Mailing List Archive

Firepower Threat Defense Geolocation DB
I've been going back and forth with cisco support for 2 weeks on this and
gotten nowhere. Does anyone know of a way to verify (and update if
needed) Cisco's IP Geo data for the FTD platform? I've been trying to get
support to let me download the DB files from

https://software.cisco.com/download/home/286322194/type/286321931/release/GeoDB

but as I don't have the appropriate service contract, that seems to not be
happening.

We have an IP block (57.135/16) that is former RIPE space. We've had some
IP Geo issues with it, but thought those were behind us. Recently, we've
run into IP Geo based filtering/redirection issues with this space. The
first was a network that admitted it was an issue with their FTD blocking
our traffic & needing an update. So, I assume the latest IP Geo data from
cisco has 57.135/16 correctly listed as ARIN/US, but I'd like to be sure
of that and also look back at past versions of the DB to see how far
behind someone needs to be to have it listed as RIPE/EU space.

----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
Blue Stream Fiber, Sr. Neteng | therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: Firepower Threat Defense Geolocation DB [ In reply to ]
On 26/03/2024 17:29, Jon Lewis via cisco-nsp wrote:

Find out from Cisco where you can publish your geo-location data as per:
https://www.rfc-editor.org/rfc/rfc8805.html

If it is Google related, report the issue here:
https://support.google.com/websearch/workflow/9308722?hl=en
or define your geo-feed for Google here:
https://isp.google.com/geo_feed/

Also test here:
https://geolocatemuch.com/

Regards,
Hank


> I've been going back and forth with cisco support for 2 weeks on this
> and gotten nowhere.  Does anyone know of a way to verify (and update if
> needed) Cisco's IP Geo data for the FTD platform?  I've been trying to
> get support to let me download the DB files from
>
> https://software.cisco.com/download/home/286322194/type/286321931/release/GeoDB
>
> but as I don't have the appropriate service contract, that seems to not
> be happening.
>
> We have an IP block (57.135/16) that is former RIPE space.  We've had
> some IP Geo issues with it, but thought those were behind us.  Recently,
> we've run into IP Geo based filtering/redirection issues with this
> space.  The first was a network that admitted it was an issue with their
> FTD blocking our traffic & needing an update.  So, I assume the latest
> IP Geo data from cisco has 57.135/16 correctly listed as ARIN/US, but
> I'd like to be sure of that and also look back at past versions of the
> DB to see how far behind someone needs to be to have it listed as
> RIPE/EU space.
>
> ----------------------------------------------------------------------
>  Jon Lewis, MCP :)              |  I route
>  Blue Stream Fiber, Sr. Neteng  |  therefore you are
> _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: Firepower Threat Defense Geolocation DB [ In reply to ]
Also it doesn't hurt to otherwise advertise your 8805 geofeed as per:
https://datatracker.ietf.org/doc/html/rfc9092


-----Original Message-----
From: Hank Nussbacher via cisco-nsp <cisco-nsp@puck.nether.net<mailto:Hank%20Nussbacher%20via%20cisco-nsp%20%3ccisco-nsp@puck.nether.net%3e>>
Reply-To: Hank Nussbacher <hank@interall.co.il<mailto:Hank%20Nussbacher%20%3chank@interall.co.il%3e>>
To: cisco-nsp@puck.nether.net<mailto:cisco-nsp@puck.nether.net>
Subject: Re: [c-nsp] Firepower Threat Defense Geolocation DB
Date: Wed, 27 Mar 2024 16:54:26 +0200

On 26/03/2024 17:29, Jon Lewis via cisco-nsp wrote:

Find out from Cisco where you can publish your geo-location data as per:
https://www.rfc-editor.org/rfc/rfc8805.html

If it is Google related, report the issue here:
https://support.google.com/websearch/workflow/9308722?hl=en
or define your geo-feed for Google here:
https://isp.google.com/geo_feed/

Also test here:
https://geolocatemuch.com/

Regards,
Hank


I've been going back and forth with cisco support for 2 weeks on this
and gotten nowhere. Does anyone know of a way to verify (and update if
needed) Cisco's IP Geo data for the FTD platform? I've been trying to
get support to let me download the DB files from

https://software.cisco.com/download/home/286322194/type/286321931/release/GeoDB

but as I don't have the appropriate service contract, that seems to not
be happening.

We have an IP block (57.135/16) that is former RIPE space. We've had
some IP Geo issues with it, but thought those were behind us. Recently,
we've run into IP Geo based filtering/redirection issues with this
space. The first was a network that admitted it was an issue with their
FTD blocking our traffic & needing an update. So, I assume the latest
IP Geo data from cisco has 57.135/16 correctly listed as ARIN/US, but
I'd like to be sure of that and also look back at past versions of the
DB to see how far behind someone needs to be to have it listed as
RIPE/EU space.

----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
Blue Stream Fiber, Sr. Neteng | therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net<mailto:cisco-nsp@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net<mailto:cisco-nsp@puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/