topic Best practice to add Geo Policy in R80.30 VSX in Firewall and Security Management

Best practice to add Geo Policy in R80.30 VSX

Habib_Rahman_TX — Thu, 23 Dec 2021 16:54:21 GMT

We added Geo Policy using default Profile and installed Policy on VS2.

IPS blade is enabled.

However Geo Policy is not enforced.

We started debugging using following SK (sk92823) and noticed Geo process is not running.

Can you confirm if using Updatable object for Geo Policy in R80.30 only way to make Geo Policy work?

We also tried using updatable object and it dropped traffic.

We can access user center using VS0 (not from VS2, and VS2 is our FW)

We can also perform DNS Lookup from VS0

We ran unified_dl UPDATE ONLINE_SERVICES, and it shows completed successfully but last_revision.xml file has a July 2020 timestamp.

Can you share tips as how to update last_revision.xml successfully?

Re: Best practice to add Geo Policy in R80.30 VSX

_Val_ — Fri, 24 Dec 2021 08:45:22 GMT

Probably it is best to take it with TAC

Re: Best practice to add Geo Policy in R80.30 VSX

the_rock — Fri, 24 Dec 2021 16:08:57 GMT

I was under impression that geo policy would be the same regardless of platform you are running, but I could be mistaken...I know starting in R80.20, its recommended to use updatable objects in the policy, but if you are saying that process is not even running, then definitely worth considering TAC case.

Below is what TAC gave me few months back when customer had issues with geo updates and it did fix it (you do this on mgmt server, just make sure you backup thise directories first, in case or even do backup quickly)

Procedure:
1. Change the name of the folder $MDS_FWDIR/conf/SMC_Files/uo to uo_original
2. Run cpstop && cpstart on the mgmt server
3. Re-open updatable object picker
4. Make sure the $FWDIR/conf/SMC_Files/uo was created again

These steps, should enforce the management server to re-download the Updatable Object package and should solve the issue.

Re: Best practice to add Geo Policy in R80.30 VSX

Habib_Rahman_TX — Mon, 03 Jan 2022 16:25:26 GMT

Thank you. I have a case open with TAC.