topic Re: Geo policy in Firewall & Security Management

Geo policy

Basilio_Alcant1 — Fri, 05 Jul 2019 14:33:07 GMT

Good Morning,

Is there a way to generate/extract the list of countries that we currently block under Geopolicy? we are running on R80.20.

Re: Geo policy

Danny — Fri, 05 Jul 2019 14:57:04 GMT

Do you have such a long list in your Geo Policy?

Re: Geo policy

Basilio_Alcant1 — Fri, 05 Jul 2019 15:23:51 GMT

yes we do, it s a very long list.

Re: Geo policy

Timothy_Hall — Wed, 10 Jul 2019 15:24:39 GMT

Getting this Geo Policy country list does not seem possible through the SmartConsole GUI or the API from what I can see.

However this information can be pulled out of the compiled policy out on the gateway similarly to the antispoofing configuration. The file to look at on the gateway is $FWDIR/state/local/FW1/local.set. There is a section called block_by_countries_protection in that file that shows all the countries listed under "Policy for Specific Countries". A fast way to access the list is the following command you can run on the gateway:

grep country_dispaly_name $FWDIR/state/local/FW1/local.set

(Note that I did not make a typo in the above command, it truly is country_dispaly_name in the file itself)

Obviously this one-liner does not show direction of enforcement and action (Drop/Accept) but if you know that all countries listed have an action of Drop this should be sufficient.

I sense an impending update to the ccc tool...

Re: Geo policy

HeikoAnkenbrand — Fri, 05 Jul 2019 18:10:13 GMT

Hi @Basilio_Alcant1

Use this script on management server to show countries and country IP lists.

This script lists all country entries from the file ip2country. csv and displays the countries sorted for R80.10+.
The country code can then be insert. For the selected country all IP Ranges are displayed.

So you can find all IP range, which are blocked by GeoProtection for a country.

Bash script to show IP ranges for countrys from GeoProtection
or
GEO Location Objects in Firewall Policy (with Dynamic Objects)

Regards

Heiko

Re: Geo policy

Danny — Wed, 10 Jul 2019 15:01:44 GMT

@Basilio_Alcant1 looks for a list of countries, not IP ranges.

Re: Geo policy

Danny — Wed, 10 Jul 2019 15:04:40 GMT

@Timothy_Hall senses are powerful. Solution here: One-liner to show Geo Policy on gateways

ccc script updated.