topic Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted in Network Security

Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Mon, 13 Jul 2020 07:44:31 GMT

Hello,

Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted. As some of the community discussion i have seen & check the ip prefix in http://www.find-ip-address.org/ip-country/ . but initiator blocked ip is not in the country list. How can i get the database updated? Whom i should contact? Can anyone help me regarding this issue?

Thank you.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marius Gunnerud — Mon, 13 Jul 2020 21:20:07 GMT

Well, each country is assigned blocks of IP subnets so if the IP that you are given is not part of the IP block assigned to your country I would start by finding out which country it is actually assigned to. If the IP is part of your country and not recognized in your filter, you may need to update your GeoLocation database.

Is this a dynamic IP or a static IP that you have been assigned? If it is a dynamic IP, and you find it is not part of your country's IP block, I would suggest contacting your ISP and inquire why that IP is not part of the country IP block.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Tue, 14 Jul 2020 03:10:39 GMT

The IP is assigned for country "NP" by APNIC. All the online databases shows as Country "NP" no doubt but http://www.find-ip-address.org/ip-country/ does not show my ip range while searching for country "NP". The geo_location is updated. /23 ip is being blocked including Dynamic & Static. So, I wanna know which database does Cisco use to verify the country. If not updated on database used by Cisco, i can ask them to update the databases.

Thank You,

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marvin Rhoads — Tue, 14 Jul 2020 04:22:12 GMT

Are you sure it is being blocked due to Geoblocking and not some other policy element?

Can you share a screenshot of your policy and a connection event showing the block?

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Tue, 14 Jul 2020 04:57:32 GMT

Yes this is the screenshot.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marvin Rhoads — Tue, 14 Jul 2020 05:44:18 GMT

I don't see the associated policy or indication of block event in that screenshot.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Tue, 14 Jul 2020 06:04:26 GMT

The Hosting company are using this firewall and they had send me the same screenshot, the service being hosted in their company is not accessible through my ip address. They told me they are using firewall policy that the ip within the country Nepal is accepted and remaining will be blocked. Except my /23 ip all the ip from Nepal can access their service.
Again i asked them for a screenshot and they send me the same screenshot. Should i ask them for the screenshot of policy they are using or the reason of blocking the ip ?

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Tue, 14 Jul 2020 06:39:38 GMT

This is the policy they are using.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marvin Rhoads — Tue, 14 Jul 2020 10:23:19 GMT

If you send me a PM of your public IP address I will check it in my Firepower to see if it also reports the wrong country.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marius Gunnerud — Tue, 14 Jul 2020 19:10:56 GMT

I suspect that your IPs are being blocked by the Asia geolocation they have in their deny rule. Could you get your ISP to confirm this via screenshot of their logs? You can also ask them to add your /23 subnet with the permit rule for Nepal. That way you will be up and running and can have some breathing room while figuring out why your subnet is not included in the Nepal geolocation rule.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marvin Rhoads — Wed, 15 Jul 2020 06:25:30 GMT

@mesarojkhadka84 shared his IP address privately. Both a current FMC Geolocation lookup and whois.apnic.net report his address as being in Nepal.

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

mesarojkhadka84 — Wed, 15 Jul 2020 06:39:00 GMT

Yes the ip details are correct, Now what should i do further? Should i contact the hosting company who is using the firewall or what is the solution now?

Re: Cisco ASA 5515-X blocks ip address even the ip address is within the same country i accpeted

Marius Gunnerud — Thu, 16 Jul 2020 10:32:19 GMT

If you do not have direct access to the firewall to provide us with further information, you need to contact the firewall hosting company and ask them to troubleshoot this issue.