ERROR: Wrong Geo Location for Russia - Customers are reporting issues

[Danny]

The last Geo Location update on Quantum Security Gateways appears to have an error.

[Expert@fw:0]# ls -la $CPDIR/database/downloads/ONLINE_SERVICES/1.0/150622030521/geo_location.C
Jun 14 17:02 /opt/CPshrd-R81/database/downloads/ONLINE_SERVICES/1.0/150622030521/geo_location.C

A newer update for updatable objects (sk121877) is currently not available.

Multiple customers report that regional IP addresses are blocked as they are wrongly located in Russia.
MaxMind correcty shows them as regional IP addresses in Germany but Check Point Quantum Security Gateways do not.

Example: 92.217.8.19

MaxMind shows: Munich, Germany

Check Point shows the IP within a big block for Russia within geo_location.C:

    :CP_GEO_RU (
                :parent ()
                :uuid ("909383a0-c34b-49ef-b423-c0168a37c37d")
                :display_name ("Russia")
                :icon ("@app/cp_geo_ru")
                :IPV4 (
                        : (
                                :from ("91.228.62.0")
                                :to ("92.228.64.255")
                                :type (ip_range)
                        )

[Expert@fw:0]# dynamic_objects -lo CP_GEO_RU | grep 92.228.
range : 91.228.62.0  -  92.228.64.255

[AaronCP]

Hey @Danny,

We're having the exact same issue. Our gateway last updated the iptocountry.csv file at 10pm UK time last night. It seems that the URL referenced in SK120261 is no longer available (https://sc1.checkpoint.com/freud2/IpToCountry.csv.gz). I wonder if Check Point have pulled the file?

Do you know if it's possible to revert to a previous version of this file on the gateway? Our support provider have a ticket raised with TAC, but have said they're starting to get a lot of other customers reporting this issue.

Thanks,

Aaron.

[Danny]

It should be possible to revert to a previous revision by extracting it from a backup.

Example: tar -tzvf /var/log/CPbackup/backups/backup_filename.tgz | grep geo_location.C

Simply copy and paste the revision folder to $CPDIR/database/downloads/ONLINE_SERVICES/1.0/ and adjust $CPDIR/database/downloads/ONLINE_SERVICES/1.0/last_revision.xml to point to that revision.

Alternatively you can temp. unblock Russia in your security policy or configure Allow rules for the affected network ranges.

[_Val_]

@Danny please raise a TAC case for this, thanks

[Danny]

🙂 This is the first thing we did.

[_Val_]

Thank you

[Customer_ckp]

Put that subject on top. This affect several clients in France too. TAC cases opened too.

[G_W_Albrecht]

MaxMind updates it daily, CP weekly only - so false positives happen every couple of weeks, i had three such cases with CP in the last 2 month...

But i am very suspicious concerning GeoIP.

[Eitan_Gilad-Lug · Accepted solution]

Hello CheckMates,

We are working on a solution for this issue, and aiming for releasing it today. sorry for the inconvenience.

thanks

Eitan

[Juan_]

Customers from UK reporting it as well.

Geo-Policy affected too. I suppose it feeds from the same as updateable objects.

[ids · Accepted solution]

I would like to share an update on the ongoing Geo enforcement issue

 For any customers who are using IPS Geo Protection, and not Geo Updateable Objects (R80.30 and above)

 Customers that applied the manual workaround, should revert the change to get the new update.

 Please follow the steps below to manually deploy the change on demand, if waiting for the auto-update cycle is not an option

• Updatable Objects - a new release will be sent out at 1900 IL time today, while FWs update frequency is every 2 hours. that means without any manual intervention, all FWs should get the new update by 2100 IL time.
1. To enforce an update on demand  for Updatable; objects:

Per sk131852 > Troubleshooting: Run on your Gateway machine:

 # unified_dl UPDATE ONLINE_SERVICES

• IPS Geo Protection ( IP2country)- fixed release was uploaded and the FWs should get this on their next update that happens every 24 hours, without any manual intervention. (maximum by tomorrow 1600 IL time)
1. Check Point recommendation is to use only Updatable Objects from FW R80.20 upwards instead of IPS Geo.
2. To enforce an update on demand  for IPS Geo Policy:
1. Download the latest IpToCountry.csv file from this URL:
1. http://downloads.checkpoint.com/fileserver/ID/11901/FILE/IpToCountry.csv.gz
2. Transfer the IpToCountry.csv.gz file to the Security Gateway / each Cluster Member to some directory.
3. Connect to the command line on the Security Gateway / each Cluster Member.
4. Log in to the Expert mode.
5. Go to the directory with the IpToCountry.csv.gz file.
6. Unpack the IpToCountry.csv.gz file:
   $CPDIR/util/gzip -df IpToCountry.csv.gz
7. Copy the file IpToCountry.csv to $FWDIR/tmp/geo_location_tmp/updates/ directory:
   cp -v IpToCountry.csv $FWDIR/tmp/geo_location_tmp/updates/
8. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster object.

 Thank you for your understanding and cooperation, we appreciate the patience

[Danny]

Thanks Mate!

[skandshus]

Yep im seeing the same issue today 

[skandshus]

Today I’m seeing danish ip addresses from Telia showing us as Swedish ip adresses.. even ripe has them

shown as danish 

[_Val_]

Please report via TAC case