topic Re: How to Block all countries in General Topics

How to Block all countries

hill11 — Mon, 20 Nov 2017 18:49:03 GMT

I am trying to make a policy on my new PA-220 and i want to block all traffic coming in from every country except the united states..I can't figure out how to do that except by blocking every country one country at a time.. Can anyone tell me if there is a block all except feature?

Re: How to Block all countries

BPry — Mon, 20 Nov 2017 20:28:28 GMT

@hill11,

You should be able to create a security policy that has the source set as the 'US' and then simply Negate the source and set the action to block.

Re: How to Block all countries

reaper — Tue, 21 Nov 2017 09:34:52 GMT

or set 'US' as the only source for your inbound allow policies, anything not from the US will hit the default deny rule (or an 'any' drop rule you create right after the allow policies)

Re: How to Block all countries

kiwi — Tue, 21 Nov 2017 10:05:39 GMT

Hi @hill11,

Both options are valid. The negate option is an often 'forgotten' feature and it has my preference in this case.

Depending on how many rules you have, you don't want to wait until you hit the final default deny all rule. This uses up precious resources and to avoid that I would recommend to block early on ^_^

Cheers !

-Kiwi.

Re: How to Block all countries

clewis1 — Tue, 21 Nov 2017 16:11:32 GMT

create an allow rule with US as source followed by a deny rule of source 'any'.