topic Geo object does not work correctly in Firewall and Security Management

Geo object does not work correctly

Hllrdm — Wed, 03 Aug 2022 09:00:58 GMT

We encountered a problem that some IP addresses do not pass the rules with Geo object country as source, so the traffic is blocked on Cleanup rule.
We can see that some addresses from Geo object country are not found when dynamic_objects -uo_show command is output, but they are related to the addresses of the country of interest and the country flag is displayed in Logs (screen 2)

Part of the addresses are in the output of the command (for these addresses also works cleanup, although they are in the output of the command dynamic_objects -uo_show) (screen1)

How can this problem be solved? Maybe there is a command that allows you to update the geo object country?

R80.40 Last JHF

Re: Geo object does not work correctly

_Val_ — Wed, 03 Aug 2022 11:05:59 GMT

May I ask which countries you are trying to filter here? Two examples are belonging to different countries, is this how you want to use them?

Re: Geo object does not work correctly

Hllrdm — Wed, 03 Aug 2022 11:24:18 GMT

The addresses refer to Russia. Both appear in the SmartConsole with the Russia flag.

Re: Geo object does not work correctly

_Val_ — Wed, 03 Aug 2022 11:29:49 GMT

Not really, at least some of the IPs in the second example belong to a French ISP. I am talking about 45.15.221.0/24.

You can check them here: https://www.maxmind.com/en/geoip-demo

Please look into sk126172, and if you do not see any issues with your config after reviewing that SK, open a TAC case to investigate further.

Re: Geo object does not work correctly

the_rock — Wed, 03 Aug 2022 16:18:31 GMT

@_Val_ is correct, if you check few of those 45.15.x.x subnets, they all belong to locations in France. I actually used 5 different sites and they all gave same results. I know CP escalation team told me they officially use maxmind, but if other sites show the same, then its safe to conclude 100% its valid info.