Technical Tip: Automation stitch to add an address object group based on a predetermined schedule and append it to SSL VPN block automation stitch

Based on the article Technical Tip: How to permanently block SSL VPN failed logins using an Automation Stitch, the following solution features a stitch to add groups on a weekly basis.

1. Create a trigger for schedule:
   
   

CLI configuration:

config system automation-trigger

    edit "weekly"

        set trigger-type scheduled

        set trigger-frequency weekly

        set trigger-weekday friday

        set trigger-hour 23

    next

end

2. Create an automation action:
   
   

CLI configuration: 

config system automation-action

    edit "update_addrgrp"

        set action-type cli-script

        set script "config firewall addrgrp

            edit VPN_Failed_Login_%%date%%

            end
            config firewall local-in-policy

            edit 3

                append srcaddr VPN_Failed_Login_%%date%%

            end"

        set accprofile "super_admin"

    next

end

3. Update the actual automation-action which is already configured as 'BAN-SSLVPN-IP'.
   
   

CLI configuration: 

config system automation-action

    edit "BAN-SSLVPN-IP"

        set action-type cli-script

        set script "config firewall address

            edit SSLVPN-Block-%%log.remip%%

                set color 6

                set subnet %%log.remip%%/32

            end

            config firewall addrgrp

                edit VPN_Failed_Login_%%date%%

                append member SSLVPN-Block-%%log.remip%%

            end"

        set accprofile "super_admin"

    next

end

4. Now, create the new stitch for creating the groups weekly.

CLI configuration:

config system automation-stitch

    edit "update addrgrp"

        set trigger "weekly"

            config actions

                edit 1

                    set action "update_addrgrp"

                    set required enable

                next

            end

        next

    end

5. Right-click on the stitch 'update addrgrp' and select 'Test Automation Stitch'. The group should be created immediately.
   
   

6. Attempt a failed login on SSL VPN. The trigger will add this new failed login remote-ip to a new address object group and will add it to the local in policy as well.

CLI references for the steps above are already mentioned in the original article. Refer to that article for the CLI and VDOM references for the above steps.