Using geographical information in policy enforcement

摘要

Using geographical information in policy enforcement is disclosed. A request for a resource is received from a device. A policy to be applied to the request is determined based at least in part on geographical information associated with an IP address. The policy is enforced. The IP address may be either a source IP address or a destination IP address.

主权项

1. A system, comprising:
a first interface configured to receive a set of rules to be applied to network traffic, wherein a first rule included in the set of rules includes a first geolocation, and wherein the first geolocation corresponds to at least one of: (1) a country identifier, and (2) an identifier of a user-defined region; a second interface configured to receive, from a device having an associated source IP address, a request to access a resource, wherein the resource has an associated destination IP address; a processor configured to:
determine that the first rule should be applied to the request, at least in part by determining that at least one of the source IP address and the destination IP address is present in a first IP address-geolocation mapping stored in a data store; andapply the first rule to network traffic associated with the request; and a memory coupled to the processor and configured to provide the processor with instructions.