You have a couple alternatives.
One is to use two (or three) Security Policies, The first one allowing all traffic from (and/or a second rule for trafic *to*) US and India Regions, the next rule listed right after these rules, blocking destination any.
The second option is to use the Negate option. You would configure a Deny rule, and add US and India, then in the Source or Destination Address (depending on which direction of sessions you want to block, you may need to use separate rules for either direction) use the Negate checkbox, which will say, Deny everything 'except' these two Regions.
#1 Pros: Configuration is obvious to anyone reading it, especially if you need to add security profiles in the Actions tab.
#1 Cons: You need two (or three, to cover sessions in either direction) rules
#2 Pros: You need only one rule (or two, to cover sessions in either direction)
#2 Cons: Configuration may look awkward to someone who doesn't understand what the Negate option does, and it's also counter-intuitive to see Security Profiles configured in a Deny policy.
... View more
