topic Re: GeoDB Updates file in Network Security

GeoDB Updates file

Knassi — Thu, 08 Jun 2023 20:19:34 GMT

Hi,

I downloaded the GeoDB Updates and uploaded it. I have some geolocation rules set to block traffic from certain locations. Now some IPs are being blocked by those rules but the IPs are not from the locations i am blocking. Somehow the FMC sees those IP as coming from banned locations. Anyone seen that before? I want to open the GeoDB file downloaded and see what's in there. I have not been successful so far. Any help will be appreciated. Thank you

Re: GeoDB Updates file

Marius Gunnerud — Fri, 09 Jun 2023 17:08:54 GMT

I have seen this issue a lot over the past couple years. The only work-around we have found is to white list the source and destination IPs and ports that are being blocked / add ACP rules above the GeoBlock to allow that traffic. We have had TAC on the case earlier and they cannot do anything as these IPs are automatically fetched (from Talos I believe).

We have boiled the issue down to that some of these subnets are re-allocated to different geographic locations therefore causing the issue. Not entirely sure if this is an issue with the classification or if the subnets are actually being allocated to new geographic locations.

Re: GeoDB Updates file

Knassi — Fri, 09 Jun 2023 18:11:14 GMT

I did that and things are working fine. The TAC submitted didn't yield anything good either. Thank you