topic Re: Can't find the "Republic of Kosovo" in the "Firewall Region Code Legend" in General Topics

Can't find the "Republic of Kosovo" in the "Firewall Region Code Legend"

Sergio_Voigt — Mon, 15 Jul 2024 13:56:32 GMT

Hey, new to the community today!

I've searched the LIVEcommunity discussions and the web, but couldn't find any solutions or anything related to such a problem.

We have geo-blocked every country in the world by default and add countries to an exepction rule whenever needed. Today I was asked to grant a client access from the Republic of Kosovo (RoK). Normally I'd choose a region from the predefined regions list provided by PA (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFFCA0). But the RoK is not listed. Why? Does it belong the another region (although recognised as independent)? Is there any way to solve this problem?

Thanks!

Re: Can't find the "Republic of Kosovo" in the "Firewall Region Code Legend"

BPry — Mon, 15 Jul 2024 14:10:41 GMT

@Sergio_Voigt,

The Republic of Kosovo isn't actually recognized with only partial recognition as a independent country. From a brief look, it looks like their IP addresses are spread between Austria, Albania, and Serbia. It might be one of the situations where it's hard to do this via GeoLocation simply due to how those addresses are registered.

Re: Can't find the "Republic of Kosovo" in the "Firewall Region Code Legend"

Sergio_Voigt — Mon, 15 Jul 2024 14:18:36 GMT

Hi BPry!

thanks a lot, at least that's a hint. Would you advise to create a custom region and add known IPs to it? Any suggestions on where to find a somewhat complete list of IPs allocated to Kosovo?

Re: Can't find the "Republic of Kosovo" in the "Firewall Region Code Legend"

BPry — Mon, 15 Jul 2024 14:49:19 GMT

@Sergio_Voigt,

That would be the safest route instead of whitelisting countries that don't actually match what you're attempting to do. If it's just one customer you could attempt to identify if they have static IPs assigned to them or their ISP and just allow the ranges allocated to that provider (assuming that you aren't providing a service that is expected to be utilized on mobile connections or anything like that).

I'm not sure how accurate it is, but ipinfo.io/countries/xk has at least some information that might get you started.