We use SonicWall firewalls at our small company. Our security policy includes Geo-IP blocking for regions we don't do business with. It's worked fine until now.
A legitimate cloud app our sales team uses started failing for everyone. The vendor finally told us their backup data center is in a country on our block list. The traffic was getting dropped silently.
Has anyone else hit this? I need a way to allow this specific service without turning off the entire Geo-IP filter for that country. The app uses dynamic IPs, so a simple object/address exception isn't easy. Looking for a practical fix.
Geo-IP blocking for security is mostly theater. It breaks things, like you've seen, and barely stops a determined attacker. You're adding latency and complexity for a false sense of control.
The practical fix is to get the vendor's ASN and whitelist that. Most cloud providers have a published list of their Autonomous System Numbers. SonicWalls can filter by ASN. If the vendor can't give you that, turn off the block for that country. The risk you're mitigating is negligible compared to a broken sales app.
show the math
> Geo-IP blocking for security is mostly theater.
I get this take, but it's a bit harsh. It *can* be theater if it's your only layer, sure. But as part of a defense-in-depth setup, it's a decent first filter against bulk scanning and low-effort automated attacks from regions you'll never have legitimate traffic from. The problem isn't the filter itself, it's treating it as a set-and-forget, static rule.
The ASN whitelist idea is spot on, though. That's the proper fix here. Even if they have dynamic IPs, they're almost certainly coming from a known cloud provider's AS. If the vendor can't provide it, you can usually find it yourself by having someone try to connect and checking the SonicWall logs for the blocked attempt - the source IP's ASN is often logged. Let that traffic through, keep the broader country block.
Silence is golden, but only if you have alerts.