How to change the geolocation of a subnet in FiresIGHT

[guillerm]

hello,

some of our internal networks are historically based on public IP subnets ;

we use ASA + FirePOWER+FireSIGHT solution,

and, so, FireSIGHT automatically, but incorrectly associates these internal subnets with the national flag of different countries based on its owns Geolocation database : this is visible in the different FireSIGHT dashboards and reports ;

There is a way in FireSIGHT to create new Geolocation Objects to group different regions or countries under a single logical name;

but it does not seem to exist an option that would allow to indicate that those internal subnets are not real public ones on Internet but local subnets;

Any idea ?

thanks in advance

[Marvin Rhoads]

If you customize the HOME_NET variable and exclude those private networks from your EXTERNAL_NETS object under Object management, that should fix the mis-identification.

[guillerm]

Hello Marvin,

I tried your solution but this did not change the problem ...

any other suggestion ?

thanks

[Marvin Rhoads]

I'd suggest opening a TAC case.