Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 40 replies
  • Answers 1 answer
  • Subscribers 46 subscribers
  • Views 15839 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

GeoIP

Peter-Paul Gras

Is anybody having success in using the GeoIP functionality? I am not and i find it quite frustrating.

What have i done:
1. created a country group within that group f.i. Romania:

2. created a Drop rule based on the country group:

3. Have been checking logs for a couple of weeks, today i saw that there wher entries in the log showing me that traffic was allowed originating from a Romanian IP:

And this is only one example, my log is filled with more similar ones.
Any thoughts on this? Is my thinking wrong, was my execution poor or are my expectations not right?

Grtz, Peter-Paul



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Oo-T

    Hi,

    I applied that rule to my v18 XG and ended up with 3 NAT rules of which I deleted 2 because they were not showing any use. 

    I knew my XG was being attacked, but just didn't realise how much over 7000 in 6 hours, from the same IP address in Russia using the same source port.

    Ian

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Oo-T

    I have the same problem. Is it like this (link)

    Rule name

    Enter a name

    Original source

    Any

    Original destination

    The WAN interface of your XG Firewall

    Original service

    Select a service

    Translated source (SNAT)

    Original

    Translated destination (DNAT)

    A dummy IP address (a host that does not exist)

    Translated service (PAT)

    Original

    Inbound interface

    Any

    Outbound interface

    Any
  • FormerMember
    0 FormerMember in reply to Rijsbol

    Hi  

    Could you please provide the screenshot of your country blocking rule and let me know what service/port you still see traffic from the blocked countries? 

    Thanks,

  • 0 in reply to FormerMember

    As requested:

    NAT Rule

    In the Source: BLOCK the country group with Ukraine included.

  • FormerMember
    0 FormerMember in reply to Rijsbol

    Hi  

    Thank you for providing screenshots of your firewall rules. 

    Please change the destination to some other IP address that is not configured in your internal network. The IP address 1.2.3.4 is a magic IP address that is used for Sophos AP registration on the firewall. Also, consider creating a matched drop/reject firewall rule.

    Thanks,

Unfiltered HTML