This help contains the following topics:

·     Introduction

¡     Signature library upgrade

¡     Signature library roll back

·     Restrictions and guidelines

·     Configure signature library upgrade and rollback

¡     Configure automatic signature library update

¡     Trigger immediate online update

¡     Perform a manual signature library update

¡     Configure a proxy server

¡     Roll back a signature library

	To upgrade the signature library for a DPI service module such as APR, URL filtering, IPS, ant-virus, or WAF, the correct license is required. If the license for a DPI service module expires, you can still use the existing signature library, but you can no longer upgrade the signature library. For more information about licenses, see license online help.

 

Introduction

A DPI signature library is a collection of common signatures that DPI uses for service identification. The company's official website releases up-to-date signatures in the form of DPI signature library files. You can manually download the files or configure the device to automatically download the files to update the DPI signature libraries. You can also roll back the signature library for a DPI service module.

DPI signature libraries include the WAF signature library, IPS signature library, virus signature library, APR signature library, and URL filtering signature library.

Signature library upgrade

The following methods are available for updating the signature library for a DPI service module:

·     Automatic update.

The device automatically downloads the most up-to-date signature file to update its local signature library periodically.

·     Online update.

The device downloads the most up-to-date signature file to update its local signature library immediately after you trigger the operation.

·     Manual update.

Use this method when the device cannot obtain the signature file automatically.

You must manually download the most up-to-date signature file, and then use the file to update the signature library on the device.

Signature library roll back

If filtering false alarms or filtering exceptions occur on a DPI service module frequently, you can roll back its signature library to the previous version or to the factory default version.

Restrictions and guidelines

·     Do not perform signature library update or rollback when the device's free memory is below the normal state threshold. The signature library update or rollback operation performed under such conditions is likely to fail and the DPI service will be affected.

·     Update only one signature library at a time.

Configure signature library upgrade and rollback

You can upgrade the signature library of a DPI service module to the latest version or roll back the signature library to the previous or the factory default version.

You can also configure a proxy server through which the device can access the company's official website for automatic or immediate online signature library update.

Configure automatic signature library update

Perform this task to configure automatic signature library update for a DPI service module.

For automatic signature library update to work correctly, make sure the device can access the company's official website to obtain the latest signature file.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

The Signature Library Update List page opens.

3.     Click the box in the Auto update column for a signature library.

In this example, click the box in the Auto update column for the IPS signature library.

The Configure Scheduled Update For IPS Signature Library window opens.

4.     Set the scheduled update time.

The automatic signature library update starts actually at a random time between the following time points:

¡     One hour before the scheduled update time.

¡     One hour after the scheduled update time.

5.     Click OK.

Trigger immediate online update

Anytime you find a release of new signature library version on the company's official website, you can trigger the device to immediately update the local signature library.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

The Signature Library Update List page opens.

3.     Click Online update in the Actions column for the signature library.

4.     Click OK in the confirmation dialog box that opens.

Perform a manual signature library update

Perform this task to manually update the signature libraries for DPI service modules by using locally stored signature files.

Use this method if the device cannot access the signature database services on the company's official website.

Store the update file on the correct location for successful signature library update:

·     For centralized IRF devices, store the update file on the master device.

·     For distributed devices in standalone mode, store the update file on the active MPU.

·     For distributed devices in IRF mode, store the update file on the global active MPU.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

The Signature Library Update List page opens.

3.     Click Manual update in the Actions column for a signature library. In this example, click Manual update for the IPS signature library.

The Update IPS Signature Library window opens.

4.     Click Select to select the local update file.

5.     Click OK.

Configure a proxy server

The device must access the company's official website for online or automatic signature library update. If direct connectivity is not available, the device can access the company's official website through the specified proxy server.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

The Signature Library Update List page opens.

3.     Click Configure proxy server.

The Configure Proxy Server window opens.

4.     Configure the proxy server settings, including the server address, port number, login username, and login password.

5.     Click OK.

Roll back a signature library

If a signature library update causes exceptions or a high false alarm rate, you can roll back the signature library.

Before rolling back the signature library, the device backs up the current signature library as the previous version. For example, the previous library version is V1 and the current library version is V2. If you perform a rollback to the previous version, library version V1 becomes the current version and library version V2 becomes the previous version. If you perform a rollback to the previous version again, the library rolls back to library version V2.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

The Signature Library Update List page opens.

3.     Click Roll back in the Actions column for a signature library. In this example, click Roll back for the IPS signature library.

The Roll Back IPS Signature Library window opens.

4.     Select Roll back to previous version or Roll back to factory default.

5.     Click OK.