USG40 Geo IP Not Working

enpingado

my USG-40 does not appear to be blocking based on Geo IP.

i have FW 4.65(AA 1), Geo IP date is 8-17-21

i create object for russia, used the geography setting.
then made policy as 1st rule to Deny, From Any, To Any Source-russia, Log
And i dont see anything in the log blocking traffic. 
But i see the Default Rule Denying Russia labeled IPs in the log. 

Why is my rule not blocking it?
Do i need to reboot after making new rules?

gb5102

@enpingado

Add a 2nd rule below the first one you created:

From: Any

To: ZyWALL

Source: russia

Action: Deny/log

Reboot is not required for new rules to take effect.

PeterUK

You need both.

From any to ZyWALL only blocks to the USG like remote login (if you have a rule to allow that) and VPN.

From any to any (except ZyWall) blocks like a NAT rule to a server for WAN to LAN and LAN to WAN

gb5102

@enpingado

Add a 2nd rule below the first one you created:

From: Any

To: ZyWALL

Source: russia

Action: Deny/log

Reboot is not required for new rules to take effect.

enpingado

great that worked perfect. So are two rules neccesary or just one?

I see some suspect IP scanning different ports on my public static IP.
Do i only need to block using rules with To=ZyWALL or both ZyWALL and other rule for Any(except ZyWall)?

PeterUK

You need both.

From any to ZyWALL only blocks to the USG like remote login (if you have a rule to allow that) and VPN.

From any to any (except ZyWall) blocks like a NAT rule to a server for WAN to LAN and LAN to WAN

enpingado

great thanks!