Skip to main content
GCLWLAW
GCLWLAW
New Member
October 16, 2025
Question

entry not found in datasource when append srcaddr in firewall local-in-policy

  • October 16, 2025
  • 3 replies
  • 981 views

Hello,

 

I'm following this guide : 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-logins/ta-p/287171#:~:text=Creating%20the%20Automation%20Stitch%20(Part,for%20the%20new%20Automation%20Stitch.&text=Next%2C%20select%20Add%20Trigger%2C%20then,by%20selecting%20FortiOS%20Event%20Log

 

Trying to do an automation to create a new group each day.

I 'm on a FG100E with OS 7.0.17

 

I manage to create the group with the date :

edit VPN_Failed_Login_%%date%%

 

But when I want to add this new group to my config firewall local-in-policy with 


append srcaddr VPN_Failed_Login_%%date%%

 

I got this :

 

entry not found in datasource

value parse error before 'VPN_Failed_Login_%%date%%'

Command fail. Return code -3

 

Any help?

 

Thanks,

 

3 replies

Stephen_G
Moderator
Stephen_G
Moderator
October 19, 2025

Hi,

 

Thanks for using our forum! We'll try to get you an answer as soon as we can.

 

If anybody seeing this has any ideas, feel free to contribute!

Stephen_G - Fortinet Community Team
funkylicious
SuperUser
funkylicious
SuperUser
October 19, 2025

hi,

the group should be static and manually created beforehand with a name something like VPN_Failed_Login ( as per example ) and in it you should append the created firewall object SSLVPN-Block-%%log.remip%% ( as per example ).

you are trying to add a group to a group, what you need is to add an object ( SSLVPN-Block-%%log.remip%% ) to a group that is used as source to block the traffic ( VPN_Failed_Login ) 

"jack of all trades, master of none"
    GCLWLAW
    GCLWLAWAuthor
    New Member
    October 20, 2025

    Hi Funky,

     

    Thanks for your reply. as group are limited to 600 entries, I have to create a group per day. Following the documentation, I'm able to create the groupe with the day date. then, entries (IPs) are automatically  created and added. The only part that is not working is when I want the group to be added to the policy. For now, I just do it manually:

     

    config firewall local-in-policy

    edit 1

    append srcaddr VPN_Failed_Login_2025-10-20

    end

     

    Thanks

    G

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    October 20, 2025

    hi,

    i would suggest using a threat feed as the source and you can create ( or search on the Internet ) a custom script that would insert into that list any remote IPs that tried to login.

    "jack of all trades, master of none"
    GCLWLAW
    GCLWLAWAuthor
    New Member
    October 22, 2025

    Thanks for your suggestion.

    I don't know why but it start to work by itself over the weekend. 

    Terms & ConditionsAccessibility statement