[c-nsp] Firepower Threat Defense Geolocation DB

[Justin Krejci]

Also it doesn't hurt to otherwise advertise your 8805 geofeed as per:
https://datatracker.ietf.org/doc/html/rfc9092


-----Original Message-----
From: Hank Nussbacher via cisco-nsp <cisco-nsp at puck.nether.net<mailto:Hank%20Nussbacher%20via%20cisco-nsp%20%3ccisco-nsp at puck.nether.net%3e>>
Reply-To: Hank Nussbacher <hank at interall.co.il<mailto:Hank%20Nussbacher%20%3chank at interall.co.il%3e>>
To: cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
Subject: Re: [c-nsp] Firepower Threat Defense Geolocation DB
Date: Wed, 27 Mar 2024 16:54:26 +0200

On 26/03/2024 17:29, Jon Lewis via cisco-nsp wrote:

Find out from Cisco where you can publish your geo-location data as per:
https://www.rfc-editor.org/rfc/rfc8805.html

If it is Google related, report the issue here:
https://support.google.com/websearch/workflow/9308722?hl=en
or define your geo-feed for Google here:
https://isp.google.com/geo_feed/

Also test here:
https://geolocatemuch.com/

Regards,
Hank


I've been going back and forth with cisco support for 2 weeks on this
and gotten nowhere.  Does anyone know of a way to verify (and update if
needed) Cisco's IP Geo data for the FTD platform?  I've been trying to
get support to let me download the DB files from

https://software.cisco.com/download/home/286322194/type/286321931/release/GeoDB

but as I don't have the appropriate service contract, that seems to not
be happening.

We have an IP block (57.135/16) that is former RIPE space.  We've had
some IP Geo issues with it, but thought those were behind us.  Recently,
we've run into IP Geo based filtering/redirection issues with this
space.  The first was a network that admitted it was an issue with their
FTD blocking our traffic & needing an update.  So, I assume the latest
IP Geo data from cisco has 57.135/16 correctly listed as ARIN/US, but
I'd like to be sure of that and also look back at past versions of the
DB to see how far behind someone needs to be to have it listed as
RIPE/EU space.

----------------------------------------------------------------------
  Jon Lewis, MCP :)              |  I route
  Blue Stream Fiber, Sr. Neteng  |  therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/