Traffic blocking on FTD using Geolocation doesnt work properly

[mikeyasg]

Dear Community,

Due to excessive malicious attempts to our network we decided to block traffic that come from specific countries on our Firepower Threat Defence. But we are still having attempts that bypassed the geolocation rule. the log shows that their source address belongs to the location that we added the geolocation blocking rule. How is this possible? any idea on how to resolve this issue?

[MHM Cisco World]

check this 
Using the Firepower geolocation | Blue Network Security (bluenetsec.com)

[MHM Cisco World]

@mikeyasg by the way @Aref Alsouqi  who is write this article.
so you have answer by professional @Aref Alsouqi  

[Aref Alsouqi]

thank you friend

[Aref Alsouqi]

As per the link @MHM Cisco World shared, unfortunately the FTD doesn't support blocking the geo traffic to itself. It can apply the enforcement on the transit traffic though, but not the traffic destined to itself.

[mikeyasg]

Thank You @Aref Alsouqi @MHM Cisco World  for the support but what we did is exactly as mentioned in the link. The traffic that we wanted to block was the traffic that is destined to our internal network and to our DMZ. But still we are getting those traffics.

[MHM Cisco World]

Friend @Aref Alsouqi mention below 

""FTD doesn't support blocking the geo traffic to itself""

So it ftd limitations.

[mikeyasg]

these traffics are not destined to the FTD itself rather they are going through the FTD to the internal networks. so they should have been blocked unless we missed something.

[MHM Cisco World]

Can I see policy you use.

Thanks 

MHM

[Aref Alsouqi]

Is the geodb updated on your FMC? if so, could you please check any of those IP addresses that are still getting through and see if you can find them in the "ipv4_country_code_map" on the FMC? if so, please take the country code and check if that code is associated to the right country in the "geoDBInfo.csv" file on the FTD.