Understanding F5's Transparent Mode vs Blocking Mode with a Focus on Geo-Blocking

Enforcement mode defines how act when we apply this policy. In transparent mode, policy learning will work and traffic will not be manipulated. In blocking mode traffic will be dropped or manipulated based on the policy.

when a WAF policy is in transparent mode all traffic will pass, so if you configured geo-location, and if I understood your question correctly, and your WAF policy is in transparent mode the traffic will pass and not block 

Hi dbaimakov , 

like Amr_Ali said, 
I want to add i your AWAF in Transparent mode and you configure Geo-location protection , your AWAF policy will not take any actions against these traffic it only presents it in event logs an Alarm logs if you checked the Alarm option here : 

So you need to watchout on this. 
Also have a look in this article about Geo-location Configs : https://my.f5.com/manage/s/article/K79414542#configure-1

- For Transparent mode in general : AWAF in Transparent mode can pares http traffic , match it against all security controls and learn all of http parameters in the request , but not block the request if violates these security control. 

So AWAF policy in transparent consumes CPU cycles because it's some how process in bigip and do it's work. 

There is a clear difference between ( AWAF disabled on Virtual server and AWAF policy in Transparent mode ) as when it disabled >>> This policy will NOT Consume CPU cycle or do parsing for http requests or anything. 

Sometimes we need to disable AWAF policy from Virtual server to troubleshoot in delay or drops issues ( even it is in transparent mode ) and return it back after troubleshooting is over. 

I hope this gives you clear insight in addition to Amr_Ali  comment 🙂