topic I had forgotten it too Dennis in Network Security

ASA Firepower - Testing GeoIP result

Ella Bella — Tue, 12 Mar 2019 08:51:45 GMT

Is there a way to see what country the firepower system thinks an IP is from?

I get that I can create a rule and test whether the packet is allowed or denied - but I'd like more feedback from firepower regarding what country it believes the IP is from.

Thanks!

Unfortunately there is not at

Dennis Perto — Mon, 20 Feb 2017 07:12:39 GMT

Unfortunately there is not at the moment. In Firepower 6.2 we are able to lookup the URL category, but I have not seen anything about geolocation lookups yet. I hope for being able to do this in the future. 🙂

Realy?

Boris Uskov — Mon, 20 Feb 2017 10:09:41 GMT

Realy?

It may be, that I misundestand the question... but, for example, in Analysis -> Contex Explorer I can see Geolocation information for connections. The same for Analysis -> Connection Events. Please, see the attaches.

Also, we need to update periodically geolocation base on FMC in System -> Updates -> Geolocation Updates.

I might have misunderstood

Dennis Perto — Mon, 20 Feb 2017 10:14:38 GMT

I might have misunderstood the question as well.

What I mean is that it is not possible to test the geolocation before actually creating a rule to either allow or block.

But it is definitely possible to see the history of connection events, and where the geolocation resolved it to be.

Got it, thanks for update.

Boris Uskov — Mon, 20 Feb 2017 10:39:10 GMT

Got it, thanks for update. You meant somethink like Bulk URL lookup feature, but for geolocation.

That was my thought. But now

Dennis Perto — Mon, 20 Feb 2017 10:41:10 GMT

That was my thought. But now I am not certain that I understand the question from the thread starter.

Please see this post

Ravi Singh — Mon, 20 Feb 2017 18:56:03 GMT

Please see this post

https://supportforums.cisco.com/discussion/12716991/can-i-do-geo-ip-filtering-my-asa-5520

Yes. The idea is to evaluate

Ella Bella — Wed, 22 Feb 2017 16:03:13 GMT

Yes. The idea is to evaluate IPs prior to rule creation and without logged traffic.

Mostly this is to evaluate IP blocks which have been assigned to the customer prior to implementing, especially where existing geographic based rules already exist.

Cisco added this feature in

Marvin Rhoads — Thu, 23 Feb 2017 16:50:05 GMT

Cisco added this feature in FMC 6.1:

Analysis > Lookup > Geolocation

You can enter up to 250 IP addresses and get back the Country, Country Code and Continent.

Oh my. You are right.

Dennis Perto — Thu, 23 Feb 2017 16:54:30 GMT

Oh my. You are right.

Why did I not see that!

http://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/using_lookups.html#id_15479

I had forgotten it too Dennis

Marvin Rhoads — Thu, 23 Feb 2017 17:37:09 GMT

I had forgotten it too Dennis.

Earlier I was re-reading a presentation (BRKSEC-2050 from Cisco Live US 2016), saw the feature mentioned and was reminded of this thread.