Hey folks — been tinkering with Ping’s geo-based access rules for a client project and wanted to share our step-by-step setup. We had a requirement to block access from certain countries for compliance reasons, while allowing specific IPs from those regions (think contractors or traveling employees). Here’s how we pieced it together using PingFederate and PingAccess.
First, we mapped out the logic:
- Default policy: deny access from a blocked country list.
- Exception: allow if the IP matches a whitelist (even if from a blocked country).
- Fallback: if geo-IP lookup fails, require step-up authentication (better safe than sorry).
The core configuration happened in PingAccess:
1. **Created a new policy** under Access Control → Rules.
- Used the “Location” condition set to pull from the MaxMind GeoIP2 database (Ping has built-in support).
- Added countries like `RU`, `CN`, `BR` to the “blocked” list.
2. **Built an IP whitelist** as a separate rule.
- Added CIDR ranges for our known safe IPs (e.g., corporate VPN exit nodes).
- Set the rule order so the whitelist evaluates *before* the country block.
3. **Added a final catch-all rule** for “unknown” locations that triggered a second-factor prompt.
A couple of things we learned the hard way:
- The order of rules is critical — PingAccess evaluates top-down, so whitelists need to be higher up.
- Geo-IP data isn’t perfect. We saw some legitimate users flagged incorrectly, so we added a low-friction “report access issue” link that logged their IP for review.
- If you’re using cloud proxies (like Cloudflare), make sure Ping is configured to use the original client IP header, not the proxy’s IP.
Has anyone else set up something similar? Curious how you handled:
- Users who travel frequently — did you create a self-service portal for temporary access requests?
- Performance impact — we didn’t see latency spikes, but our traffic volume is moderate.
Overall, it’s been solid for about six months. The logging is detailed enough to audit, and we’ve avoided any compliance headaches. Definitely recommend testing in monitor-only mode first if you can.
✌️
✌️