close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Set Up
- play_arrow Juniper Advanced Threat Prevention Cloud Overview
  - Juniper Advanced Threat Prevention Cloud
- play_arrow Enroll SRX Series Firewalls to Juniper Advanced Threat Prevention Cloud
  - Enroll an SRX Series Firewall Using the CLI
  - Cloud Feeds for Juniper ATP Cloud
- play_arrow Configure Security Policies on SRX Series Firewall
- play_arrow Configure SRX Series Firewall
play_arrow Configure
- play_arrow Configure ATP Cloud Features on SRX Series Firewall
- play_arrow Configure AI Predictive Threat Prevention on SRX Series Firewall
play_arrow Configuration Statements and Operational Commands
- play_arrow SRX Series Firewall Commands to Configure Juniper ATP Cloud
  - SRX Series Firewall Commands to Configure Juniper ATP Cloud
play_arrow Use Cases
- play_arrow SecIntel Feeds for MX Series Routers
  - Configure SecIntel Feeds for MX Series Routers
- play_arrow Amazon Web Services GuardDuty with vSRX Virtual Firewall
  - Integrate AWS GuardDuty with vSRX Virtual Firewall
- play_arrow Juniper ATP Cloud with Policy Enforcer
  - How to Enroll Your SRX Series Firewalls in Juniper ATP Cloud Using Policy Enforcer
play_arrow Troubleshoot
play_arrow More Documentation
- play_arrow Additional Documentation on Juniper.net
  - Links to Documentation on Juniper.net

list Table of Contents

English

keyboard_arrow_right

Configure Juniper Advanced Threat Prevention Cloud With Geolocation IP

date_range 04-Sep-24

arrow_backward

arrow_forward

To configure Juniper ATP Cloud with GeoIP, you first create the GeoIP DAE and specify the interested countries. Then, create a security firewall policy on the SRX Series Firewall to reference the DAE and define whether to allow or block access.

To create the GeoIP DAE and security firewall policy:

Create the DAE using the set security dynamic-address CLI command. Set the category to GeoIP and property to country (all lowercase). When specifying the countries, use the two-letter ISO 3166 country code in capital ASCII letters; for example, US or DE. For a complete list of country codes, see ISO 3166-1 alpha-2. Table 1 lists the additional codes that are not part of ISO 3166-1 alpha-2.

Table 1: Additional Codes
Code	Country	Additional Information
A1	Anonymous Proxy	This country code identifies a set of IP addresses used by specific anonymous proxies or VPN services. These types of services may be used to bypass GeoIP restrictions. Note: This country code does not provide complete coverage of all proxy traffic. It identifies the traffic for specific legal anonymous proxies.
A2	Satellite Provider	This country code identifies a set of IP addresses used by Satellite ISPs to provide Internet service to multiple countries. Examples: Nigeria and Ghana.
AP	Asia/Pacific Region	This country code identifies a set of IP addresses that are spread out through the Asia/Pacific region. The country of origin for this set of IP addresses is unknown. Note: This country code consists of a small subset of IP addresses in the Asia/Pacific region.
EU	Europe	This country code identifies a set of IP addresses that are spread out through Europe. The country of origin for this set of IP addresses is unknown. Note: This country code does not cover all IP addresses in Europe.
VA	Vatican City State
AS	Asia
OC	Oceania

In the following example, the DAE name is my-geoip and the interested countries are the United States (US) and Great Britain (GB).

content_copy zoom_out_map
set security dynamic-address address-name my-geoip profile category GeoIP property country string US
set security dynamic-address address-name my-geoip profile category GeoIP property country string GB

Use the show security dynamic-address CLI command to verify your settings. Your output should look similar to the following:

content_copy zoom_out_map
show security dynamic-address
address-name my-geoip {
    profile {
        category GeoIP {
            property country {
                string US;
                string GB;
            }
        }
    }
}

Create the security firewall policy using the set security policies CLI command.
In the following example, the policy is from the untrust to trust zone, the policy name is my-geoip-policy, the source address is my-geoip created in Step 1, and the action is to deny access from the countries listed in my-geoip.
```
set security policies from-zone untrust to-zone trust policy my-geoip-policy match source-address my-geoip destination-address any application any
set security policies from-zone untrust to-zone trust policy my-geoip-policy then deny
```

Use the show security policies CLI command to verify your settings. Your output should look similar to the following:

content_copy zoom_out_map
show security policies
...
from-zone untrust to-zone trust {
    policy my-geoip-policy {
        match {
            source-address my-geoip;
            destination-address any;
            application any;
        }
        then {
            deny;
        }
    }
}

...

Import the category feeds to the dynamic address using the set dynamic address CLI command.
In the following example, the source address is my-geoip created in Step 1 and the action is to import feeds under the GeoIP category to the dynamic address.
```
set security dynamic-address address-name my-geoip profile category GeoIP feed fd property country string US
```
Use the show security dynamic-address CLI command to verify your settings. Your output should look similar to the following:
```
show security dynamic-address
...
address-name my-geoip {
    profile {
        category GeoIP {
            property country {
                string US;
            }
        }
    }
}
address-name my-geoip {
    profile {
        category GeoIP {
            feed fd;
            property country {
                string US;
            }
        }
    }
}
```
Deleting GeoIP-based Dynamic Addresses for a Single Country Code

You can delete GeoIP-based dynamic addresses for a single country code using the following step:
delete security dynamic-address address-name address-name profile category GeoIP property country string CA
In the following example, the DAE name is my-geoip and the country codes you want to delete are—United States (US) and Great Britain (GB).
delete security dynamic-address address-name my-geoip profile category GeoIP property country string US delete security dynamic-address address-name my-geoip profile category GeoIP property country string GB
Above step deletes country successfully from the profile without affecting the other country entries.

After you delete the country code, you can confirm the deletion using the show security dynamic-address command.

show security dynamic-address
node0: -------------------------------------------------------------------------- Instance default Total number of matching entries: 0 No. IP-start IP-end Feed Address CountryCode 1 1.0.0.0 1.0.0.255 geoip_country my-geoip1 AU 2 1.0.0.0 1.0.0.255 geoip_country my-geoip2 CN

Juniper ATP Cloud with GeoIP provides improved consistency checks and logging from SRX Series Firewalls that are enrolled with Juniper ATP Cloud.

The session deny message includes the following fields:

source-country—Displays the country code of the source address with reference to the policy dynamic address match.
destination-country—Displays the country code of the destination address with reference to the policy dynamic address match.

The system log message displays the valid country code only if the matched policy includes a dynamic address configured with GeoIP. If the matched policy does not have GeoIP configured, then the source-country and destination-country fields display N/A. See System Log Explorer for more details.

arrow_backward PREVIOUS Geolocation IPs and Juniper Advanced Threat Prevention Cloud

NEXT arrow_forward Configure IPFilter Category

Juniper ATP Cloud Administrator Guide

Configure Juniper Advanced Threat Prevention Cloud With Geolocation IP

Deleting GeoIP-based Dynamic Addresses for a Single Country Code

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Juniper ATP Cloud Administrator Guide

Configure Juniper Advanced Threat Prevention Cloud With Geolocation IP

Deleting GeoIP-based Dynamic Addresses for a Single Country Code

Related Documentation

Stay in touch