Technical Tip: Quarantine the IP for failed SSL VPN login using an automation stitch

dbhavsar · ‎02-28-2024

Description

This article describes how to quarantine the IP address that failed to login to SSL VPN using an automation stitch

Scope

FortiGate

Solution

Create an automation stitch: Navigate to Security Fabric -> Automation -> Create New -> supply the name 'SSL_VPN_Login_Block'.
Select Add Trigger -> Create -> FortiOS Event Log -> supply the name 'QuarantineSSLVPN-FailedIP' -> open the FortiOS Event Log: Search and add 'SSL VPN login fail' -> select Ok -> select Apply.

Select Add Action -> Create -> CLI Script -> Supply the name 'QuarantineIP' -> Enter the script below -> Select Administrator profile as 'super_admin' -> select Ok -> select Apply -> select Ok.

diagnose user quarantine add src4 %%log.remip%% 9504000 admin <----- This will block IP for 110 days.

Note:

Once the IP is quarantined, with one failed attempt it will add the IP address to the banned list. it will be necessary to manually remove the IP address from the list to unban it.