GEOIP Block / Allow With Updateable Objects - How to allow and continue to main rule base like befor

[Seth_Scavette]

With the old GEOIP policy you could allow and block countries easily and then there was a box at the bottom that said "policy for other countries" which could be set to allow or block. Given that ability I am trying to figure out how to replicate that with the newer preferred method using updateable objects. Blocking is easy, setting up a whitelist of countries seems much more involved.

So currently I have main rules setup at the top of the policy to block countries I have selected. I then use inline layered rules to create exceptions where needed with a "drop" clean up rule at the bottom of the inline policy. Blocking is easy!

This is what I want to do now:

--- Create a rule to allow specific countries with updateable objects but still go on to match the main rule base below like the old GEOIP policy would do. The only way I can figure would be to create inline rules with all my existing rules which seems wrong. 

 I searched but I have not found any good solutions. 

[PhoneBoy]

Put the geo rules in a separate ordered layer.
Provided that layer only contains geo rules and the final result is “accept” for the countries you wish to accept, it should work the way you wish.

[the_rock]

I see what @PhoneBoy is saying, makes total sense. I will tell you what I always advise people and works 100% fine. So, say if you have, just as an example, 2 ordered layers, 1 network (with fw blade only enabled) and 2nd as appc+urlf enabled in layer editor, in network layer, you can have multiple inline layers tied to different zones representing different interfaces and then first few rules on the top can include geo block rules. IF you need to allow someone from foreign country to conenct, you can simple have such rule ABOVE geo block rules, thats it.

I attached basic example from one of my R81.20 labs. Also, super IMPORTANT, if you have multiple ordered layers, traffic HAS TO be accepted on all layers, otherwise, nothing will work.

Best,

Andy