topic Re: Geoip Protection outubound Enforcement in Firewall and Security Management

Geoip Protection outubound Enforcement

lluner — Thu, 02 Jan 2025 19:44:55 GMT

Could someone explain why this is happening

Re: Geoip Protection outubound Enforcement

the_rock — Thu, 02 Jan 2025 20:52:46 GMT

Appears its related to default geo policy. You definitely should be using updatable objects for geo policy starting R80.20 version. I would examine current policy and see how Brazil is configured.

Andy

Re: Geoip Protection outubound Enforcement

Lesley — Thu, 02 Jan 2025 21:15:48 GMT

I assume you wonder why it is blocked? Maybe this SK helps https://support.checkpoint.com/results/sk/sk126172

Or something else is wrong?

Re: Geoip Protection outubound Enforcement

lluner — Fri, 03 Jan 2025 11:37:01 GMT

@the_rock

When I do the application with the updated objects it gives the same error shown above, I believe it is something in the base of the checkpoint that inserted this ips incorrectly

Re: Geoip Protection outubound Enforcement

the_rock — Fri, 03 Jan 2025 13:29:58 GMT

So if you try using geo updata ble objects and I assume you disabled legacy geo policy, you get same error?

Andy

Re: Geoip Protection outubound Enforcement

lluner — Fri, 03 Jan 2025 19:31:56 GMT

hi @the_rock

I didn't disable the default policy of GEO, I created a rule on the layer network with the update objets. Even so, the error happened, the access to the Brazilian continent was blocked

Re: Geoip Protection outubound Enforcement

the_rock — Fri, 03 Jan 2025 19:34:01 GMT

Right, but whole point of using updatable objects for countries is to disable legacy geo policy.

Andy

Re: Geoip Protection outubound Enforcement

lluner — Fri, 03 Jan 2025 19:41:53 GMT

Hi @the_rock

Even applying the rule does not work with the update objects. I believe that the problem is at the base?

Re: Geoip Protection outubound Enforcement

the_rock — Fri, 03 Jan 2025 19:47:13 GMT

K, just to make sure we are on the same page here..are you trying to block/allow given country or specific IP from that country or what exactly?

Andy

Re: Geoip Protection outubound Enforcement

Timothy_Hall — Fri, 03 Jan 2025 19:52:43 GMT

The legacy Geo Policy is enforced well before Geo Updatable Objects, at roughly the same time as antispoofing enforcement. So if traffic is dropped by the legacy Geo Policy it will be dropped regardless of how your main policy layers are configured with Geo Updatable Objects. To disable the legacy Geo Policy:

1) Under Shared Policies...Geo Policy...select Policy

2) Make sure "Default Geo Policy" is selected in the dropdown at the top of the screen

3) Select Inactive or "Monitor Only", your choice

4) Using Geo Updatable objects, ban any countries you want using Geo Updatable Objects in the first layer of your policy package

5) Publish and install policy.

Re: Geoip Protection outubound Enforcement

the_rock — Fri, 03 Jan 2025 19:57:56 GMT

I guess I thought I mentioned to disable it previously, but my bad, I did not. @lluner , thats what you have to do first.

Andy