Access Rules and GEO-IP filter
Simon_Weel
Enthusiast ✭✭
On our TZ470W, I set up an access rule for inbound HTTPS traffic to accommodate Exchange OWA. Under tab Security Profiles, I set a custom GEO-IP filter to only allow the Netherlands.
When doing a routine eventlog check on the Exchange server, I notice an entry of a failed logon attempt. It lists the user host address as 64.62.197.194. Doing a lookup, this address resolves to ISP Hurricane Electric, based in the US.
How can that be when the only allowed country is the Netherlands?
Category: Firewall Security Services
0
Answers
Did you do the lookup from the GeoIP diags tool on the firewall or from Sonicwall's online GeoIP lookup tool? I have found some inconsistencies between the two - obviously what the firewall says "wins" when it comes to applying the rule.
Most of the times I use this site: LookIP.net | Free IP lookup tool for IP addresses and websites
When I use the GeoIP diags tool on the firewall it reports the same country.
The on-firewall tool is the only one that is relevant, because that's how the firewall determines what to do. You won't be able to progress this issue with Sonicwall if you use any other lookup tool.