topic Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues in Firewall and Security Management

ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Danny — Wed, 15 Jun 2022 11:19:27 GMT

The last Geo Location update on Quantum Security Gateways appears to have an error.

[Expert@fw:0]# ls -la $CPDIR/database/downloads/ONLINE_SERVICES/1.0/150622030521/geo_location.C Jun 14 17:02 /opt/CPshrd-R81/database/downloads/ONLINE_SERVICES/1.0/150622030521/geo_location.C

A newer update for updatable objects (sk121877) is currently not available.

Multiple customers report that regional IP addresses are blocked as they are wrongly located in Russia.
MaxMind correcty shows them as regional IP addresses in Germany but Check Point Quantum Security Gateways do not.

Example: 92.217.8.19

MaxMind shows: Munich, Germany

Check Point shows the IP within a big block for Russia within geo_location.C:

:CP_GEO_RU ( :parent () :uuid ("909383a0-c34b-49ef-b423-c0168a37c37d") :display_name ("Russia") :icon ("@app/cp_geo_ru") :IPV4 ( : ( :from ("91.228.62.0") :to ("92.228.64.255") :type (ip_range) )

[Expert@fw:0]# dynamic_objects -lo CP_GEO_RU | grep 92.228. range : 91.228.62.0 - 92.228.64.255

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

AaronCP — Wed, 15 Jun 2022 09:24:27 GMT

Hey @Danny,

We're having the exact same issue. Our gateway last updated the iptocountry.csv file at 10pm UK time last night. It seems that the URL referenced in SK120261 is no longer available (https://sc1.checkpoint.com/freud2/IpToCountry.csv.gz). I wonder if Check Point have pulled the file?

Do you know if it's possible to revert to a previous version of this file on the gateway? Our support provider have a ticket raised with TAC, but have said they're starting to get a lot of other customers reporting this issue.

Thanks,

Aaron.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

_Val_ — Wed, 15 Jun 2022 09:28:38 GMT

@Danny please raise a TAC case for this, thanks

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Danny — Wed, 15 Jun 2022 09:33:33 GMT

🙂 This is the first thing we did.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

_Val_ — Wed, 15 Jun 2022 09:37:49 GMT

Thank you

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Danny — Wed, 15 Jun 2022 09:58:21 GMT

It should be possible to revert to a previous revision by extracting it from a backup.

Example: tar -tzvf /var/log/CPbackup/backups/backup_filename.tgz | grep geo_location.C

Simply copy and paste the revision folder to $CPDIR/database/downloads/ONLINE_SERVICES/1.0/ and adjust $CPDIR/database/downloads/ONLINE_SERVICES/1.0/last_revision.xml to point to that revision.

Alternatively you can temp. unblock Russia in your security policy or configure Allow rules for the affected network ranges.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

G_W_Albrecht — Wed, 15 Jun 2022 10:38:47 GMT

MaxMind updates it daily, CP weekly only - so false positives happen every couple of weeks, i had three such cases with CP in the last 2 month...

But i am very suspicious concerning GeoIP.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Customer_ckp — Wed, 15 Jun 2022 10:48:15 GMT

Put that subject on top. This affect several clients in France too. TAC cases opened too.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Eitan_Gilad-Lug — Wed, 15 Jun 2022 14:01:44 GMT

Hello CheckMates,

We are working on a solution for this issue, and aiming for releasing it today. sorry for the inconvenience.

thanks

Eitan

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Juan_ — Wed, 15 Jun 2022 15:42:02 GMT

Customers from UK reporting it as well.

Geo-Policy affected too. I suppose it feeds from the same as updateable objects.

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

ids — Thu, 16 Jun 2022 06:56:37 GMT

I would like to share an update on the ongoing Geo enforcement issue

For any customers who are using IPS Geo Protection, and not Geo Updateable Objects (R80.30 and above)

Customers that applied the manual workaround, should revert the change to get the new update.

Please follow the steps below to manually deploy the change on demand, if waiting for the auto-update cycle is not an option

Updatable Objects - a new release will be sent out at 1900 IL time today, while FWs update frequency is every 2 hours. that means without any manual intervention, all FWs should get the new update by 2100 IL time.

To enforce an update on demand for Updatable; objects:

Per sk131852 > Troubleshooting: Run on your Gateway machine:

# unified_dl UPDATE ONLINE_SERVICES

IPS Geo Protection ( IP2country)- fixed release was uploaded and the FWs should get this on their next update that happens every 24 hours, without any manual intervention. (maximum by tomorrow 1600 IL time)

Check Point recommendation is to use only Updatable Objects from FW R80.20 upwards instead of IPS Geo.
To enforce an update on demand for IPS Geo Policy:

Download the latest IpToCountry.csv file from this URL:

http://downloads.checkpoint.com/fileserver/ID/11901/FILE/IpToCountry.csv.gz

Transfer the IpToCountry.csv.gz file to the Security Gateway / each Cluster Member to some directory.
Connect to the command line on the Security Gateway / each Cluster Member.
Log in to the Expert mode.
Go to the directory with the IpToCountry.csv.gz file.
Unpack the IpToCountry.csv.gz file:
$CPDIR/util/gzip -df IpToCountry.csv.gz
Copy the file IpToCountry.csv to $FWDIR/tmp/geo_location_tmp/updates/ directory:
cp -v IpToCountry.csv $FWDIR/tmp/geo_location_tmp/updates/
In SmartConsole, install the Access Control policy on the Security Gateway / Cluster object.

Thank you for your understanding and cooperation, we appreciate the patience

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

Danny — Wed, 15 Jun 2022 19:33:36 GMT

Thanks Mate!

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

skandshus — Wed, 15 Jun 2022 21:57:58 GMT

Yep im seeing the same issue today

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

skandshus — Mon, 17 Oct 2022 19:49:35 GMT

Today I’m seeing danish ip addresses from Telia showing us as Swedish ip adresses.. even ripe has them

shown as danish

Re: ERROR: Wrong Geo Location for Russia - Customers are reporting issues

_Val_ — Tue, 18 Oct 2022 07:53:19 GMT

Please report via TAC case