Geography based addresses

Geography addresses are those determined by country of origin. The IP for the country or region is automatically determined from the Geography IP database.

To view IP Geography database:

#diagnose autoupdate versions | grep -A 6 "IP Geography DB"
IP Geography DB
---------
Version: 3.00152
Contract Expiry Date: n/a
Last Updated using manual update on Thu Nov 17 17:52:00 2022
Last Update Attempt: Wed Nov 23 10:56:46 2022
Result: No Updates

Without a valid license, local IP geography database will continue to work. However the FortiGate will stop receiving geography IP updates from the FortiGuard servers and the geography IP database will no longer be updated. IP geolocation service is part of base services included with all FortiCare support contracts. See FortiGuard Security Services for more information.

To create a geography address:

1. Go to Policy & Objects > Addresses.

2. Select Create New > Address.

3. In the Category field, choose Address.

4. Enter a Name for the address object.

5. In the Type field, select Geography from the dropdown menu.

6. In the Country/Region field, select a single country from the dropdown menu.

7. In the Interface field, leave as the default any or select a specific interface from the dropdown menu.

8. Enter any additional information in the Comments field.

9. Click OK.

Overrides

It is possible to assign a specific IP address range to a customized country ID. Generally, geographic addressing is done at the VDOM level; it could be considered global if you are using the root VDOM, but the geoip-override setting is a global setting.

config system geoip-override
    edit "test"
        set country-id "A0"
        config ip-range
            edit 1
                set start-ip 7.7.7.7
                set end-ip 7.7.7.8
            next
            edit 2
                set start-ip 7.7.10.1
                set end-ip 7.7.10.255
            next
        end
    next
end

While the setting exists in the configuration file, the system assigns the country-id option automatically and cannot be set or unset manually. While you can use "edit 1" and "edit 2", it is simpler to use "edit 0" and let the system automatically assign an ID number.

After creating a customized Country by using the geoip-override command, the new country name has been added automatically to the country list and will be available on the Firewall Address Country field.

Diagnose commands

There are a few diagnosis commands used with geographic addresses. The basic syntax is:

diagnose firewall ipgeo [country-list | ip-list | ip2country | override | copyright-notice]

Diagnose command	Description
country-list	List of all countries.
ip-list	List of the IP addresses associated with the country.
ip2country	Used to determine which country a specific IP address is assigned to.
override	List of user defined geography data; items configured with the config system geoip-override command.
copyright-notice	Shows the copyright notice.