How to resolve mismatch of country-IP mapping?

How to resolve mismatch of country-IP mapping?

Created On 10/08/19 20:39 PM - Last Modified 03/18/20 02:25 AM

Sometimes country ip mapping on Firewall does not match the actual GeoLocation of the IP Address. The article explains how to correct the same.

  • Any PAN-OS.
  • Any Panorama.

  1. Make sure device is updated with the last content version.
  2. Run show location ip  <ip address>  command to check the Geolocation indicated by the firewall. Example below.
    >show location ip  
    United Kingdom
  3. Check the actual Geolocation of the IP address using external websites. Some listed below.
  4. If the result of external website and the result on the Firewall do not match, Content version needs to be fixed. Create the support TAC case for fixing the problem. 
  5. As a work around till the content version is fixed,  create a custom region with the correct location. ( GUI:Object > Regions

                            User-added image

Additional Information
IP-to-country-mapping is updated in weekly content loads. PAN-OS performs IP Address Region (Country) Mapping through an internal database which is updated weekly via content updates.

  • Print
  • Copy Link