06-02-2021 09:24 AM
In the Palo alto firewall for the public ip 205.254.183.218 source ip region is showing as US. but user is located at India.
we have given access on firewall for source region India only for inbound traffic.
In the traffic logs source country is showing as US country.
Therefore traffic is going from clean-up rule.
what should we troubleshoot for the same issue ,to show this ip as India country ip.
As checked in public IP location finder, it was showing region from Delhi India.
06-02-2021 09:32 AM
Hi @SurajN ,
As any other vendor Palo Alto is using some kind of ip-geolocation database. There are countless reasons why this information could be wrong. It is regularely updated, but still is could have wrong information.
If you are sure that this IP is located in India you can create custom region object listing the IP address/range. This will effectivley override the geo location for that ip in the FW internal db.
06-02-2021 11:56 AM
Hi @SurajN
Do you have installed the latest content update? Because the geolocation db is updated with these updates.
You could also create a support case to tell this wrong IP to paloalto, so the could correct this information.
06-03-2021 10:01 AM
Hello,
Palo Alto uses ARIN for their info. In this time of IPv4 address shortages. they get bought and sold and not always quick to update. If you dont have the latest updates, contact support with all the info.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
