Cisco ASA and Firepower - GeoFiltering

[LovejitSingh130013]

Hello Experts, 

I had Russia blocked as GeoFilter in Firepower and policy is deployed successfully. 

When I run Packet-tracer command, it showed allow.  Is it normal ?  Or my Firepower policy is not in place?

Thanks,

[Kasun Bandara]

@LovejitSingh130013  how you ran packet tracer for geofilter? packet tracer is only looking for IP and not for geolocation. additionally, make sure you have correct service rule to traffic filter.

[Aref Alsouqi · Accepted solution]

Geolocation filter blocks the transit traffic through the firewall, not the traffic destined to the firewall itself. Please take a look at this post of mine with some examples:

https://bluenetsec.com/ftd-geolocation/