Only works on R80.40
Link here: https://github.com/inscez/ckp-dyn-ip-block
I have recently been involved in a project where i had to block a list of 2000 IP Addresses that were provided by a third party vendor as a CSV. I have created a script that moves this to a local URL that is accessed by Security Gateways every 20 minutes and updated into dynamic blocking function of fw accel dos [basically blocking IPs using dos mitigation engine with a quota of 0 packets]. The advantages are that it works bidirectional and also without policy push.
Basically this has a deployment script that replicates the actual script to a list of GW. It has functionality to deploy, activate and deactivate the script. It can also clean the script. It only supports ONE URL but the scripts may be modified easily to support more than one.
The load on the Gateways is not very high an i am getting very good results with it in the last 2 months since it is deployed on 30+ gateways.
The old SK was using fw samp while this one is using fw accel dos. Another advantage is that this one also blocks outbound traffic and logs properly. The old fw samp solution is not logging correctly or is using only unsupported fields.
To see logs search Smart Log for SecureXL -> "The packet's destination IP is blacklisted (SecureXL device 0)"
I have used the following SK/articles for reference: