Geo-IP Block and Access Rules question
A_Elliott
Newbie ✭
I have Geo-IP block turned on, with a small list of "allowed" countries.
I have a Access Policy to allow incoming connections to an SBC for voice, and have it set as the US being the only "allowed" country. (see picture).
The SBC is getting hammered from countries not listed in the "Allowed" list. Makes me question all of the other inbound Access Policies I have as well.
What am I doing wrong here?
This is specifically on a NSa2700 HA pair, but I question if it's happening to my other locations with TZ670s/470s.
Category: Firewall Security Services
0
Answers
@A_Elliott , are you indicating that the traffic is flowing to the SBC from countries not listed in the allowed list or is this finding based on the TCP handshake only, from those countries?
Could this be related to the highlighted option available on the "diag" page?
Inbound access rule is set to USA only, but the SBC had loads of connection attempts from other countries, verified on the SonicWall itself when looking up the IPs via "Diagnostics" in the Geo-IP filter settings sub page.
I do have "Drop TCP handshake originating from blocked Country" already checked.
I know its not ideal but try using the Global option on the access rule rather than Custom. See if that actually applies the restrictions. I never use the Custom option.
What firmware version are you running? Always provide that info in your posts.
Global has a few dozen countries listed, and inbound only needs to be from our local area, so limiting to the US was the best course. in fact, Global has France listed, which we sometimes need outbound access to, but would never need an inbound connection.
You're absolutely correct, my bad.
Firmware 7.0.1-5111 and now 7.0.1-5119