Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
the_rock
Legend
Legend

Geo policy question

Hello everyone,

 

I have simple question about geo policy. Is it normal that if you block certain country via updatable object in policy that when you search logs for that country, you see random logs showing accepts on http and https on implied rule?

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

Two possible things at play: implied rules (“first” ones) are enforced before any rule in the rulebase, and the management uses a different database of countries than your gateways do (or more precisely, it’s not automatically updated like gateways are).
You can update the management geo database with: https://community.checkpoint.com/t5/API-CLI-Discussion/One-liner-to-update-IpToCountry-data-on-Secur...

the_rock
Legend
Legend

Thanks! May need to open tac case, as its cloud mgmt, so no ssh

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events