> Source: [sk126172](https://support.checkpoint.com/results/sk/sk126172)

# sk126172 - Configuring Geo Policy with Updatable Objects

| Property | Value |
|----------|-------|
| Solution ID | sk126172 |
| Date Created | 2018-06-06 |
| Last Modified | 2026-07-20 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |

## Cause



## Solution

### Background

Check Point's Geo servers download the updated database from Geo IP locations cloud feeders daily. Right after the download, a new **IPToCountry.csv** file is generated and pushed to customers with the new Geo location classifications.

**Starting from R81** , the Geo Policy page is hidden in SmartConsole \> Security Policies \> Shared Policies if no Geo rules are configured. Geo Policy is now supported through Updatable Objects in the Access Control Policy.  
The Legacy Geo Policy is deprecated and is supported only for customers who upgraded their Management server from a previous version.

In versions R80.20 and higher, we recommend configuring Geo Protection only with the Updatable Objects.

If it is necessary to show the Geo Policy section:  
**Show / Hide the section**   
1. Close SmartConsole.
2. Connect to command line on the Management Server.
3. Log in to the Expert mode.
4. On Multi-Domain Management Server, go to the context of the relevant Domain Management Server:  
   `mdsenv <IP Address or Name of Domain Management Server>`
5. Run:  
   `$FWDIR/scripts/reload_env_vars.sh -e "disableHiddenGeoPolicy=1"`
6. Connect with SmartConsole to the Security Management Server / Domain Management Server.

If it is necessary to hide the Geo Policy section again:  
**Show / Hide the section**   
1. Close SmartConsole.
2. Connect to the command line on the Management Server.
3. Log in to the Expert mode.
4. On a Multi-Domain Management Server, go to the context of the relevant Domain Management Server:  
   `mdsenv <IP Address or Name of Domain Management Server>`
5. Run:  
   `$FWDIR/scripts/reload_env_vars.sh -u "disableHiddenGeoPolicy"`  
   **Note:** You can see the environment variables' current setting in the file *$MDS_FWDIR/conf/dynamic_system_env*.
6. Connect with SmartConsole to the Security Management Server / Domain Management Server.

<br />

### Configuration

* **In Management Servers R80.20 and higher**

  For each continent/country, Check Point provides an Updatable Object that you can use in SmartConsole.

  Each continent/country object matches a list of IP addresses based on the database that is provided to Check Point from the Geo classification.

  After every update in the provider database, these Updatable Objects are updated automatically on the managed Security Gateways and Clusters (it is not necessary to install policy).

  When the traffic's source or destination IP address matches a Network object in the rule, the traffic is processed based on the "Action" selected in the corresponding rule.

  Procedure:
  1. Connect with SmartConsole to the Security Management Server / Domain Management Server.
  2. From the left navigation panel, click **Security Policies**.
  3. In the **Access Control** section, click **Policy**.
  4. In the relevant rule, click in the **Source** or the **Destination** column \> click the **\[+\]** icon in the cell.
  5. In the top right corner, click **Import** \> **Updatable Objects.**
  6. Select the applicable continent/country from the list of objects in the **Updatable Objects** window.
  7. Click **OK**.
  8. Publish the session.
  9. Install the Access Control policy.

  **Note** - Updatable Objects support IPv6 traffic.

  Example of Geo Updatable Objects in the "Source" column (rule 3) and the "Destination" column (rules 1 and 2):

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk126172/Untitled202305242047051.png)
* **In Management Servers R80.10 and lower**

  To restrict access to/from a specific continent/country based on IP addresses, it is necessary to add them to the rule as "Host" objects and install the security policy after each change.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content