Gateway version? Geo Protection was part of the IPS blade in R77.30 and earlier, but was decoupled from IPS in R80.10 gateway, became part of the Access Policy, and was renamed Geo Policy.
First off as mentioned in my book, make sure that the country database has been updated as specified here: sk92823: Geo Protection fails to update.
Geo Policy enforcement is performed very early in firewall processing, well before the rulebase is ever consulted and can save lots of overhead imposed by the "background noise" of the Internet. As mentioned by another poster above, make sure you are blocking connections both from and to the country in question.
If using R80.10, make sure that the country restriction is associated with the correct Geo Policy Profile that is applied on the gateway. Under Geo Policy select Gateways to verify which Geo Policy profile is applied to your gateway, then make sure you are editing the right one. In R77.30 the Geo Protection settings are associated with the IPS profile assigned to the gateway.
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com