entry not found in datasource when append srcaddr in firewall local-in-policy

[GCLWLAW]

Hello,

I'm following this guide : 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-lo...

Trying to do an automation to create a new group each day.

I 'm on a FG100E with OS 7.0.17

I manage to create the group with the date :

edit VPN_Failed_Login_%%date%%

But when I want to add this new group to my config firewall local-in-policy with 

append srcaddr VPN_Failed_Login_%%date%%

I got this :

entry not found in datasource

value parse error before 'VPN_Failed_Login_%%date%%'

Command fail. Return code -3

Any help?

Thanks,

[Stephen_G]

Hi,

Thanks for using our forum! We'll try to get you an answer as soon as we can.

If anybody seeing this has any ideas, feel free to contribute!

[funkylicious]

hi,

the group should be static and manually created beforehand with a name something like VPN_Failed_Login ( as per example ) and in it you should append the created firewall object SSLVPN-Block-%%log.remip%% ( as per example ).

you are trying to add a group to a group, what you need is to add an object ( SSLVPN-Block-%%log.remip%% ) to a group that is used as source to block the traffic ( VPN_Failed_Login ) 

[GCLWLAW]

Hi Funky,

Thanks for your reply. as group are limited to 600 entries, I have to create a group per day. Following the documentation, I'm able to create the groupe with the day date. then, entries (IPs) are automatically  created and added. The only part that is not working is when I want the group to be added to the policy. For now, I just do it manually:

config firewall local-in-policy

edit 1

append srcaddr VPN_Failed_Login_2025-10-20

end

Thanks

G

[funkylicious]

hi,

i would suggest using a threat feed as the source and you can create ( or search on the Internet ) a custom script that would insert into that list any remote IPs that tried to login.