How to use the Geo-IP feature on the USG-Series

This tutorial will guide you through the GeoIP function, which was introduced from v4.20 onwards!

Walkthrough Steps

After you went through these steps, you can block the access to your USG or network for specific countries:

1. Log in to the unit by entering its IP address and the credentials for an admin account (by default, the username is “admin”, the password is “1234”)
2. Navigate to Configuration > Object > Address/Geo IP and click “Add”
3. Type in a speaking name for the object, choose “GEOGRAPHY” as the Address Type, choose the needed Country and click “OK”
4. Using the tab “Geo IP” above you can update the Geo IP database, configure an automatic update schedule for the database, create your IPv4 to Geography rules and test different IPs to see to which Country they belong
5. Navigate to Configuration > Security Policy > Policy Control and click “Add”
6. Choose “From: any”, “To: any (Excluding ZyWall)”, the Geo IP country object for the Source and click “OK”
7. Choose "Action: Deny".

After setting this firewall rule to active, requests from that Country to your internal networks will be blocked in the future. You can enable the logging for that rule to see in the logs under Monitor > Log.

Please note: To also block the access for that Country to your ZyWall, you would need to create a second firewall rule similar to the first one where you define the Destination “ZyWall”.

KB-00045