tab.
Click the check box to enable these thresholds before activating the notification. Note that notifications are activated if any of the configured thresholds are reached during the configured time interval.
For each of the given time intervals – Adjust the minimum of events that are necessary during the related time interval to trigger a notification.
Example: 2 during 5 min. If 2 events occur within the period of 5 minutes, then a notification will be sent.
Click OK.
Click Send Changes and Activate.
Repeat this step until all notification IDs are configured to match your needs.
Step 3. Modify Event Severity Settings
Modify the notification type for the severity category and if it is forwarded to the Control Center (only when the firewall is managed).
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Eventing.
Click Lock.
Click on the Severity tab.
Double-click on the severity ID you want to edit. The Detail window opens.
(optional) Modify the Description.
From the Notification ID list, select the notification.
To forward the event to the Control Center, click the Propagate to CC check box.
Click the Drop Event check box to avoid displaying these events in the Events tab.
Click OK.
Repeat this step until all severity IDs are configured to match your needs.
Step 4. Modify the Event Default Severity and Notification IDs
Modify the severity and notification event IDs selected by default for the events.
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Eventing.
Enter the ID for the events in the Lookup field.
Double-click the highlighted event. The Detail window opens.
Select the Severity ID.
Select the Notification ID. Select from severity to use the default notification ID for the severity.
Click the Persistent check box to forward the event only once to the Control Center, even it if occurs multiple times.
Click the Propagate to CC check box to forward the event to the Control Center. This setting overrules the setting in the basic and severity configurations.
Click the Drop Event check box to drop the event.
Click OK.
Click Send Changes and Activate.