topic Re: Geo policy question in General Topics

Geo policy question

the_rock — Sun, 23 May 2021 11:52:20 GMT

Hello everyone,

I have simple question about geo policy. Is it normal that if you block certain country via updatable object in policy that when you search logs for that country, you see random logs showing accepts on http and https on implied rule?

Re: Geo policy question

PhoneBoy — Sun, 23 May 2021 16:02:51 GMT

Two possible things at play: implied rules (“first” ones) are enforced before any rule in the rulebase, and the management uses a different database of countries than your gateways do (or more precisely, it’s not automatically updated like gateways are).
You can update the management geo database with: https://community.checkpoint.com/t5/API-CLI-Discussion/One-liner-to-update-IpToCountry-data-on-Security-Managements/m-p/97922

Re: Geo policy question

the_rock — Sun, 23 May 2021 16:07:09 GMT

Thanks! May need to open tac case, as its cloud mgmt, so no ssh