Country blocking broken?

Oxident,

I think that ICMP is enabled on WAN under Device Access. Can you create an ACL blocking icmp using Country blocking and chec if it works?

To block HTTP requests, you need to create a Business Application Rule and use "block from" field but as you can see, Country Lists or Groups cannot be used.

[:|]

Have you found any more information on this?  I'm starting to think this is not working as well.  Looking through some of the reports, I see a ton of "Source" traffic from countries I have blocked in the same exact rule as you have Oxident.  This is a little concerning.  Here is the rule I have at the very top of the list.

Thanks

Hmm, what Luk said sounds well but ICMP packets from those blocked countries still arrive. I share DMR188's opinion that his rule should do the trick but I couldn't verifiy this for now, at least not with any online tool I've found on the web :-(

It's not working for me either.  It never has and this is first on the list.  Any suggestions?  HTTP traffic still reaches my dmz/lan from these countries.

HI There,

You're creating the rule in the wrong spot this is a device access rule. You'll need to create a device access ACL under System >Administration >Device Access It'll need to look similar to below. I tried that and it worked for me.

The test at website pulse does not appear to be accurate. I just use a ping test on both UTM and XG that had ICMP disable and website pulse reported a response when from any other device I was getting no response back. I then ran the test using CA's tool https:/asm.ca.com/en/ping.php and got the accurate/desired outcome.

Does this also apply to TCP/UDP traffic?

I am trying to block all TCP/IP traffic from these locations.

This seems to only apply to services hosted on those NICs for XG Firewall.

Country blocking can be applied to both Network and Device Access policies. If it's a Network/User Policy you can apply country blocking to any port or protocol.

Country blocking does not work when applied to network policies.  See my screenshot above.  It has never worked and I have tried every combination of source and destination.

Thanks. This works for me ... although I was really expecting in the "policy" area!

Does anyone have any luck with country blocking and network policies?