Cannot Block Country

[buntha]

Dear Everyone,   I have been create policy to block Country, That country is china because of many attack source from china, but after create policy to block i still see traffic from china again. Could you please check this problem for me ?    

[EMES]

If you are trying to block inbound traffic to your servers then you need to go into the cli and set some commands Config firewall policy Edit <policyid> Set match-vip enable Next End

[buntha]

Dear sir,

Noted with thank, I will try for your solution but could you tell me why we need to add more command to block country ? Because Policy already create to block Geography oh in policy not completed block Geography ?

Best Regard,

Buntha 

[EMES]

The reason is the firewall matches vips first in security policy and without that command set it will never match this policy. It will find your cup policies first.

[balcobulls]

Emes is exact on this one.  You can have a Geo-location block policy going to destination of ALL, if 

set match-vip enable

is not enabled, you will see a lot of 0 packets.