ASA Firepower - Testing GeoIP result

[Ella Bella]

Is there a way to see what country the firepower system thinks an IP is from?

I get that I can create a rule and test whether the packet is allowed or denied - but I'd like more feedback from firepower regarding what country it believes the IP is from.

Thanks!

[Dennis Perto]

Unfortunately there is not at the moment. In Firepower 6.2 we are able to lookup the URL category, but I have not seen anything about geolocation lookups yet. I hope for being able to do this in the future. :)

[Boris Uskov]

Realy?

It may be, that I misundestand the question... but, for example, in Analysis -> Contex Explorer I can see Geolocation information for connections. The same for Analysis -> Connection Events. Please, see the attaches.

Also, we need to update periodically geolocation base on FMC in System -> Updates -> Geolocation Updates.

[Dennis Perto]

I might have misunderstood the question as well. 

What I mean is that it is not possible to test the geolocation before actually creating a rule to either allow or block. 

But it is definitely possible to see the history of connection events, and where the geolocation resolved it to be. 

[Boris Uskov]

Got it, thanks for update. You meant somethink like Bulk URL lookup feature, but for geolocation.

[Dennis Perto]

That was my thought. But now I am not certain that I understand the question from the thread starter. 

[Ella Bella]

Yes. The idea is to evaluate IPs prior to rule creation and without logged traffic. 

Mostly this is to evaluate IP blocks which have been assigned to the customer prior to implementing, especially where existing geographic based rules already exist. 

[Marvin Rhoads]

Cisco added this feature in FMC 6.1:

Analysis > Lookup > Geolocation

You can enter up to 250 IP addresses and get back the Country, Country Code and Continent.

[Dennis Perto]

Oh my. You are right. 

Why did I not see that!

http://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/using_lookups.html#id_15479

[Marvin Rhoads]

I had forgotten it too Dennis.

Earlier I was re-reading a presentation (BRKSEC-2050 from Cisco Live US 2016), saw the feature mentioned and was reminded of this thread.

[Ravi Singh]

Please see this post

https://supportforums.cisco.com/discussion/12716991/can-i-do-geo-ip-filtering-my-asa-5520