GeoBlocking Hong Kong

gsandlin@elevate.com

We had been under the impression that by enabling a Geoblock rule in the Client Connectivity Policy for Hong Kong, that would prevent any of our travelling users from connecting to a Hong Kong PoP.

I have been informed by Cato support that this is not the case.

"Regarding Hong Kong specifically, Hong Kong is not a Chinese PoP in Cato's architecture. It is a separate PoP that acts as a proxy/gateway for Chinese PoPs, and it is reachable by users globally and this cannot be controlled via the Client Connectivity Policy's Countries condition."

We were also under the belief that by Geo-blocking countries, a user could not connect to a PoP in that country - this is apparently also not the case; If the user originates in an allowed country, then they are allowed to connect to a PoP in a Geo-blocked country.

This may become a compliance issue for us.

ebabiano

Hi Gordon

Thanks for joining the PS AMA session yesterday and all your interesting questions. I was not hosting the event, but I was present there, so I would like to add some details about your question.

Regarding the Geo-restriction features in Cato, we have different control points:

• IPS: we can detect and block IPs from/to specific countries. In this case, Hong Kong and Chinese are different countries. This traffic does not apply to inbound SDP user connection, so it need to be managed in the CCP (Client Connectivity Policy).
• Client Connectivity Policy: you can block users from connecting from a specific country based on the public source IP, but this cannot control to which PoP the user is connecting. So by default all the PoP are available for any user.
• WAN & Internet Firewall: you can create more granular control of traffic based also on the source country where the user is located.

Apart of that, and if you really need to avoid certain Cato PoPs to be used, I recommend to open a Support Case, so they can evaluate the possibility to exclude some PoPs from your algorithm.

You can check more info here:

• https://knowledge.catonetworks.com/docs/configuring-ips-and-geo-restriction
• https://knowledge.catonetworks.com/docs/configuring-the-ips-policy#defining-geo-restriction-rules
• https://knowledge.catonetworks.com/docs/configuring-the-client-connectivity-policy
• https://knowledge.catonetworks.com/docs/recommendations-for-internet-and-wan-firewall-policies
• https://knowledge.catonetworks.com/docs/adding-device-conditions-to-firewall-rules#adding-country-requirements
• https://knowledge.catonetworks.com/docs/cato-client-pop-selection

Hope this helps!