How to use the Geo-IP feature on the USG-Series

This tutorial will guide you through the GeoIP function, which has been introduced from v4.20 onwards!

Walkthrough Steps

After you went through these steps you are able to block the access to your USG or network for specific countries:

1. Log in to the unit by entering its IP address and the credentials for an admin account (by default, username is “admin”, password is “1234”)
2. Navigate to Configuration > Object > Address/Geo IP and click “Add”
3. Type in a speaking name for the object, choose “GEOGRAPHY” as the Address Type, choose the needed Country and click “OK”
4. Using the tab “Geo IP” above you can update the Geo IP database, configure an automatic update schedule for the database, create your own IPv4 to Geography rules and test different IPs to see to which country they belong
5. Navigate to Configuration > Security Policy > Policy Control and click “Add”
6. Choose “From: any”, “To: any (Excluding ZyWall)”, the Geo IP country object for the Source and click “OK”

After setting this firewall rule to active, requests from that country to your internal networks will be blocked in future. You can enable the logging for that rule to see in the logs under Monitor > Log.

Please note: To also block the access for that country to your ZyWall, you would need to create a second firewall rule similar to the first one where you define the Destination “ZyWall”.

KB-00045