-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
How can I configure SonicWall Geo-IP filter using firewall access rules?
04/26/2024 
2,480 People found this article helpful
503,321 Views
Description
Geo-IP Filter allows administrators to block connections coming to or from a geographic location to resolving the Public IP address to a particular country. This feature is usable in two modes, blanket blocking or blocking through firewall access rules.
Blocking through firewall access rules gives a network administrator greater control over what traffic is and isn't scanned by the Geo-IP Filter. This is useful for deployments in which Outbound Traffic may want to be uninhibited but Inbound traffic should be subject to scanning. Typical deployments of Geo-IP Filter with firewall access rules include DDoS and other network attack mitigation as well as anti-spoofing.
CAUTION: As mentioned, Geo-IP Filter works by tracing a public IP to a particular country. Users which make use of a VPN to disguise their country of origin may be able to get around the Geo-IP Filter by having their traffic appear as if it's coming from a white-listed country. At this times there are no work around for this issue.
Resolution
Resolution for SonicOS 7.X
This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.
- Login to the SonicWall management GUI.
- Navigate to POLICY | Security Services | Geo-IP Filter.
- Enable the check-box for Block connections to/from following countries under the settings tab.
- Enable the radio-button Firewall Rule-based Connections.
- Navigate to POLICY | Rules and Policies | Access rules, choose the LAN to WAN, click Configure .
- Under the Security Profiles tab, check the Enable Geo-IP Filter.
- Global- This option applies the default countries selected under Security Services | GEO-IP Filter |Countries.
- Custom- This option can be used when creating a specific access rule to block certain countries for certain users while globally allowing access to those specific countries.
Blocking particular IP Address from a specific country
- Navigate to POLICY | Security Services | GEO-IP Filter | Custom List tab .
- Click Add, create an Address Object with the zone assignment WAN with the appropriate IP address to be blocked.
- Choose the appropriate country from the drop-down menu.
To Exclude specific IP Address from GEO-IP filter
- Under the Geo-IP Exclusion Object select address object or groups of IP addresses on the WAN to be excluded from Geo-IP Filter.
- Click Accept at the bottom of the page to save the settings.
To Enable Logging
- Navigate to POLICY |Security Services | GEO-IP Filter |Settings , check on the option Enable logging.
NOTE: Geo-IP is supported on SOHO 250/TZ 215/TZ 215W, TZ300, Gen7 TZ and higher appliances .
Resolution for SonicOS 6.5
This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.
- Login to the SonicWall management GUI.
- Navigate to Manage | Security Configuration | Security Services | Geo-IP Filter.
- Enable the check-box for Block connections to/from following countries under the settings tab.
- Enable the radio-button Firewall Rule-based.
- Navigate to Policies | Rules | Access rules, choose the LAN to WAN, click Configure .
- Under the GeoIP tab, check the Enable Geo-IP Filter.
- Global- This option applies the default countries selected under Security Services | GEO-IP Filter |Countries.
- Custom- This option can be used when creating a specific access rule to block certain countries for certain users while globally allowing access to those specific countries.
Blocking particular IP Address from a specific country
- Navigate to Security Configuration | Security Services | GEO-IP Filter | Custom List tab .
- Click Add, create an Address Object with the zone assignment WAN with the appropriate IP address to be blocked.
- Choose the appropriate country from the drop-down menu.
To Exclude specific IP Address from GEO-IP filter
- Under the Geo-IP Exclusion Object select address object or groups of IP addresses on the WAN to be excluded from Geo-IP Filter.
- Click Accept at the bottom of the page to save the settings.
To Enable Logging
- Navigate to Security Configuration |Security Services | GEO-IP Filter |Settings , check on the option Enable logging.
NOTE: Geo-IP is supported on SOHO 250/TZ 215/TZ 215W, TZ300, Gen7 TZ and higher appliances .
Related Articles
- Cysurance Partner FAQ
- How can I enable Enhanced Audit Logging Support?
- How to stop the creation of Auto-Added Access Rules and enable the ability to edit or delete the existing rules?
Categories
- Firewalls > TZ Series > Geo-IP & Botnet Filter
- Firewalls > NSa Series > Geo-IP & Botnet Filter
- Firewalls > NSv Series > Geo-IP & Botnet Filter
YES
NO