can we block non-Hong Kong IP to connection using Endpoint Security VPN?

[JJ]

can we block non-Hong Kong IP to connection using Endpoint Security VPN?

i know that would be controlled by implied rules but i have tested disable in the global policy, which is no help. those traffic still can be access the gateway 

but according to sk43401 that state that "enabling certain features (e.g., Clientless VPN) will enable certain Implied Rules that cannot be disabled in SmartConsole / SmartDashboard."

do anyone know a method to solve it ?

So many thanks 

Regards,

JJ  

[Tal_Paz-Fridman]

What about using Access Control Policy with Updatable Object (Negate Hong Kong):

[Danny]

To disable specific geo locations before explicit and implied rules you would have to use SAM rules and catch the specific Geo location data from Check Point's IP2Country.csv file. So you'll have to create a little Bash script to catch the location file, grep the IP adresses from Hong Kong and block Endpoint Security VPN connections for all others.

[JJ]

Hi Danny,

Thanks for your suggestion seems will be work, but using Bash script to catch the location file is too difficult to me to setup.

Anyway thanks for your reply.

Regards,

JJ

[JJ]

because of the implied rule will accepted the connection before the policy.

[Tal_Paz-Fridman]

What about changing the order of the Implied Rules in Global Properties?

[JJ]

actually the global properties is in grey on the accept remote access control connections, and after disable the connection still accepted by the implied rule.

so that no help.

[JJ]

Hi All,

i had disable the implied rule as below 

 and setup the access policy as below, all problem is solved. 

 so many thanks with all you guy.