This article explains how to filter the traffic on SRX based on the region/country using ATP Cloud.

Juniper ATP Cloud supports GeoIP, giving you the ability to filter traffic to and from specific geographies in the world. IP-based Geolocation (GeoIP) is a mapping of an IP address to a geographic location.

GeoIP functionality relies on a Dynamic Address Entry (DAE) infrastructure. A DAE represents a collection of IP addresses rather than a single IP prefix, which can be imported into Juniper Advanced Threat Prevention Cloud from external sources. These IP addresses correspond to specific domains or entities sharing a common attribute, such as an identified undesirable location posing a threat. You can configure security policies to utilize the DAE within a security policy framework. As the DAE undergoes updates, the alterations seamlessly integrate into the security policy without manual intervention.

Upon enrolling the SRX to ATP Cloud, the cloud feed URL is automatically established. You can confirm this URL via the SRX CLI using the following command:

User@Device> show configuration services security-intelligence url
https://cloudfeeds.sky.junipersecurity.net/api/manifest.xml

Please refer to the following link for the GeoIP configuration example: Configure Juniper Advanced Threat Prevention Cloud With Geolocation IP

In order to check the status of GeoIP feed along with details like update status, last update time and next update time use the below command:

user@host> show services security-intelligence category summary 
Category name     :GeoIP
  Status          :Enable
  Description     :GeoIP data schema
 Update interval :1800s
  TTL             :3456000s
  Feed name       :geoip_country
    Version       :N/A
    Objects number:0
    Create time   :2018-03-16 05:57:39 PDT
    Update time   :2018-03-19 12:30:32 PDT
    Update status :N/A
    Expired       :No
    Options       :N/A
    Status        :Enabled
  Feed name       :geoip_ipv6_data
    Version       :20180228.1
    Objects number:1
    Create time   :2018-03-16 05:57:39 PDT
    Update time   :2018-03-16 06:19:47 PDT
    Update status :Store succeeded
    Expired       :No
    Options       :N/A
    Status        :Disabled