Monitor Geolocation Activity
Geolocation of Allowed Connections
From Fireware Web UI and Firebox System Manager, you can see Geolocation statistics, which include the total number of source and destination IP addresses that were scanned, and the number of connections blocked based on source or destination IP address. You can also see the version information of your Geolocation database and manually update the database to the latest version.
Select Dashboard > Subscription Services.
Select the Subscription Services tab.
For more information about these statistics, see Geolocation Statistics.
Geolocation IP Address Lookup
From the Subscription Services tab in Firebox System Manager you can look up the country and continent of an IP address.
To look up the location of an IP address, from the Subscription Services tab:
- In the Geolocation section, click Look Up IP.
The Geolocation IP Address Lookup dialog box appears.
- In the IP Address text box, type an IP address.
- Click Look Up.
The results appear in the Recent Results section.
You can also look up the location of an IP address from the Geolocation Dashboard in Fireware Web UI. For more information, see Geolocation Dashboard.
Geolocation Log Messages
Your Firebox generates a log message when Geolocation blocks a connection based on the geographic location of the source or destination. Geolocation log messages indicate whether the connection was blocked based on the geographic location of the connection source or destination, and include the country abbreviation. For example, this log message shows a connection denied based on the geographic location of the destination:
2018-10-05 11:34:06 Deny 10.0.1.3 22.214.171.124 https/tcp 60183 443 1-Trusted 0-External blocked sites (geolocation destination) 52 127 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0173" tcp_info="offset 8 S 3686646637 win 8192" geo_dst="GBR" geo="geo_dst"
When Geolocation is enabled, all traffic log messages show the destination or source of the connection external to the Firebox.
In Traffic Monitor, you can filter the log messages for information about connections blocked by Geolocation.
- To see log messages for all connections blocked by Geolocation, search for: geo=
- To see log messages for connections blocked based on the source, search for: geo="geo_src"
- To see log messages for connections blocked based on the destination, search for: geo="geo_dst"
For more information about how to see and filter log messages in Fireware Web UI, see Traffic Monitor.
For more information about how to see and filter log messages in Firebox System Manager, see Device Log Messages (Traffic Monitor).