06-14-2020 06:17 AM - edited 06-14-2020 06:17 AM
Hi team,
I am facing the source IP mismatch region .
This is the IP 41.139.156.142 which shows up from Kenya, i have confirmed from https://ping.eu & https://threatvault.paloaltonetworks.com/
but in firewall traffic log it show like this IP belongs to Germany.
I have blocked this IP in policy but why it is happening ? Why firewall shows mismatch source region ?
Does someone have insight on this issue ??
PAN OS version is 8.1.10.
06-14-2020 08:29 PM
On a fully updated firewall this IP address is properly mapping to Kenya as it should be. You'll want to insure that you are running the latest content updates so that you have the latest database updates.
06-15-2020 02:46 PM
Hello,
I have seen this in the past where one country/provider sells IP's to another. I have had to open a support case and work it that way. PAN then had to correct the database it gets from ARIN.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
