Editing the GeoIP database in FortiGate

Forum|Forum|4 years ago
March 1, 2022
2 replies
5284 views

I can create a GeoIP and select a country to distribute the rules to the region at once. But what if I want to add or exclude some addresses in this list? I have Fortigate-600D-LENC (that is, it is not connected to cloud services and auto-updates) and I have not found a way to view the database of addresses included in the GeoIP of a particular country.

FortiGate

Best answer by akristof

Hello,

Thank you for your question. You can manually override that specific IP range will belong to different country:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Commands-to-verify-GeoIP-information-and/ta-p/190341

Or other option is to do it with 2 firewall policies:

First firewall policy will allow traffic with specific ranges that you want to allow.

Second policy will block access based on GEO-IP addresses.

amouawad

Staff

Hi Daniil,

This article shows the commands: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Commands-to-verify-GeoIP-information-and/ta-p/190341

akristofAnswer

Staff

Hello,

Thank you for your question. You can manually override that specific IP range will belong to different country:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Commands-to-verify-GeoIP-information-and/ta-p/190341

Or other option is to do it with 2 firewall policies:

First firewall policy will allow traffic with specific ranges that you want to allow.

Second policy will block access based on GEO-IP addresses.

DubosAuthor

Explorer II

Thank you, I think this is the maximum I can do in this situation. Of course, I have already figured out myself that you can add addresses to the policy manually, and without the ability to automatically determine the country of the address, it seems to me that it is easier to do this than using the console to specify the country.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded