topic Re: Checking IP Against Geo-Protection Database in API / CLI Discussion

Checking IP Against Geo-Protection Database

Nate_Johnson — Thu, 26 Jan 2017 15:45:14 GMT

Overview

This code takes in a user input for an IPv4 address and searches for it in the Geo-Protection Database, returning the country of origin.

Description

This python script allows a user to quickly search the IpToCountry.csv file to find the country of origin for a given IPv4 address. It does all the necessary IP to decimal conversions automatically and uses that to iterate through the CSV.

For more information on how the IpToCountry.csv file works, please see SK94364

Instructions

Download the Python scripts below and place them in the same directory. (Note: Script was written in Python 2.7)

Copy the IpToCountry.csv file from a security gateway, located in the $FWDIR/tmp/geo_location_tmp/updates/ directory, to the same directory as the files above

Run Geoprotect.py

Input the IPv4 address you'd like to check

Code Version

Code version 1.0.0

Tested on version

R77.30 IpToCountry.csv file

NOTICE: By using this sample code you agree to terms and conditions in this Not authorized to view the specified document 1042

...

Re: Checking IP Against Geo-Protection Database

Marc_Lampo — Wed, 01 Feb 2017 13:49:47 GMT

The file IpToCountry.csv, even on a recent R77.30 + Jumbo take 205, reads :

# Download time: 11:15:25, Wed Aug 29, 2012

Isn't this a bit old.

Knowing that, in these years with increasing IPv4 shortage, blocks of IPv4 addresses have be sold and been transferred, sometimes to other countries.

How does one update this file ?

Kind regards,

Re: Checking IP Against Geo-Protection Database

Jeff_St_John — Fri, 31 Mar 2017 03:30:11 GMT

I assume you are not running the IPS blade. My file is updated regularly and they get the data from Maxmind.com. Maxmind updates the data regularly.

Re: Checking IP Against Geo-Protection Database

Pablo_Munoz — Wed, 04 Jul 2018 17:21:37 GMT

I just saw this thread, maybe a reply is not needed anymore, however I thought I would provide some additional information here to clarify:

sk95976 - How GEO protection country file is getting updated

sk79360 - How to check if Geo Protections have been updated

The Gateway needs internet connectivity to get the IpToCountry updates from the Check Point Cloud (Maxmind.com is correct). If there is no internet connectivity available, you can also follow:

sk84801 - Updating Geo IPs on Offline Gateways.

I hope this information helps!