topic Re: Odd Thing After R82 Upgrade in General Topics

Odd Thing After R82 Upgrade

Wayne_Hammond — Mon, 02 Jun 2025 21:18:40 GMT

Hi,

This evening I upgraded one of our FW's to R82 from R81.20

All went well, but then I noticed it was getting an odd message about couldn't contact Checkpoint and could not then find updates.

After various head scratching I looked in the logs and for some reason the Geo Policy now thinks my IP address is registered in BGR which is on our risk database, so blocked.

Long story short I have had to add an exception in the policy, but what on earth would cause this, and is there a reasonable fix or do i just leave me exception in place?

Thanks

Wayne - confused 🙂

Re: Odd Thing After R82 Upgrade

the_rock — Mon, 02 Jun 2025 22:41:04 GMT

Hey Wayne,

I hate assuming things, but let me take a wild guess...did you by any chance have old legacy geo policy in place? If so, this behavior would not surprise me. Since R80.20, updatable objects are recommended to use for geo blocking.

Andy

Re: Odd Thing After R82 Upgrade

Wayne_Hammond — Tue, 03 Jun 2025 06:01:24 GMT

Hi Andy,

Yes I use the old Geo policy, I checked my IP on MaxMind and that says UK based.

Still a bit confused?

Cheers

Wayne

Re: Odd Thing After R82 Upgrade

Tal_Paz-Fridman — Tue, 03 Jun 2025 06:22:19 GMT

Please refer to https://support.checkpoint.com/results/sk/sk126172 and use Updatable Objects instead of the Geo Policy.

Re: Odd Thing After R82 Upgrade

Wayne_Hammond — Tue, 03 Jun 2025 06:39:43 GMT

Hi Tal,

I will try converting to UO and see what happens

Cheers

Wayne

Re: Odd Thing After R82 Upgrade

Wayne_Hammond — Tue, 03 Jun 2025 07:52:31 GMT

Quick question, if I do use UO for Geo policy, what is the best way to have exceptions?

Re: Odd Thing After R82 Upgrade

the_rock — Tue, 03 Jun 2025 10:37:29 GMT

I get it, but I had seen it happen many times before with old geo policy, specially in new versions. As @Tal_Paz-Fridman suggested, that sk is best to follow.

Andy

Re: Odd Thing After R82 Upgrade

the_rock — Tue, 03 Jun 2025 10:39:09 GMT

Here is what I always do with all customers.

Create whatever country exceptions you need on the top of the rulebase, then just below that, add all other countries as source (group them so it looks nicer), then dst as any, service any, action block, install policy, thats it. And you can also delete old legacy geo policy.

Andy

Re: Odd Thing After R82 Upgrade

Wayne_Hammond — Tue, 03 Jun 2025 11:02:36 GMT

Thanks to both of you !!

Re: Odd Thing After R82 Upgrade

the_rock — Tue, 03 Jun 2025 11:08:01 GMT

Glad we can help mate. I attached a screenshot from my lab. I did not even add any exceptions, as in my group, I did NOT add Canada and USA, everything else is there (just as an example)

Andy

Re: Odd Thing After R82 Upgrade

the_rock — Tue, 03 Jun 2025 11:24:42 GMT

Forgot to add something else, though this obviously will not apply to everyone out there, but I want to mention it to you Wayne. While back, I was working with a hospital and we determined they were having bunch of issues due to geo policy, until we addeed Israel and Japan as exceptions. Mind you, that should be easy to tell from the logs if you ever encounter such an issue.

Best,

Andy