Technical Tip: Error 'is not in kernel IP-country DB; occurs while identifying an IP’s country on low-end FortiGate models after upgrading FortiOS.
| Description | This article describes behavior changes in the Geo-IP feature set on low-end FortiGate models that may lead to certain countries not being correctly identified by their IP and instead presenting a message 'not in kernel ip-country DB.' |
| Scope | FortiGate 7.4.9+, 7.6.4+, 8.0.0+. |
| Solution | In some cases, the IP geolocation database does not appear to have been updated properly after the upgrade.
For example:
diagnose firewall ipgeo ip2country 208.84.195.241
The error message 'is not in kernel IP-country DB', observed in FortiOS 7.4.9 (or FortiOS 7.6.4+ and FortiOS 8.0.0+) is due to a behavioral change introduced in this version.
This change was implemented to optimize memory utilization on low-end FortiGate (where system memory is 2GB or less) models, where memory is typically the primary bottleneck. The geo-IP installation logic in the kernel was modified so that only the geo-IP entries that are actively used are installed into the kernel.
This behavior change has two main aspects:
For example, the IP address 208.84.195.241 is associated with the geolocation of the U.S. Virgin Islands. Navigate to Policy & Objects -> Addresses -> Create New and add Country/Region address object as shown in the screenshot below.
Afterward, FortiGate will display the correct geolocation of the IP address.
diagnose firewall ipgeo ip2country 208.84.195.24 |
