This article provides the steps to configure GeoIP using Policy Enforcer in Security Director.

1. Add Policy Enforcer to Security Director:

Security Director, Administration

Select "Cloud Feeds Only"

Do not use wizard. (Prompts to configure unnecessary items)

2. Add Feed Source:

Security Director, Configure, Threat Prevention, Feed Sources, SkyATP, Add

Create SkyATP Realm if needed (follow instructions in UI).

3. Add Device to Secure Fabric:

Security Director, Devices, Secure Fabric

Create a Site, then Add your device to the site.

After completing the Add device operation, Policy Enforcer will add configuration to the SRX and commit. (May not run if Feed Source is not configured yet.)

Monitoring Device configuration Process:

Wait for the configuration to be added to the device before continuing, this may take some time.

The Configuration Job can be seen in Space Platform, Job Manager. ExecRPC Job type

The following lines will be added:

• set services security-intelligence url  <PE System IP + URL>
• set services security-intelligence authentication auth-token <configured by PE>

"Show system commit" should show 1 update (More commits occur when using SkyATP mode)

4. Create Geo IP Object:

Configure, Shared Objects, Geo IP

Click "+"  To create a new GeoIP object

Note:  Assign to groups is not needed in Cloud Feeds only mode.  

5. Use GeoIP Address object in Security Policy:

Edit Security Policy, create/edit Firewall rule that includes the GeoIP Address object as source or destination address object

6. Publish and update to device

7. (Optional) Verify on SRX

show security dynamic-address summary

In the output, look for the Address Name that was created in Step 4. Check to ensure that IPv4 Address objects exist.

> show security dynamic-address summary

Example:

    Address name          : US
    Address id            : 11
      IPv4 entries        : 72277 <-- Here
      IPv6 entries        : 0
      Category/feed       : GeoIP   / ---
            property name : country
                    value : UM
                    value : US                    

It may take the system a few minutes to complete loading the data.
 

Troubleshooting

If dynamic object contents is not seen after 5-10 minutes, check that the SRX is downloading feeds

1. Check SRX Download status from PE

2. Trigger download and check on status:

Start manual Download:

Check Status:

Examples:

{primary:node1}
> request services security-intelligence download status
node1:
------------------------------------------------------------------
Security intelligence feed download status:
Start time:Thu May 14 19:37:21 2020
Start downloading the latest manifest.
Start parsing manifest file.
Parse manifest succeeded, version:06a4149fb12dfa55053db1f5776fbcc1.
Checking update interval of category GeoIP.
Start checking feed geoip_country of category GeoIP.
Updating feed geoip_country (20200512.1) of category GeoIP.
Feed geoip_country (20200512.1) of category GeoIP not changed
End time:Thu May 14 19:37:21 2020

3. If the previous command shows an error as below, then review if port connectivity in the network is fine between the SRX and PE. Port 443, 444 (when using Security Director Insights as PE) should be open.

{primary:node1}
> request services security-intelligence download status
node1:
------------------------------------------------------------------
Security intelligence feed download status:
Start time:Tue Dec 10 14:21:15 2024
Start downloading the latest manifest.
Download manifest failed<connection error: Timeout was reached> [28][0].
End time:Tue Dec 10 14:22:49 2024

If setup steps fail,

2024-12-10 - Adding ports to review for connectivity between SRX and PE.