https://community.checkpoint.com/t5/Firewall-and-Security-Management/Geo-Blocking-IKE-Implied-Rules/m-p/151902#M25028 <P>Hi all,</P><P>(R81.10)</P><P>We recently changed over from the legacy way of geo blocking to the recommended use of updatable objects as a rule in the access control policy.</P><P>The geo block rule is at the top off our ruleset but I think that the firewall still is allowing any IP to connect to the IKE ports (we use CP VPN) through the implied policy.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ike.jpg" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/17058i65CAA6A3FA7DD636/image-size/large?v=v2&amp;px=999" role="button" title="ike.jpg" alt="ike.jpg" /></span></P><P>I believe with the legacy geo policy it blocked any geo IP connecting to the firewall (this was proved with the recently issue with classifying UK IP's as Russian).</P><P>Is there a way to apply the geo rules to the applied policy?</P><P>Many thanks</P><P>Rich</P> Tue, 28 Jun 2022 08:22:26 GMT RichUK 2022-06-28T08:22:26Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Geo-Blocking-IKE-Implied-Rules/m-p/151902#M25028 <P>Hi all,</P><P>(R81.10)</P><P>We recently changed over from the legacy way of geo blocking to the recommended use of updatable objects as a rule in the access control policy.</P><P>The geo block rule is at the top off our ruleset but I think that the firewall still is allowing any IP to connect to the IKE ports (we use CP VPN) through the implied policy.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ike.jpg" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/17058i65CAA6A3FA7DD636/image-size/large?v=v2&amp;px=999" role="button" title="ike.jpg" alt="ike.jpg" /></span></P><P>I believe with the legacy geo policy it blocked any geo IP connecting to the firewall (this was proved with the recently issue with classifying UK IP's as Russian).</P><P>Is there a way to apply the geo rules to the applied policy?</P><P>Many thanks</P><P>Rich</P> Tue, 28 Jun 2022 08:22:26 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Geo-Blocking-IKE-Implied-Rules/m-p/151902#M25028 RichUK 2022-06-28T08:22:26Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Geo-Blocking-IKE-Implied-Rules/m-p/151908#M25029 <P>This has just been discussed <A href="https://community.checkpoint.com/t5/Remote-Access-VPN/can-we-block-non-Hong-Kong-IP-to-connection-using-Endpoint/m-p/151889" target="_self">here</A>. You can disable the implied rule within Global Properties and explicity define it on top of your rulebase in order to be able to specify geo locations for IKE.</P> Tue, 28 Jun 2022 08:55:49 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Geo-Blocking-IKE-Implied-Rules/m-p/151908#M25029 Danny 2022-06-28T08:55:49Z