Technical Tip: Updating FortiGate IP Geography Database

This article describes how to update FortiGate's Geo-IP Database and how to utilize it in blocking/permitting traffic from specific Geographic location(s).

To block or permit traffic based on their Geographic location(s), this is when the FortiGate Geo-IP Database needs to be as accurate as it can, and one way to ensure this is by making sure the unit Geo-IP Database is up-to-date.

FortiGate.

1. Use the command below to check which version of Geo-IP DB is installed on the FortiGate.

diagnose autoupdate versions | grep "IP Geography" -A 6

IP Geography DB
---------
Version: 3.00319
Contract Expiry Date: n/a
Last Updated using scheduled update on Wed Feb 18 11:51:06 2026
Last Update Attempt: Thu Feb 19 07:51:01 2026
Result: No Updates

Note:

The latest IP Geolocation Database version can be verified from the FortiGuard site.

2. If the Geo-IP DB is out of date, run below command to update manually:

execute update-geo-ip

3. To allow or block traffic based on Geo-IP, create the geography-based Firewall Address and use it in the Firewall Policy. Go to Policy & Objects -> Addresses -> Create New then fill in the required information. Set Address Type to Geography and select the required country from the drop down list.

To use the Geo-based Firewall Address in the Policy:

In this example, traffic is set to DENY from a specific country (CZ) to FortiGate dmz from Internet (wan1), and from dmz to Internet (wan1).

Go to Policy & Objects -> Firewall Policy -> Create New and set the Source or Destination to the geography-based firewall address.

• Block from Internet (wan1) to DMZ:

• Block from DMZ to Internet (wan1):

If the traffic needed to be allowed or blocked from specific geographic location(s) is bound to one of the FortiGate interfaces, configure a local-in-policy instead of a firewall policy.

Note:

This feature needs to be enabled under System -> Feature Visibility -> Local In Policy. Custom local-in policies can be configured from the GUI starting v7.6.0. For lower firmware versions, local-in-policies are only configurable via CLI.

Refer to the example below where traffic is denied from Geo-IP address 'CZ' from the wan1 interface to all:

Related article:

Technical Tip: How to update the GeoIP database