Source ip region/country showing incorrect on PA firewall

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Source ip region/country showing incorrect on PA firewall

L2 Linker

In the Palo alto firewall for the public ip 205.254.183.218 source ip region is showing as US. but user is located at India.
we have given access on firewall for source region India only for inbound traffic.

In the traffic logs source country is showing as US country.

Therefore traffic is going from clean-up rule.
what should we troubleshoot for  the same issue ,to show this ip as India country ip.

As checked in public IP location finder, it was showing region from Delhi India.

3 REPLIES 3

Hi @SurajN ,

As any other vendor Palo Alto is using some kind of ip-geolocation database. There are countless reasons why this information could be wrong. It is regularely updated, but still is could have wrong information.

 

If you are sure that this IP is located in India you can create custom region object listing the IP address/range. This will effectivley override the geo location for that ip in the FW internal db.

 

 

L7 Applicator

Hi @SurajN 

Do you have installed the latest content update? Because the geolocation db is updated with these updates.

You could also create a support case to tell this wrong IP to paloalto, so the could correct this information.

Cyber Elite
Cyber Elite

Hello,

Palo Alto uses ARIN for their info. In this time of IPv4 address shortages. they get bought and sold and not always quick to update. If you dont have the latest updates, contact support with all the info.

 

Regards,

  • 3307 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!