topic Source ip region/country showing incorrect on PA firewall in General Topics

Source ip region/country showing incorrect on PA firewall

SurajN — Wed, 02 Jun 2021 16:24:24 GMT

In the Palo alto firewall for the public ip 205.254.183.218 source ip region is showing as US. but user is located at India.
we have given access on firewall for source region India only for inbound traffic.

In the traffic logs source country is showing as US country.

Therefore traffic is going from clean-up rule.
what should we troubleshoot for the same issue ,to show this ip as India country ip.

As checked in public IP location finder, it was showing region from Delhi India.

Re: Source ip region/country showing incorrect on PA firewall

aleksandar.astardzhiev — Wed, 02 Jun 2021 16:32:32 GMT

Hi @SurajN ,

As any other vendor Palo Alto is using some kind of ip-geolocation database. There are countless reasons why this information could be wrong. It is regularely updated, but still is could have wrong information.

If you are sure that this IP is located in India you can create custom region object listing the IP address/range. This will effectivley override the geo location for that ip in the FW internal db.

Re: Source ip region/country showing incorrect on PA firewall

Remo — Wed, 02 Jun 2021 18:56:59 GMT

Hi @SurajN

Do you have installed the latest content update? Because the geolocation db is updated with these updates.

You could also create a support case to tell this wrong IP to paloalto, so the could correct this information.

Re: Source ip region/country showing incorrect on PA firewall

OtakarKlier — Thu, 03 Jun 2021 17:01:24 GMT

Hello,

Palo Alto uses ARIN for their info. In this time of IPv4 address shortages. they get bought and sold and not always quick to update. If you dont have the latest updates, contact support with all the info.

Regards,