topic Re: GEO policy don't work in Firewall and Security Management

GEO policy don't work

Ned_Stark — Sun, 03 May 2020 17:23:13 GMT

Hello Team,

I have configured a GEO policy to block traffic to and from Russia, but I still see traffic to and from Russia in my logs after applying the rule. Do I need to configure something else? This is my first time configuration GEO policy.

My smartconsole is 80.10 & my firewalls are R77.30.

I have seen some post about GEO policy but I 'm a little confuse about that cause some people talk about update the file ipcountry.csv. but really I don't know what happen in my case.

Always thanks for any help.

good day !!

Re: GEO policy don't work

Timothy_Hall — Mon, 04 May 2020 11:59:11 GMT

Under Geo Policy go to "Gateways" and make sure the default Geo Policy Profile set for your specific gateway is "Geo_settings_upgraded_from_Default_Protection" and not some other profile. Because your gateway is R77.30, IPS must be licensed and enabled on your gateway for Geo Policy to work. Requiring IPS for use of Geo Policy is not needed with a R80.10+ gateway.

Re: GEO policy don't work

Ned_Stark — Mon, 04 May 2020 14:48:50 GMT

Thanks for reply. Yes, we have applied the right profile to the gateways and IPS license is activated to the gateways. however, we look at the same behavior at the other console R80.20 & gateways R80.10. Attached images.

Re: GEO policy don't work

Timothy_Hall — Mon, 04 May 2020 18:48:00 GMT

That IP address is properly classified as Russia on my R80.40 lab system according to the steps here: sk94364: How to determine which country an IP address is associated with for Geo Protections and RIPE.net/Maxmind agrees.

So first make sure your IpToCountry.csv file is updated: sk108425: IPS Geo Protection does not perform daily update

Also do you have any IPS Core Protections Exceptions defined? They also apply to Geo Policy enforcement:

sk164916: Geo Protection does not block countries

Re: GEO policy don't work

Ned_Stark — Mon, 04 May 2020 21:18:30 GMT

Ok, last date my file IPcountry is 2017. I going to check the IPS exceptions. Thanks for help. Appreciatte it.

Re: GEO policy don't work

Timothy_Hall — Mon, 04 May 2020 22:49:35 GMT

It is not the Threat Prevention Exceptions you need to check, it is the IPS Core Protection Exceptions which are accessed by editing any one of the special 39 IPS "Core" Protections such as Sweep Scan.

Re: GEO policy don't work

Ned_Stark — Tue, 05 May 2020 14:26:01 GMT

ok ok I get it now. Thank you. I will be check that.

Re: GEO policy don't work

Cyber_Serge — Tue, 05 May 2020 17:23:44 GMT

have you try Geo Updatable object?

Re: GEO policy don't work

Timothy_Hall — Tue, 05 May 2020 19:39:32 GMT

Geo Updatable Objects are not supported in R80.10 or earlier.

Re: GEO policy don't work

Ned_Stark — Wed, 06 May 2020 00:50:34 GMT

don't work is this version R77.30. Thanks.

Re: GEO policy don't work

Ned_Stark — Wed, 06 May 2020 00:51:34 GMT

Yes you right. I tried it on other console R80.20 & gtws R80.10 & don't work that.