The src_country and dst_country fields

[okatsladz454]

Good afternoon.

In the Threat Prevention logs fields of the demo stand (the one that can be opened when opening Smartconsole) I see two specific fields:

1. Source Country
2. Destination Country

Which display the source/destination country of the IP address, respectively. (screenshoot demo.png)

However, I do not see these fields on my stand, there is no display in the traffic section. (screenshoot mine.png)

Please tell me how to enable the display of data from two fields in smartlog and is it possible to export this through cp log exporter on log collector?

[Duane_Toler]

Make sure the ip2country download and mapping is taking place correctly. 

https://support.checkpoint.com/results/sk/sk120261

https://support.checkpoint.com/results/sk/sk79360

https://support.checkpoint.com/results/sk/sk94364

Be sure to verify your software subscription and license contracts are in order so that the automatic download can take place correctly.

[okatsladz454]

Good weekend, thanks for your help. 

Don t see this file on GW at all, should i add it or check the SMS too?

[Duane_Toler · Accepted solution]

The IP2Country mapping happens on the gateway.  The association between countries and flags happens on the management.

Check SK92823 to update the GeoIP info manually.  Be sure to install policy afterwards... just in case.If this doesn't help, then a call to TAC may be your next best thing.  There are a few odd complexities that can be involved, including the AutoUpdater service not functioning correctly. Although, it could be as simple as a policy error, too.

I can't remember for certain if you'll need to have the Geo Protection policy enabled, but I'm mostly certain you do.  I have one enabled on all of my customers, and theirs works; but causation != causality, tho.

[okatsladz454]

Good morning. 

It had no effect on logs, still i don t see source and destination country fields: 

version 81.20 last take

[okatsladz454]

IT probably help me 

I see the fiels at my syslogserver 

Thank you very much! 

[the_rock]

Good job!

[Duane_Toler]

Excellent!  Just to be certain, did you enable to Geo Protection policy as well?  Or just update ip2country info from the SK article?

[the_rock]

Agree with @Duane_Toler 

[the_rock]

Are you able to search by say basic filter src_country:CN for China, as an example.

Andy

[okatsladz454]

Good evening.

Nope. Tried to use the:

1) src_country:CN 

2)src_country:China

3)src_country:china

4) src_country:People's Republic of China

and other options 

but still nothing 

[the_rock]

Does it work for any other country?

Andy

[okatsladz454]

Good morning. 

No, it doesn t work for other country: