Overview: Controlling application use by geolocations¶
Geolocation software can identify the geographic location of a client or web application user. Geolocation refers either to the process of assessing the location, or to the actual assessed location.
For applications protected by WAF, you can use geolocation enforcement to restrict or allow application use in specific countries. You adjust the lists of which countries or locations are allowed or disallowed in a security policy. If an application user tries to access the web application from a location that is not allowed, the Access from disallowed GeoLocation violation occurs. By default, all locations are allowed, and the violation learn, alarm, and block flags are enabled.
Requests from certain locations, such as RFC-1918 addresses or unassigned global addresses, do not include a valid country code. The geolocation is shown as N/A in both the request, and the list of geolocations. You have the option to disallow N/A requests whose country of origination is unknown.
If BIG-IP Next is deployed behind a proxy, you might need to set the Trust XFF Header option in the security policy properties. Then the system identifies the location using the address from the XFF header instead of the source IP address.