Country Block and security policy ordering

RussMc — Tue, 24 May 2022 22:43:21 GMT

We are currently setting up policies to block all traffic to\from all countries except a select few. The rules are in place and seem to be working well. As a best practice, do you create a deny rule for all other out of country or do you just let the interzone-default rule catch the rest? If you do create a rule, is it best practice to keep defining your rules until both the interzone-default & intrazone-default rules don't get hit?

Re: Country Block and security policy ordering

BNSRIKAR — Wed, 25 May 2022 07:54:18 GMT

Hi RussMc,

Its good to have a deny rule so that you can block malicious IP traffic from all allowed countries.

Else such accepted traffic may hit on one of the rule above default rules.(i mean example: any traffic from to DMZ/public facing servers)

topic Country Block and security policy ordering in Advanced Threat Prevention Discussions

Country Block and security policy ordering

Re: Country Block and security policy ordering