Geo Blocking with SD-Wan enable

[AdrianR]

Hello, I want to make a policy with Geo Blocking in my wan port that's inside an SD-Wan interface, I tried to configure the policy with income interface SD-Wan but it doesn’t work, If I take out my wan from the SD-Wan and configure the policy with income interface wan it works correctly, how can I configure the policy using SD-Wan?

I tried looking online for the answer but couldn’t find anything with SD-Wan, thank for the help!

[scan888]

Hi Adrian

Acctually, it sould work.

After you add interface to the SD-WAN Interface you need to creat Firewall policies with the matching SD-WAN Interface.

For example:

config firewall policy
    edit 0
        set name "Internet to local System"
        set srcintf "virtual-wan-link" <!-- Your SD-WAN Interface -->
        set dstintf "<Dst. Interface>"
        set action accept
        set srcaddr "<your allowed GEO Object>"
        set dstaddr "<your VIP Object"
        set schedule "always"
        set service "ALL"
    next
end

[AdrianR]

Thanks for the quick replay scan888, I have my policy configure like this: 

When I have the Deny option enable I cant assign a VIP 

[scan888]

Hi @AdrianR 

Your Rule block any connections comming from your selected country to any hosts behind the "lan"-Switch.

I'm not sure, what exectly you would like to achive. Because this rule only helps if you have any VIP-Rules below that rule. If you have no forwardings from the Internet to your "lan"-Switch the implicit deny rule block the connections anyway.

[AdrianR]

That’s correct I’m trying to block any connections from those countries but it isn’t working, I’m still able to access from those countries.

[scan888]

Enable logging an all rules and check the log in the "Log & Report" section. for all allowed traffic you see the corresponding rule id.

Double check, if you have no allow police above this rule.

Otherwise use the debug commands:

diag debug enable
diag debug flow filter addr <your destination ip>
diag debug flow filter port <your testing port>
diag debug flow trace start 10

Produce test traffic and check which firewall policy is allowing the traffic.

[AdrianR]

Scan888 thanks a lot for taking the time to help me, I tried the commands but didn't see any output in my test:
 

But the policy accepting the traffic is the one below:

I even tried to block all incoming traffic with "all" as source but doesn't work:

[AEK]

Try put your interface in sd-wan again but keep the policy with the original wan interface (not sd-wan).

[AdrianR]

Hello AEK the SD-WAN configuration won’t let me add the wan interface back in because it’s been use by the original policy with wan interface as incoming interface.

[AEK]

Hello Adrian

Which FOS version?