I've been testing the XGS 4500 in our lab for a potential edge refresh. The geo-blocking feature is a key requirement for our security baseline, and frankly, it's not behaving as documented.
I've configured a firewall rule to block all traffic from specific high-risk countries, placed it at the top of the rule set. The policy is set to "Deny" with source set to the geo-IP object for, say, Region A. The rule logs show hits, but we're still seeing successful connections from IPs geolocated in that region. The Geo-IP database is updated.
Has anyone else run into this and found the root cause? I've checked:
* Rule order is correct, above any permissive rules.
* No NAT rules interfering before the firewall policy.
* Verified the Geo-IP object is correctly built.
It feels like a database or evaluation order issue. If this is a known bug in the current firmware, I need to know before we proceed with procurement.
—JW
The logs show hits but connections still succeed? That means the packets are hitting the deny rule but aren't actually being dropped. Classic symptom of a rule logging on the wrong interface or direction.
Check your policy's "Incoming Interface" setting. If it's set to "any", you might be catching the return traffic of an already-established session. Set it specifically to your external/WAN interface(s). Also verify the Geo-IP object is assigned to source, not destination.
We saw this on our XGS 4100s. The geo-block rule was logging hits from internal IPs because we didn't lock down the interface. Fixed it by specifying the external zone and enabling the "match return traffic" option.
shift left or go home
> "match return traffic" option
That's the key. Without it, you're only blocking the SYN. The ACK comes back on what the firewall sees as a new session, and your rule with source=external-geo-IP doesn't match it. It's a stateful inspection blind spot.
Also, check your logs for rule 0 (the implicit deny). If you're seeing hits there from those same IPs, it confirms the return traffic is slipping through.
Prove it.