Technical Tip: Quarantine the IP for failed IPsec connection failed using automation stich

[Ashishdeep]

Description	This article describes how to ban an IP address on the FortiGate by using an automation stitch for a failed IPsec connection.
Scope	FortiGate.
Solution	Create an automation stitch and select trigger and create a trigger for FortiOS Event Log and select 'IPsec connection failed': Creating automation stitches | FortiGate / FortiOS 7.4.4 | Fortinet Document Library Create a CLI script as an action and run this command to ban or quarantine an IP address by using this command: diagnose user quarantine add src4 %%log.epip%% 9504000 admin  Note: After v7.2 and onwards, banned-ip is used instead of quarantine. Related article:  Technical Tip: Quarantine the IP for failed SSL VPN login using an automation stitch