The Security Director log may incorrectly display the country of origin for certain IP addresses due to outdated GeoIP database information.

• The flow log in Security Director shows IP address <IP-Address> as originating from a different country than the one reported by external GeoIP lookup tools such as MaxMind, IP2Location, and IPLocation.net.
• The GeoIP dynamic-address feed on the SRX device correctly identifies the IP address and associates it with the expected country.
• Running the mmdblookup command against the locally installed GeoIP database shows the IP address mapped to an incorrect country.

/usr/share/GeoIP2/GeoLite2-City.mmdb

 # mmdblookup --file GeoLite2-City.mmdb --ip <IP-Address>

• The affected IP address may be associated with an outdated country mapping because the local GeoIP database is older than the versions used by current public GeoIP lookup services. 

Cause: 

The Security Director Insights server relies on the bundled MaxMind GeoLite2 database for IP geolocation lookups. If the bundled database is outdated, newly reassigned or updated IP address ranges may still be mapped to their previous countries, resulting in incorrect country information being displayed in flow logs in Security Director.

To resolve this issue, update the GeoIP database by upgrading Security Director Insights to a release that contains a newer version of the MaxMind GeoLite2 database.

Important:

• The GeoIP database is packaged within an internal .deb package and cannot be updated independently.
• GeoIP database updates are incorporated only during the Security Director Insights release cycle.
• To obtain updated GeoIP information, users must upgrade to the latest supported Security Director Insights release.

Note:

There is currently no supported way to update the GeoIP database manually or via SDI CLI, as the database files are packaged and are part of an internal GeoIP deb package. To upgrade the GeoIP database, users must upgrade to the latest SDI release.