Geo policy question

[the_rock]

Hello everyone,

I have simple question about geo policy. Is it normal that if you block certain country via updatable object in policy that when you search logs for that country, you see random logs showing accepts on http and https on implied rule?

[PhoneBoy]

Two possible things at play: implied rules (“first” ones) are enforced before any rule in the rulebase, and the management uses a different database of countries than your gateways do (or more precisely, it’s not automatically updated like gateways are).
You can update the management geo database with: https://community.checkpoint.com/t5/API-CLI-Discussion/One-liner-to-update-IpToCountry-data-on-Secur...

[the_rock]

Thanks! May need to open tac case, as its cloud mgmt, so no ssh