Drop, updateable objects

[Moudar]

Hi

I wonder why some traffic from China can cross my rules even if a rule that would drop the traffic is there!

The goal of the 8th rule is to drop any traffic from these countries

but looking at the logs:

What do I miss here?

[the_rock]

That is a bit odd. When did you notice this happen first? Rule order is 100% correct, so as long as Geo block rule comes first, no reason why it would not work.

Andy

[the_rock]

Ok, now I know 100% why it works...look at below. Based on maxmind site, (which is what CP uses officially for geo location), that IP shows as belonging to Singapore, NOT China and thats why its allowed. Also, all the other IPs from same range belong to exact same ISP provider.

I would open TAC case and ask them to sort this out.

Andy

 

[Moudar]

You are right, I will keep an eye on this and see if more flag errors are there

[the_rock]

I think what @Timothy_Hall posted is perfect, maybe you should folllow that and see if it works for you.

Andy

[Timothy_Hall]

The gateways and the SMS have their own separate update mechanisms for the MaxMind geo database, and when they get out of sync with each other things like this can happen.  This situation was covered in my updated R81.20 IPS/AV/ABOT Immersion Course: