# 2019 Jotne v1.1 # 1.1确定“谈判失败”是行结束,它包含IP # #此脚本添加IP用户失败的IPSEC协商为24小时#块列表调度的脚本运行每5分钟#应该运行在所有routerOS版本#找到所有“谈判失败”错误最后5分钟:当地loglist [: toarray[/日志找到时间>([/系统时钟时间]- 5米)(消息~”谈判失败了。l雷竞技\$" || message~"src_ip")]] #查找所有错误do:foreach i in=$loglist do={#查找消息:local logMessage [/log get $i message] #查找ip:local ip [:pick $logMessage 0 [:find $logMessage " "]] #将ip添加到accesslist /ip防火墙地址列表中添加地址=$ip list=IPSEC超时=24h #向日志发送消息:日志信息消息="script=IPSEC_failed src_ip=$ip"}

/system scheduler add interval=5m name="Find IPSEC" on-event=Find_IPSEC_negotian_failed

/ip firewall filter add action=drop chain=forward comment="阻断错误的IPSEC" in-interface=ether1 src-address-list=IPSEC

/系统脚本添加dont-require-permissions =没有名字= Find_IPSEC_negotian_failed所有者= = \ ftp jotne政策,重新启动,读,写,政策,测试,密码,嗅嗅,敏感,二大源= " #创建jotne 2019 v1.0 \ \ r \ n \ r \ \ n # #此脚本添加ip用户失败的IPSEC协商一块列表24小时\ r \ \ n #调度的脚本运行每5分钟\ r \ \ n它应该运行在所有routerOS版本号\ \ r \ n \ r \ \ n #找到所有\”谈判失败\”错误最后5分钟\ r \ \ n:当地loglist [: toarray[/日志找到l雷竞技time>([/系统时钟获取时间]- 5m)消息~\"协商失败\"]]\r\ n\r\ n# for all error do\r\ \n:foreach i in=\$ logist do={\r\ \n\ n# find message\r\ \n\t:local logMessage [/log get \$i message]\r\ \n# find ip\r\ \n\t:local ip [:pick \$logMessage 0 [:find \$logMessage \"\ "]]\r\ \n\r\ \n#将ip添加到accesslist\t\ \ \ \n\t/ip防火墙地址列表中添加地址=\$ip list=IPSEC超时=24h\r\ \n#发送消息到日志\t\ \ \n\t:日志信息消息=\"script=IPSEC_failed src_ip=\$ip\"\r\ \nr \ n \ t} \ \ \ n”

[#找到所有“谈判失败”错误最后5分钟:当地loglist [: toarray[/日志找到时间>((/系统时钟时间)- 24 h)消息~“谈判失败”]]所有错误做:# foreach我在= $ loglist ={#发现消息:当地logMessage[/日志得到我消息美元]#找到ip:本地ip[:选择$ logMessage 0美元[:找到logMessage "]] # accesslist / ip防火墙添加ip地址列表添加地址= $ ip列表= IPSEC超时= 24小时#发送信息到日志:把“脚本= IPSEC_failed src_ip = $ ip”}]

:put [:toarray [/log find time>([/system clock get time] - 24h) message~"negotiation failed"]]

[: local list [:toarray [/log find time>([/system clock get time] - 24h) message~"negotiation failed"]]:put "ID-List":put $list:put "":put " log lines":foreach i in=$list do={:put [/log print as-value where .id=$i]}]

[: local list [:toarray [/log find message~"a"]]:put "ID-List":put $list:put "":put " log lines":foreach i in=$list do={:put [/log print as-value where .id=$i]}]

:local list [:toarray [/log find message~"a"]]

:put [:toarray [/log find message~"a"]]

:put ([/system clock get time] - 2h)

[: local list [:toarray [/log find message~"negotiation failed"]]:put "ID-List":put $list:put "":put " log lines":foreach i in=$list do={:put [/log print as-value where .id=$i]}]

:put ([/system clock get time] - 2h)

:local list [:toarray [/log find message~"a"]]

:put [:toarray [/log find message~"a"]]

* lb60; * lb61; * lb62”

[: local logist [:toarray [/log find message~"negotiation failed"]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage " "]]:put "script=IPSEC_failed src_ip=$ip"}]

:put [:toarray [/log find time>([/system clock get time] - 24h) message~"negotiation failed"]]

[: local logist [:toarray [/log find time>([/system clock get time] -24h) message~"negotiation failed"]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage " "]]:put "script=IPSEC_failed src_ip=$ip"}]

[: local logist [:toarray [/log find message~"negotiation failed"]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage" "]]:put "script=IPSEC_failed src_ip=$ip msg=$logMessage"}]

[: local logist [:toarray [/log find (message~"negotiation failed" || message~"src_ip")]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage" "]]:put "script=IPSEC_failed src_ip=$ip msg=$logMessage"}]

[: local logist]:toarray [/log find message~"协商失败。\$"]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage" "]]:put "script=IPSEC_failed src_ip=$ip msg=$logMessage"}]

[: local logist [:toarray [/log find (message~"negotiation failed" || message~"src_ip")]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage" "]]:put "script=IPSEC_failed src_ip=$ip msg=$logMessage"}]

[: local logist [:toarray [/log find time>([/系统时钟获取时间]- 7d) (message~"negotiation failed" || message~"src_ip")]]:foreach i in=$ logist do={:local logMessage [/log get $i message]:local ip [:pick $logMessage 0 [:find $logMessage" "]]:put "script=IPSEC_failed src_ip=$ip msg=$logMessage"}]

:put [:toarray [/log find time>([/system clock get time] - 7d) message~"negotiation failed"]]

:local loglist [:toarray [/log find message~"negotiation failed.\$"]]

X.X.X.X第一阶段协商失败

xxx.zzz.yyy.ccc[500]<=>43.130.57.239[500] 19 e047e3b950a4ce: 2 f829675b9dfe1fa