Email Alerts for Failed Admin Logins on a Palo Alto Firewall

Before you run this

This guide configures a Palo Alto firewall to send an email whenever it records a failed login to the device itself (web UI or CLI admin authentication). It does this by creating an Email server profile and attaching it to a System log forwarding filter. It does not touch security rules, NAT, or routing, so it will not drop production traffic — but it is still a configuration change that ends in a commit, and commit is the point where your changes become live.

You need a firewall administrator account with rights to edit Device settings and commit — a superuser role is the simplest. This is all done in the web GUI; no shell scripting is involved.

Standard firewall discipline still applies:

• Keep a separate console / out-of-band session open (serial console or a second management session) while you work, so a bad commit can't strip your only way back in.
• Back up the running config first. In the GUI: Device > Setup > Operations > Save named configuration snapshot, and Export named configuration snapshot to download a copy off-box.
• Do it in a maintenance window, even for a low-risk change, and test on a lab or spare firewall before you touch production.
• Rollback path: before you commit, you can discard everything with Config > Revert > Revert to running configuration. After a commit, you can go back with Device > Setup > Operations > Load configuration version and pick the version from before your change, then commit again.

I'm writing this for PAN-OS 11.1 on a standalone firewall (not managed by Panorama). Menu names moved slightly across 10.x/11.x, but the two building blocks — Email server profile and Log Settings — have been stable for years. If you're on Panorama, you'd do the equivalent under a Template instead of directly on the Device tab.

Step 1 — Create the Email server profile

This tells the firewall which SMTP server to relay through and who to email.

1. Go to Device > Server Profiles > Email.
2. Click Add.
3. Give the profile a Name, e.g. email-alerts.
4. On the Servers tab, click Add and fill in:
   • Name — a label for this server entry, e.g. smtp-relay.
   • Email Display Name — the "friendly" name shown in the From line, e.g. Firewall Alerts.
   • From — the sender address, e.g. firewall@example.com.
   • To — the recipient, e.g. secops@example.com.
   • Additional Recipient(s) — optional second address.
   • Email Gateway — the hostname or IP of your SMTP server, e.g. mail.example.com.

Replace every one of those with your own values — example.com is a placeholder.

A few honest caveats here. If your mail server requires a specific submission port, STARTTLS, or SMTP authentication, the exact fields available depend on your PAN-OS build; check the Email server profile page in the PAN-OS Web Interface reference for your version rather than assuming. Many setups simply point the firewall at an internal relay that accepts mail from the management IP without auth — that's the mainstream, reliable path, and I'd use it if you have one. Make sure the firewall's management interface can actually reach the relay on the SMTP port (a route and a security rule if the relay is across a zone boundary).

Leave the Custom Log Format tab alone unless you have a reason — the default format produces a readable message.

Click OK.

Step 2 — Identify the log you actually want to match

Rather than guess at an event name, generate a real failed-login entry and read it. Failed admin authentication to the device shows up as a System log.

1. Deliberately fail a login — from a test browser, try to log in to the firewall with a wrong password (don't lock out a real admin account; use a throwaway bad username if your account-lockout policy is aggressive).
2. Go to Monitor > Logs > System.
3. Find the resulting entry. Click it to open the detailed view and note its attributes — the Event, Severity, and the Description text (it typically reads along the lines of a failed authentication for a user).

I'm deliberately not pasting an exact eventid string here, because the precise event name has varied between PAN-OS releases and I won't risk you filtering on one that doesn't match your build. Reading the real log entry is the reliable way to get the right value, and it takes thirty seconds.

Step 3 — Build the System log forwarding filter

Now attach the email profile to a filter that catches those entries.

1. Go to Device > Log Settings.

2. In the System section, click Add.

3. Name the match list, e.g. failed-login-email.

4. Filter — click the dropdown and choose Filter Builder. Build a condition using the attributes you saw in Step 2. The cleanest match is usually on the Event ID of the failed-authentication event. In the builder:

   • Connector: and
   • Attribute: select the event / event-ID attribute
   • Operator: equal
   • Value: pick the failed-login event value from the dropdown (the builder populates real values from your system).
   • Click Add, then OK.

   Using the Filter Builder's own dropdowns is what keeps this honest — you're selecting values PAN-OS knows exist, not typing a string I made up. If you can't isolate a single event cleanly, a coarser but safe fallback is to filter System logs by Severity (for example, by the severity your failed-login entry showed), accepting that you'll also get other events at that level.

5. Under Built-in Actions / forwarding methods, find Email and click Add, then select the email-alerts profile you created in Step 1.

6. Click OK.

Step 4 — Commit

1. Click Commit (top right) and confirm.
2. If anything looks wrong before you commit, use Config > Revert > Revert to running configuration to back out cleanly.

Log forwarding takes effect on the live config once the commit completes.

Verify it worked

1. Trigger another failed login the same way you did in Step 2.
2. Confirm the new entry appears in Monitor > Logs > System.
3. Check the recipient mailbox (secops@example.com in the example) for the alert. Give it a minute — email forwarding is near-real-time but not instant.

If the log appears but no email arrives, the firewall-to-SMTP path is the usual culprit. Check that the relay accepts mail from the management IP, that the port and any TLS/auth settings match your relay, and look at Monitor > Logs > System for any delivery-related entries.

Undo / roll back

If you want to remove this cleanly:

1. Device > Log Settings — delete the failed-login-email match list entry under System.
2. Device > Server Profiles > Email — delete the email-alerts profile (delete the log setting first, or PAN-OS will object that the profile is still referenced).
3. Commit.

Or, to roll the whole change back in one shot, go to Device > Setup > Operations > Load configuration version, select the version saved before you started, and commit that.

A couple of worthwhile extensions once this is working, named but not walked through here: send the same alerts to Syslog or an HTTP server profile from the same match list, and configure GlobalProtect or Authentication log forwarding if you also want alerts on failed user (not admin) authentication — those live under their own sections in Device > Log Settings. For exact field definitions, the PAN-OS Web Interface Reference (Device > Server Profiles > Email, and Device > Log Settings) on the Palo Alto Networks documentation site is the authoritative source for your specific version.