IP Geo location issues Apps & Threats update v8559-7361?

[PatrickPater]

Hi,

Since we have installed Apps & Threats update v8559-7361 we see that multiple ip address spaces are incorrect categorized.
Before the upgrade those ip address spaces where categorized as US and after the upgrade categorized as CN (China)

Is it possible that the latest updates has changed some IP geolocations or is it a bug?

A short list of ip addresses that are categorized as CN (china)

13.107.213.45
13.107.213.52
13.107.213.67
13.107.246.1
13.107.246.11
13.107.246.2
13.107.246.45
13.107.246.52
13.107.246.67

example

user@ssc-fwpa-ph-1(active)> show location
> ip By IP address

user@ssc-fwpa-ph-1(active)> show location ip 13.107.213.67

13.107.213.67
China

With kind regards,

Patrick

[Adrian_Jensen]

Hmm... odd. Yeah seeing the same 8559-7361. The following seem to be marked as China, but above and below are marked as US.

13.107.213.0/26

13.107.213.64/30

13.107.246.0/26

13.107.246.64/30

There are also some other oddities, 13.107.220.0/26 and 13.17.220.64/30 are marked as Brazil. 13.17.221.64/26 and 13.107.221.128/25 are marked Canada. There may be others.

[StephenPorter]

I am seeing the same.  Citrix put out a support article, "Palo Alto Threat Version 8559-7361 erroneously identifed the 13.0.0.0/8 network as a China location".  I don't see any notice from Palo Alto yet.

source:  Cloud CVAD - All machines are not registering and machines are in Unregistered state due to Palo Alt...

[DIEHARD]

I opened a case before seeing this post.. but we ran into the issue this morning of lots of MS365 auth issued due to China being blocked. If anyone hears any updates let us know!

[Kenneth_Bradley]

Had to revert to prior content we are waiting to her back from support now.

[PatrickPater]

Would you like to inform us if you have an update in the case?

[Noel_Adams · Accepted solution]

Update: https://live.paloaltonetworks.com/t5/customer-resources/ip-geolocation-issues-with-the-applications-...

[ChrisWietharn]

I am seeing the issue on a US IP location - IP range 8.42.246.0/24 as Portugal.

Any one else seeing this?  I have an open ticket - looks like it has been going on since 4/7/2022.

8.42.246.2
Portugal

[Noel_Adams]

@ChrisWietharn Yes, I see the same here.

[ChrisWietharn]

I have an open Case with Palo - they are reviewing currently.  Thank you for your response!!

[SheilaSeaton]

Ensure that the most recent content version is installed on the device. To verify the Geolocation provided by the firewall, issue the display location ip command using the IP address.