Skip to main content
JairCandia
JairCandia
Visitor III
November 30, 2023
Question

Automation stitch cli script variables

  • November 30, 2023
  • 7 replies
  • 6186 views

Hi Community,

 

I am trying to create an automation stitch to create an object and added it to a Deny group when somebody try access VPN SSL with admin or root user.

 

For this I created a Handler at FortiAnalyzer to alert when detects this users attempt

 

image.png

 

 

 

 

 

 

 

 

So I created this Stitch

image.png

 

 

image.png

 

 

 

 

 

 

 

image.png

 

 

 

 

 

 

 

 

 

 

 

 

 

Everything works, but when I debug we can see that the variable %%remip%% is not working

image.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

I also tryed including commands "config vdom   edit vdom"  but neither works.

 

Any idea?

Thank you in advance!

7 replies

distillednetwork
distillednetwork
Explorer II
December 1, 2023

does it not work with %%log.remip%% ?

JairCandia
JairCandiaAuthor
Visitor III
December 4, 2023

no, then I tried with %%log.remip%% and its the same

mle2802
Staff
mle2802
Staff
December 2, 2023

Hi @JairCandia,

Please refer to this article for more information https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-SSL-VPN-Failed-Logins-with-an-automation/ta-p/287171

Regards,
Minh

    distillednetwork
    distillednetwork
    Explorer II
    December 3, 2023

    This is helpful, but with what @JsairCandia is trying to do, it doesn't appear that you can have multiple usernames in the filter for the failed login events.

    JairCandia
    JairCandiaAuthor
    Visitor III
    December 6, 2023

    Thats right, I want to block multiple user with only one Stitch.

    From a FortiOS Event Log its possible ( I have it working now) but I need to create a new Stitch for every user.

    image.png

     

    image.png

     

     

     

     

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    December 5, 2023

    The issue might be the involvement of FortiAnalyzer.

    The KB shared by Minh demonstrates that %%log.remip%% works when both the log and stitch are on FortiGate; in your case, the log is sent to FortiAnalyzer, which has an event handler to then trigger an automation stitch, instead of the FortiGate detecting the log itself (including all its fields and values) and triggering the stitch.

    I believe because it is up to FortiAnalyzer to trigger the stitch, it is not aware of the %%remip%% or %%log.remip%% variable in the stitch, and thus the remote IP is never shared with the FortiGate. The FortiGate on the other hand is not aware of the log, as the stitch is triggered by the Event Handler, not an actual log message.

    I'm not certain if variables CAN be used when having FortiAnalyzer trigger the automation stitch, instead of a log message on FortiGate itself.

      JairCandia
      JairCandiaAuthor
      Visitor III
      December 6, 2023

      Hi Debbie,

      Thank you for your thoughts. Sounds like thats the reason, but I dont know then why we have the FortiAnalyzer Event Handler trigger option.  =S

      Terms & ConditionsAccessibility statement
      Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
      Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.