topic Re: IP Geo location issues Apps & Threats update v8559-7361? in Advanced Threat Prevention Discussions

IP Geo location issues Apps & Threats update v8559-7361?

PatrickPater — Wed, 20 Apr 2022 18:48:52 GMT

Hi,

Since we have installed Apps & Threats update v8559-7361 we see that multiple ip address spaces are incorrect categorized.
Before the upgrade those ip address spaces where categorized as US and after the upgrade categorized as CN (China)

Is it possible that the latest updates has changed some IP geolocations or is it a bug?

A short list of ip addresses that are categorized as CN (china)

13.107.213.45
13.107.213.52
13.107.213.67
13.107.246.1
13.107.246.11
13.107.246.2
13.107.246.45
13.107.246.52
13.107.246.67

example

user@ssc-fwpa-ph-1(active)> show location
> ip By IP address

user@ssc-fwpa-ph-1(active)> show location ip 13.107.213.67

13.107.213.67
China

With kind regards,

Patrick

Re: IP Geo location issues Apps & Threats update v8559-7361?

Adrian_Jensen — Wed, 20 Apr 2022 16:12:03 GMT

Hmm... odd. Yeah seeing the same 8559-7361. The following seem to be marked as China, but above and below are marked as US.

13.107.213.0/26

13.107.213.64/30

13.107.246.0/26

13.107.246.64/30

There are also some other oddities, 13.107.220.0/26 and 13.17.220.64/30 are marked as Brazil. 13.17.221.64/26 and 13.107.221.128/25 are marked Canada. There may be others.

Re: IP Geo location issues Apps & Threats update v8559-7361?

StephenPorter — Wed, 20 Apr 2022 17:13:42 GMT

I am seeing the same. Citrix put out a support article, "Palo Alto Threat Version 8559-7361 erroneously identifed the 13.0.0.0/8 network as a China location". I don't see any notice from Palo Alto yet.

source: Cloud CVAD - All machines are not registering and machines are in Unregistered state due to Palo Alto Threat Version 8559-7361 (citrix.com)

Re: IP Geo location issues Apps & Threats update v8559-7361?

DIEHARD — Wed, 20 Apr 2022 17:15:53 GMT

I opened a case before seeing this post.. but we ran into the issue this morning of lots of MS365 auth issued due to China being blocked. If anyone hears any updates let us know!

Re: IP Geo location issues Apps & Threats update v8559-7361?

Kenneth_Bradley — Wed, 20 Apr 2022 17:57:54 GMT

Had to revert to prior content we are waiting to her back from support now.

Re: IP Geo location issues Apps & Threats update v8559-7361?

PatrickPater — Thu, 21 Apr 2022 07:36:29 GMT

Would you like to inform us if you have an update in the case?

Re: IP Geo location issues Apps & Threats update v8559-7361?

Noel_Adams — Thu, 21 Apr 2022 11:44:03 GMT

Update: https://live.paloaltonetworks.com/t5/customer-resources/ip-geolocation-issues-with-the-applications-and-threats-package/ta-p/481479

Re: IP Geo location issues Apps & Threats update v8559-7361?

ChrisWietharn — Thu, 21 Apr 2022 14:52:26 GMT

I am seeing the issue on a US IP location - IP range 8.42.246.0/24 as Portugal.

Any one else seeing this? I have an open ticket - looks like it has been going on since 4/7/2022.

8.42.246.2
Portugal

Re: IP Geo location issues Apps & Threats update v8559-7361?

Noel_Adams — Thu, 21 Apr 2022 18:49:20 GMT

@ChrisWietharn Yes, I see the same here.

Re: IP Geo location issues Apps & Threats update v8559-7361?

ChrisWietharn — Thu, 21 Apr 2022 19:20:21 GMT

I have an open Case with Palo - they are reviewing currently. Thank you for your response!!

Re: IP Geo location issues Apps & Threats update v8559-7361?

SheilaSeaton — Thu, 19 Jan 2023 12:42:32 GMT

Ensure that the most recent content version is installed on the device. To verify the Geolocation provided by the firewall, issue the display location ip command using the IP address.