GeoDB Updates file

[Knassi]

Hi,

I downloaded the GeoDB Updates and uploaded it. I have some geolocation rules set to block traffic from certain locations. Now some IPs are being blocked by those rules but the IPs are not from the locations i am blocking. Somehow the FMC sees those IP as coming from banned locations. Anyone seen that before? I want to open the GeoDB  file downloaded and see what's in there. I have not been successful so far. Any help will be appreciated. Thank you

[Marius Gunnerud · Accepted solution]

I have seen this issue a lot over the past couple years.  The only work-around we have found is to white list the source and destination IPs and ports that are being blocked / add ACP rules above the GeoBlock to allow that traffic.  We have had TAC on the case earlier and they cannot do anything as these IPs are automatically fetched (from Talos I believe).

We have boiled the issue down to that some of these subnets are re-allocated to different geographic locations therefore causing the issue.  Not entirely sure if this is an issue with the classification or if the subnets are actually being allocated to new geographic locations.

[Knassi]

I did that and things are working fine. The TAC submitted didn't yield anything good either. Thank you