Specifically the comment I replied to: @JessIT1 wrote: Source: 172-234-96-249.ip.linodeusercontent.com 172.234.96.249:39664   Destination: internal server   Allowed SSH_EVENT_SECURECRT https://snort.org/rule_docs/128-3 ... View more

I had the same threat actor hit my VPN this morning.  Same linode IP, same event "Allowed". ... View more

We had this exact same issue.  And no, we couldn't find a way around the country block. What we did find is that MaxMind had the IP GEO Location wrong.  The local IP block for our cdnfonts was also showing in Spain while all other GEO IP lookups were showing San Francisco. I would double check the IPs you are resolving with other Geo Location services and if MaxMind seems to be incorrect, open a support ticket asking Meraki to contact MaxMind and get the issue resolved. Ours took about 3 weeks, but now works properly. ... View more