I was creating a script that looks in the memory log and if it finds an "ipsec,error" about failed phase1 negotiation adds the address to a blacklist.
In case someone else is interested, here is the script that I'm running on couple of routers.
The script is made by a function to search for duplicates addresses in the address-list and the main script itself.
The function is loaded as global variable and must be reloaded each time the router restarts.
Code: Select all
# Function to search for duplicated IP in address-list
:global searchIPList do={
:local listName $1
:local ipAddr $2
:if ([:len [/ip firewall address-list find list=$listName]] > 0) do={
:foreach foundIP in=[/ip firewall address-list find list=$listName] do={
:if ($ipAddr = ([:pick [/ip firewall address-list print as-value where .id=$foundIP] 0]->"address")) do={
:return "duplicated"
}
}
}
}
This is the main script that can be added to the router like any other script.
Code: Select all
# Main script adds to blacklist addresses which failed IPSec phase1
:global searchIPList
:global myBlackListName "intruseBL"
:foreach i in=[/log find where (topics=ipsec,error && message~"phase1 negotiation failed")] do={
:local iplength [:find [/log get value-name=message number=$i] " "]
:if ([:typeof $iplength] = "num") do={
:if ([:toip [:pick [/log get value-name=message number=$i] 0 $iplength]]~"^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}") do={
:local intruseIP [:pick [/log get value-name=message number=$i] 0 $iplength]
:if ([:len [/ip firewall address-list find list=$myBlackListName]] > 0) do={
:if ([$searchIPList $myBlackListName $intruseIP] != "duplicated") do={
/ip firewall address-list add list=$myBlackListName address=$intruseIP
}
} else={
/ip firewall address-list add list=$myBlackListName address=$intruseIP
}
}
}
}
Armando
