Jump to content


Photo

WAF Incorrect IP Geo-Location Processing


  • Please log in to reply
1 reply to this topic

#1 Dale

Dale
  • Members
  • 19 posts

Posted 11 January 2019 - 10:36 AM

We've been using the Geo-IP feature within our Barracuda WAF (running firmware version 9.1) to deny access to some of our services from anywhere except the UK. We're aware that this does not account for those using a VPN or other method to circumvent this, however it's a requirement that we need to fulfil. It's been working well for the last month or so, however this week we've had a member of staff blocked by the WAF for allegedly being in a different country (Norway in this case). I obtained his IP address and put it in a number of different online geo-ip searchers which all returned the UK as the country. This was confirmed by the member of staff who was sat at home in the UK at the time. Putting the IP into the checker on the WAF returns Norway, which is obviously why it's being blocked.

 

My question is, which geo-ip processor does the WAF use to determine the location of an IP address? Can this be modified or updated to ensure that the locations are correct? I'm well aware that the location of an IP address will never be 100% accurate, but it's a bit annoying that the WAF can't seem to even get he country right, which reduces my confidence in the whole of the IP reputation features of the device. 

 

Many thanks in advance. 



#2 Nitzan Miron

Nitzan Miron
  • Moderators
  • 9 posts

Posted 11 January 2019 - 07:11 PM

Hi Dale!

 

Our location database is gathered from multiple sources, so I can't give you a direct answer to your question.  However, I can tell you that in firmware version 9.2 we updated the databases to significantly improve accuracy.  My first suggestion would be to upgrade your firmware to 9.2 - this fixed the problem for all our other customers who experienced this kind of issue.

 

If you don't mind, I'd like to know the IP address in question so I can confirm that the 9.2 database is showing it correctly.  I don't suggest you put that information in this public forum, but if you could kindly contact Barracuda Support (https://www.barracuda.com/support) and provide us with that information, I can take a look at it.

 

Thanks for your message!