Users report seeing 403 errors with verdict "tcp_error_geoip_restricted" despite no changes in the configuration

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users report seeing sporadic 403 blocks accessing some common sites with the verdict of "tcp_error_geoip_restricted".

GEO restricted policies do exist for certain countries e.g. Saudi Arabia, but none of the sites appeared to be located there. In fact, the access logs reported the destination country as United States.

Issue started around 10am local time without any changes to the UPE managed Cloud SWG configuration; no scheduled Cloud SWG maintenance activities were documented for this time either.

Running a query of all "tcp_error_geoip_restricted" verdicts and showing the Appliance name confirmed that the block was triggered by multiple Cloud Proxy servers and not a single one, reducing the likelihood of a GEO database issue on the proxy.

Looking at all the IP addresses associated with the blocked sites, everyone of them appeared to be registered with CloudFlare. CloudFlare status page did indicate a maintenance event in and around the time the issue started, but the details of the event did not match what we would have expected (update to service in the US, when impacted users were in UK and Canada).

Environment

Cloud SWG.

UPE.

GEO policies blocking access to certain destination countries.

Cause

CloudFlare GEO locating destination IPv6 sites in a blocked country.

Cloud SWG can communicate with destination sites via IPv4 or IPv6 - issue happened when communicating using IPv6.

 

 

Resolution

Disabled IPv6 egressing feature for the tenant so that IPv4 always used to communicate with the back end (a ticket with Broadcom support is needed for this action).

Additional Information

Although the access log entries showed IPv4 destination addresses, along with the correct country, a policy trace when the issue happened confirmed that the proxy was attempting to connect using IPv6 destination IP addresses (not the logged IPv4 address) and that maxmind had GEO located this destination IP address in one of the blocked countries.

supplier.ip:
supplier.country: None
supplier.failures: "2001:db8:ffff:ffff::|Saudi Arabia|denied;2001:db8:ffff:ffff::|Saudi Arabia|denied"

This information was not available in the access logs for the blocked request.