Skip to main content
RobertC
RobertC
New Member
January 17, 2024
Solved

Atutomation: CLI action - grab "Remote IP"

  • January 17, 2024
  • 5 replies
  • 6225 views

Hello,

I'm trying to grab IP address from the log after ssl-login-fail and create new Firewall->address and append it to existing group using CLI script:

Log event looks like this:

date=2024-01-17 time=11:11:19 id=7325007792115286044 itime="2024-01-17 11:11:19" euid=1049 epid=3 dsteuid=3 dstepid=3 logver=700130566 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="admin" remip=5.153.183.36 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_permission_denied" eventtime=1705486279485398543 tz="+0100" devid="FG100E4Q17012295" vd="root" csf="TCCM_SF" dtime="2024-01-17 11:11:19" itime_t=1705486279 devname="EDGECLUSTER_FG100E"

 I see that IP address in question is named remip

 

My script follows:

config firewall address edit %%remip%%_SSL_VPN set subnet %%remip%% 255.255.255.255 next end  config firewall addrgrp edit Banned_SSLVPN append member %%remip%% next end

but the result is nothing, no address entry is created. How can I debug it (or at least check some logs)?

PS: the stitch input is FAZ log

Thanks

Robert

Best answer by RobertC

Well,

for the sake of archives....

There is a confirmed bug in FortiAnalyzer 7.2.x, which causes that srcip is not send in the log back to Fortigate so the script trying to grab this value can't work. Recommended solution is to upgrade FAZ to 7.4.x

 

HTH

Robert

5 replies

funkylicious
SuperUser
funkylicious
SuperUser
January 17, 2024

Hi,

The append should contain, %%remip%%_SSL_VPN object name, since that is what you are creating.

 

L.E. also try %%log.remip%% instead of %%remip%% if it still doesnt work 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Permanently-block-rogue-IPs-from-accessing-the-SSL/ta-p/290823

"jack of all trades, master of none"
RobertC
RobertCAuthor
New Member
January 17, 2024

Hey,

good catch on that %%remip%%_SSL_VPN object. However I tried with %%log.remip%% and the IP address entry is still not created. I removed that append to group for the moment. Now I'm trying to "Record in console" method, maybe there was some unwanted character as I pasted the script to the field. So far it's still not working.

pminarik
Staff
pminarik
Staff
January 17, 2024

I noticed one additional error.

First you create a new address object named "<remip>_SSL_VPN".
Then you edit the existing address group and try to add a new member to it named "<remip>". In other words, the names don't match.

 

edit: just realized that @Bjay_Prakash_Ghising already highlighted this.

Bjay_Prakash_Ghising
Bjay_Prakash_Ghising
Explorer II
January 17, 2024

Hi RobertC,

 

Your script must add the address into the address group. 

 

In this situation, you need to append %%remip%%_SSL_VPN

config firewall address edit %%remip%%_SSL_VPN set subnet %%remip%% 255.255.255.255 next end  config firewall addrgrp edit Banned_SSLVPN append member %%remip%%_SSL_VPN next end

 

Please try and let us know. 

 

Hope that helps,

 

Kind Regards, 

Bijay Prakash Ghising

pminarik
Staff
pminarik
Staff
January 17, 2024

Variables that are taken from the triggering log message must always be in the form of %%log.<log-field-name>%%.

 

%%log.remip%%
%%log.user%%

%%log.msg%%

etc.

 

You can refer to the clickable "%" button, it will show you what the variables should look like.

 
Bjay_Prakash_Ghising
Bjay_Prakash_Ghising
Explorer II
January 17, 2024

Hi pminarik, 

 

Greetings!

 

When I tried to append the source IP from the trigger. It worked for me when I specified %%srcip%%

 

Please find the attached article for your reference. 

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-and-append-addresses-into-address-groups/ta-p/261701

 

[ corrections always welcome ]

 

Kind Regards, 

Bijay Prakash Ghising

 

pminarik
Staff
pminarik
Staff
January 17, 2024

Interesting! %%log.xyz%% used to be the way to do this, looks like this has changed recently. Thanks for sharing.

Bjay_Prakash_Ghising
Bjay_Prakash_Ghising
Explorer II
January 17, 2024

Hi RobertC, 

 

Please note, that it's up to the FAZ handler configuration on how to channel the logs to the FortiGate.

 

If you only filter to send specific logs to the FortiGate then you might miss out on the IP address filed in the log message.

 

If the log doesn't contain or misses the key-value pair (for example, remip=5.153.183.36), then the action will be null. 

 

Hope that helps, 

 

Kind Regards, 

Bijay Prakash Ghising

 

 

RobertC
RobertCAuthor
New Member
January 17, 2024

Yeah,

I understand how it's supposed to work. I made a support ticket to ask for help, because I have no idea how to alter output of FAZ handler.

 

Thanks

Robert

Bjay_Prakash_Ghising
Bjay_Prakash_Ghising
Explorer II
January 17, 2024

Hi @RobertC 

 

You may refer to the following attached article. 

 

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-an-Event-Handler-in-FortiAnalyzer-when/ta-p/290275

 

It might give you some idea to work with your requirements. 

 

Hope it helps, 

 

Kind Regards, 

Bijay Prakash Ghising

 

 

 

RobertC
RobertCAuthorAnswer
New Member
January 24, 2024

Well,

for the sake of archives....

There is a confirmed bug in FortiAnalyzer 7.2.x, which causes that srcip is not send in the log back to Fortigate so the script trying to grab this value can't work. Recommended solution is to upgrade FAZ to 7.4.x

 

HTH

Robert

Terms & ConditionsAccessibility statement