Geolocation Region EU allowed bust Spain is denied

[kbe]

Hi

we use the region as source adress in policies.

We allowed region EU but traffic from Spain was blocked. We had to add ES (Spain) to the allowed regions.

What am i missing? Spain should match the EU region. Any ideas?

If i enter the ip that was blocked in CLI with the "show location ip" command it shows Spain.

What does the EU region match? Do i also have to allow Italy, Austria and all the other EU countries separately?

If yes, what is the EU region used for?

TIA

Karsten

[Adrian_Jensen · Accepted solution]

Yes, the "EU" region does not seem to be treated as a region group, but is instead a generic standalone region. It seems to be a catch-all for lots of mixed use blocks. So for Europe you need to have both the specific country code and the catch-all EU code.

As an example, Velia.net 146.0.224.0/19 is marked as EU, though it is in Germany (seems to be a Godaddy datacenter block in Germany). Even though the entire /19 is marked EU, specific sub-allocations are all over the place:

147.0.227.0/28 - Safetyman Intl   Hong Kong

147.0.227.16/30 - CrossEngage Germany

147.0.227.32.0/30 - PetroLube Russia

147.0.227.36.0/31 - Superscanner Netherlands

147.0.227.96/29 - Admixer Ukraine

[kbe]

Thanks for the information. This helps alot.

How did you find this information? Is there any docu concerning the EU region and what it is catching up?

Any way to find out what is covered by EU, other than wait until something hits the logs and shows up as EU?

cu

[Adrian_Jensen]

Like you, I had allowed "EU" as a destination address in multiple rules and kept having failure to match that came up as Ireland/Germany/Spain/etc. So I found it by trial and error, adding those regions. I've had to wait for reports of blocked websites or scan the Traffic logs for potential matches: ( dstloc eq 'EU' )

I have not found any documentation concerning how PaloAlto has geolocated certain IP blocks. I originally thought it was based on the "country:" field of the IP whois field, but that is not always the case. You can override a region code by adding IPs/blocks in Objects -> Regions, but I haven't found any way to view all existing geolocations to see what might be miscategorized for your policy ruleset.

[kbe]

Ok, thanks for your help. Now i can be sure that EU does not match all EU countries.

Last question: Do you know if override a region with IPs just adds the manual IPs to the original region or does it replace the original region and only uses the manual added IPs?

[Adrian_Jensen]

I am not sure, but I think it just adds the manual IPs to the original region as an exception. I have not actually used it to add to existing region geolocations before, but I do have one custom region code "Hidden-Cobra" that has all the NK Hidden Cobra servers in it, redefining their region to one that is in a block-all-traffic policy rule.

There is this PA article on using the Objects->Regions to fix "How to resolve mismatch of country-IP mapping?":

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMt6CAG

[YordanYordanov]

Hi

i found some information here

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFFCA0

br