topic Re: IPS Geo Protection doesn't recognize the country in Firewall and Security Management

IPS Geo Protection doesn't recognize the country

CheckMate-R77 — Mon, 21 Dec 2020 11:16:11 GMT

Hello.

On freshly updated R80.40 there is some issue with Geo Protection. We have added Poland as source country in one of ours security rules and one address is blocked, but it should not be.

Let's take for example following IP: 194.36.19.20. Acording to this sk94364 it's "value" used in the IpToCountry.cvs is:

194.36.19.20 = 20 + 19 * 256 + 36 * 256*256 + 194 * 256*256*256 = 20 + 4864 + 2359296 + 3254779904 = 3257144084

In IpToCountry.cvs (it was updated automatically few hours ago) it shows correctly as Poland:

"3257144064","3257144319","iana","410227200","PL","POL","Poland"

At https://www.maxmind.com/en/geoip-demo that IP is Poland, too. So everything seems ok, but unfortunately it is blocked by "Geo-location inbound enforcement" although all traffic from Poland is allowed. In default geo policy we only block some countries and all others are allowed (default policy for other countries is allow). In logs there is no even the flag in front of that IP (as it always should be). It seems like it's unrecognized country and ... that's why blocked :-(.

Any ideas?

Best regards

Mirek

Re: IPS Geo Protection doesn't recognize the country

G_W_Albrecht — Mon, 21 Dec 2020 12:09:55 GMT

I would contact TAC with the issue !

Re: IPS Geo Protection doesn't recognize the country

Danny — Mon, 21 Dec 2020 12:56:03 GMT

Make sure your gateway and management have updated IpToCountry databases.

One-liner to update IpToCountry data on Security Managements

Common Check Point Commands

Re: IPS Geo Protection doesn't recognize the country

CheckMate-R77 — Mon, 21 Dec 2020 13:21:13 GMT

As far as I know management has no in.geod service and IpToCountry.csv file.

On gateways service is running and the file was (as I wrote) updated few hours ago.

Re: IPS Geo Protection doesn't recognize the country

Danny — Mon, 21 Dec 2020 13:23:16 GMT

Your management has an IpToCountry.csv, see my links above.

Re: IPS Geo Protection doesn't recognize the country

CheckMate-R77 — Mon, 21 Dec 2020 14:06:50 GMT

Yes Sir,

one-liner works great! Now management correctly shows this IP's country in logs.

Thank You very much, however sk114216 is talking only about gateway and not a word about management. Strange.

Re: IPS Geo Protection doesn't recognize the country

CheckMate-R77 — Mon, 21 Dec 2020 14:08:33 GMT

By the way in Support Service Request we have only 2 options:

1. Non-Technical Issue (Account Services and Licensing)

2. Content Classification (Report Spam misclassification, Request URL Categorization)

Don't You think it should be (at least) 3-rd option:

3. Geo IP issues (country misclassification) ?