topic Re: Drop, updateable objects in General Topics

Drop, updateable objects

Moudar — Thu, 13 Jul 2023 12:02:41 GMT

I wonder why some traffic from China can cross my rules even if a rule that would drop the traffic is there!

The goal of the 8th rule is to drop any traffic from these countries

but looking at the logs:

What do I miss here?

Re: Drop, updateable objects

the_rock — Thu, 13 Jul 2023 12:10:33 GMT

That is a bit odd. When did you notice this happen first? Rule order is 100% correct, so as long as Geo block rule comes first, no reason why it would not work.

Andy

Re: Drop, updateable objects

the_rock — Thu, 13 Jul 2023 12:17:43 GMT

Ok, now I know 100% why it works...look at below. Based on maxmind site, (which is what CP uses officially for geo location), that IP shows as belonging to Singapore, NOT China and thats why its allowed. Also, all the other IPs from same range belong to exact same ISP provider.

I would open TAC case and ask them to sort this out.

Andy

Re: Drop, updateable objects

Timothy_Hall — Thu, 13 Jul 2023 12:45:22 GMT

The gateways and the SMS have their own separate update mechanisms for the MaxMind geo database, and when they get out of sync with each other things like this can happen. This situation was covered in my updated R81.20 IPS/AV/ABOT Immersion Course:

Re: Drop, updateable objects

Moudar — Thu, 13 Jul 2023 12:50:25 GMT

You are right, I will keep an eye on this and see if more flag errors are there

Re: Drop, updateable objects

the_rock — Thu, 13 Jul 2023 12:53:08 GMT

I think what @Timothy_Hall posted is perfect, maybe you should folllow that and see if it works for you.

Andy