SFC FRA connection issues because of wrong country - misconfiguration

Hi there,

today we found out (this issue is existing for a longer time already) that when using SFC FRA connection to Frankfurt the Microsoft Internet Connection test (https://connectivity.office.com) says that the location is in Rabat (Morocco) which should be definitively wrong.

We think, that there is some misconfiguration at Peplinks site.
Other locations like AMS (Amsterdam) work as they should and give back correct location.

I’d say it’s an IP geolocation issue for Microsoft. When connecting to Frankfurt I get a 104.28.24.x IP which is correctly geolocated to Frankfurt by every other tool.

This could be the true… But it’s hard for a single person to go against some big player like Microsoft is…

Maybe Peplink can do something in that case?!

They’re providing this service which is giving a huge issue to it’s users in that case.

You shouldn’t need to, just have one of them submit a ticket to Microsoft with IP address range x.y.z.0/whatever is being incorrectly geolocated.

Hope they will do it - support doesn’t respond to our ticket…

Hello @ATSW
Welcome to the Peplink Community Forum.

A little more context on why Microsoft may assign the wrong location to an SFC public IP:

Microsoft states that there is “no definitive connection” between an IP address and the physical location of the device using it. Its IP-to-location result is a best-effort assessment based on network traces, registry data, reverse lookups and other information. Microsoft specifically notes that VPNs and mobile providers commonly issue addresses from central pools located far from the user.
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details#sign-in-details-and-considerations

For SFC-FRA, the result could therefore be affected by:

  • Incorrect or stale registration details for the public IP range.
  • The IP range has previously been used in another country.
  • Missing or incorrect geofeed information.
  • Reverse-DNS records or routing paths suggesting another location.
  • The address is being recognised as a shared VPN or cloud egress IP.
  • Different Microsoft services or location-data suppliers are refreshing their records at different times.

Microsoft’s Windows Location Service separately combines GPS, nearby Wi-Fi access points, cellular towers and the public IP address. Microsoft also advises that some location data is shared with its current location-service partners, HERE and Skyhook.
https://support.microsoft.com/en-us/windows/privacy/windows-location-service-and-privacy

This means GPS-enabled devices might provide Microsoft with additional observations, but the documented Wi-Fi crowd-sourcing process maps locally visible access-point MAC addresses. It does not confirm that several remote SFC users will automatically correct the country assigned to the SFC-FRA public IP.

Microsoft has also acknowledged other cases where its IP geolocation record was wrong, even though independent GeoIP services were correct. In one recent case, the address was corrected only after escalation to Microsoft’s engineering team:
https://learn.microsoft.com/en-gb/answers/questions/5672870/azure-sign-in-logs-incorrect-geo-location-for-busi

It would therefore be helpful if you could raise a Peplink Support Ticket to confirm the affected SFC-FRA egress IP address or range, its registered country, any published geofeed, and which GeoIP providers currently report the incorrect country. That should make it possible to distinguish an authoritative IP-data problem from a Microsoft-specific database issue. Please share your Peplink Support Ticket back here in the forum for reference.

Have a good week,
Marcus :slight_smile:

I’ve had a similar issue with LAX and SFC (or was it SJC?)

Our corporate firewall blocked me because the GeoIP was wrong, pointed to a UAE.

Apparently LAX Wilshire One data center purchased or leased an IP block that was originally assigned to south america, broken down, leased to south korea, and re-leased to UAE, and eventually to Wilshire One…

The erroneous GeoIP did not affect all GeoIP providers, yet it did the one which our corporate vpn/firewall is using

it took a long while for the GeoIP provider to update after I made the request.

temporary workaround was to switch to another SFC location