My current company recently wanted to start implementing geo based updatable object rules following SK126172 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...)
During my PTO, our security team deployed a set of rules to one one country (Russia) and it looks to be working right now.
I was checking logs and noticed that there were a few IP addresses that were being blocked but listed as another country:
Example: 85.209.0.186
1) Our gateway is blocking this thinking its in Russia
2) Our 'flag' from the smartconsole logs is showing this in "Saudi Arabia"
3) MaxMind site states this is in Country Code of "CZ" and Location of "Czechia,Europe" (Using link: https://www.maxmind.com/en/geoip-demo)
I started to think that its possible that the ip list was not being updated from the gateways and stated to look at SK114216 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...)
Based on that SK, I looked at the 'in.geod' process and the file locations mentioned and none of the GWs have I have checked have this running nor have the files in place ($FWDIR/tmp/geo_location_tmp/updates/IpToCountry.csv)
Since this was a brand new geo deployment, the shared "Geo Policy" activation mode it still set to "inactive' (First screen shot) and I can't seem to find documentation on where having the activation is required (i.e. no mention on SK126172 and can't seem to find in deployment docs).
I have checked my 80.40 lab and I do see that when I set the geo policy to "Monitor Only" and leaving the rest as default. my lab gateway shows the daemon running and the updated file list within 24 hours like SK114216 mentions.
So my long question is this:
- Is there a Geo Policy activation requirement when using geo based updatable object rules following SK126172
- I.E setting to "monitor only" and using the updatable object method only in access rules
If there is no requirement on the Geo Policy activation, how can I validate proper updates of the IP country list against the MaxMind DB since SK114216 shows no list updates?
Thank in advance.
