Firewall & Network Device Integration

Objects → External Dynamic Lists → Add
  Name: vspam-blocklist
  Type: IP List / Domain List / URL List
  Source: FEED_URL
  Repeat: Hourly

config system external-resource
  edit "vspam-blocklist"
    set type address
    set resource "FEED_URL"
    set refresh-rate 60
  next
end

Firewall → Aliases → Add
  Name: vspam_blocklist
  Type: URL Table (IPs)
  URL: FEED_URL
  Update Freq: 1 (days)

set security dynamic-address feed-server vspam-feed url FEED_URL
set security dynamic-address feed-server vspam-feed update-interval 3600
set security dynamic-address address-name vspam-blocklist profile feed-name vspam-feed

Objects → Object Management → External Feed → Add
  Name: vspam-blocklist
  Feed URL: FEED_URL
  Type: IP / URL
  Update Frequency: 3600 seconds

#!/bin/bash
# /etc/cron.hourly/vspam-blocklist
ipset create -exist vspam hash:net
curl -sf "FEED_URL" | grep -v '^#' | while read ip; do
  ipset add -exist vspam "$ip"
done
iptables -I INPUT -m set --match-set vspam src -j DROP

/system scheduler add name=vspam-update interval=1h on-event={
  /tool fetch url="FEED_URL" dst-path=vspam.txt
  /ip firewall address-list remove [find list=vspam]
  :foreach line in=[/file get vspam.txt contents] do={
    :if ([:pick $line 0 1] != "#") do={
      /ip firewall address-list add list=vspam address=$line
    }
  }
}

# /etc/cron.hourly/vspam-suricata
curl -sf "FEED_URL" | grep -v '^#' | \
  awk '{print $1",1,127"}' > /etc/suricata/iprep/vspam.list
suricatasc -c reload-rules