The SRX series devices on Junos supports GEO-IP filter configuration. To configure Juniper ATP Cloud with GeoIP, first create the GeoIP DAE and specify the interested countries. Then create a security firewall policy on the SRX Series device to reference the DAE and define whether to allow or block access.

At times we might find that these filters might not work or stop working as expected. The reason could be the following.

1. New/Old configuration and the traffic is not allowed/blocked even when the traffic from a specific country has been added to the policy. The logs will suggest whether permit/deny action applied to that policy. If you think this is a false positive or false negative, please contact JTAC support for further assistance.

   root@host# show security dynamic-address
   address-name my-geoip {
       profile {
           category GeoIP {
               property country {
                   string US;
                   string GB;
               }
           }
       }
   }
   root@host# show security policies
   ...
   from-zone untrust to-zone trust {
       policy my-geoip-policy {
           match {
               source-address my-geoip;
               destination-address any;
               application any;
           }
           then {
               deny;
           }
       }
   }
   

2. The dynamic address was working before, then stopped suddenly and the traffic falls under a different policy.

root@SRX> show services security-intelligence category summary

Category name   :GeoIP
 Status     :Enable
 Description   :GeoIP data schema
 Update interval :435600s
 TTL       :157680000s
 Feed name    :geoip_country
  Version    :N/A
  Objects number:0
  Create time  :1969-12-31 16:00:00 PST
  Update time  :N/A
  Update status :N/A
  Expired    :Yes
  Status    :Active
  Options    :N/A

Logs:
Mar 24 11:53:26 jsqlsyncd[20632]:INFO:jsPrmThread:3173 /var/db/secintel_db/sql/GeoIP.db: not exists, remove from sync db

1. Try and restart the Sec Intel service:

   • >restart security-intelligence

2. Uninstall your sec-intel feeds

   • >request services security-intelligence uninstall

3. Check the status to verify they uninstall successfully.

   • >request services security-intelligence uninstall status

4. Force a fresh download/install of the feeds:

   • > request services security-intelligence download

5. Check the status to verify they update successfully

   • > request services security-intelligence download status | refresh 10

2023-06-05: Initial publication

Configuring Juniper Advanced Threat Prevention Cloud With Geolocation IP