topic Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN? in SASE and Remote Access

can we block non-Hong Kong IP to connection using Endpoint Security VPN?

JJ — Tue, 28 Jun 2022 05:17:50 GMT

can we block non-Hong Kong IP to connection using Endpoint Security VPN?

i know that would be controlled by implied rules but i have tested disable in the global policy, which is no help. those traffic still can be access the gateway

but according to sk43401 that state that "enabling certain features (e.g., Clientless VPN) will enable certain Implied Rules that cannot be disabled in SmartConsole / SmartDashboard."

do anyone know a method to solve it ?

So many thanks

Regards,

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

Tal_Paz-Fridman — Tue, 28 Jun 2022 06:49:09 GMT

What about using Access Control Policy with Updatable Object (Negate Hong Kong):

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

Danny — Tue, 28 Jun 2022 06:56:12 GMT

To disable specific geo locations before explicit and implied rules you would have to use SAM rules and catch the specific Geo location data from Check Point's IP2Country.csv file. So you'll have to create a little Bash script to catch the location file, grep the IP adresses from Hong Kong and block Endpoint Security VPN connections for all others.

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

JJ — Tue, 28 Jun 2022 07:09:07 GMT

because of the implied rule will accepted the connection before the policy.

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

Tal_Paz-Fridman — Tue, 28 Jun 2022 07:19:10 GMT

What about changing the order of the Implied Rules in Global Properties?

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

JJ — Tue, 28 Jun 2022 07:37:56 GMT

actually the global properties is in grey on the accept remote access control connections, and after disable the connection still accepted by the implied rule.

so that no help.

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

JJ — Tue, 28 Jun 2022 07:39:37 GMT

Hi Danny,

Thanks for your suggestion seems will be work, but using Bash script to catch the location file is too difficult to me to setup.

Anyway thanks for your reply.

Regards,

Re: can we block non-Hong Kong IP to connection using Endpoint Security VPN?

JJ — Tue, 28 Jun 2022 08:38:49 GMT

Hi All,

i had disable the implied rule as below

and setup the access policy as below, all problem is solved.

so many thanks with all you guy.