Creating Geo IP Policies

Before You Begin

• You must have a Sky ATP account to receive Geo IP feeds. Make sure you configure the necessary steps for Sky ATP before creating a Geo IP policy.
• Geo IP filtering is a useful tool when you are experiencing certain types of attacks, such as DDOS from specific geographical locations.
• If you are using Sky ATP without Policy Enforcer, you must select your Geo IP policy as the source and/or destination of a firewall rule to apply it.

Procedure

1. Select Configure>Shared Objects>Geo IP.
2. Click the + icon.
3. Complete the configuration by using the guidelines in Table 185 below.
4. Click OK.

Procedure

1. In the Group column, click the Assign to Groups link that appears here when there are no groups assigned or click the group name that appears in this column to edit the existing list of assigned groups.
2. In the Assign to Groups page, select the check box beside a group in the Available list and click the > icon to move it to the Selected list. The groups in the Selected list will be assigned to the policy.
3. Click OK.
4. Once one or more groups have been assigned, a Ready to Update link appears in the Status column. You must update to apply your new or edited policy configuration. Clicking the Ready to Update link takes you the Threat Policy Analysis page. See Threat Policy Analysis Overview. From there you can view your changes and choose to Update now, Update later, or Save them in draft form without updating.
5. If you are using Sky ATP without Policy Enforcer, you must select your Geo IP policy as the source and/or destination of a firewall rule. Navigate to Configure > Firewall Policy > Policies.

Related Documentation

• Creating Policy Enforcement Groups
• Creating Threat Prevention Policies
• Threat Policy Analysis Overview
• Geo IP Overview
• Infected Hosts Overview
• Command and Control Servers Overview
• Configuring Cloud Feeds Only