This help contains the following topics:

·     Introduction

¡     Signature library upgrade

¡     Signature library roll back

·     Restrictions and guidelines

·     Configure signature library upgrade and rollback

¡     Configure automatic signature library update

¡     Trigger immediate online update

¡     Perform a manual signature library update

¡     Configure a proxy server

¡     Roll back a signature library

¡     Test the signature library server connectivity

Introduction

A DPI signature library is a collection of common signatures that DPI uses for service identification. The company's official website releases up-to-date signatures in the form of DPI signature library files. You can manually download the files or configure the device to automatically download the files to update the DPI signature libraries. You can also roll back the signature library for a DPI service module.

DPI signature libraries include the IPS signature library, URL filtering signature library, Web application protection, APR signature library, virus signature library, IP reputation signature library, URL reputation signature library, and domain reputation signature library.

Signature library upgrade

The following methods are available for updating the signature library for a DPI service module:

·     Automatic update.

The device automatically downloads the most up-to-date signature file to update its local signature library periodically.

·     Online update.

The device downloads the most up-to-date signature file to update its local signature library immediately after you trigger the operation.

·     Manual update.

Use this method when the device cannot obtain the signature file automatically.

You must manually download the most up-to-date signature file, and then use the file to update the signature library on the device.

Signature library roll back

If filtering false alarms or filtering exceptions occur on a DPI service module frequently, you can roll back its signature library to the previous version or to the factory default version.

Restrictions and guidelines

·     Signature library upgrade and rollback can cause temporary outage for DPI services. Services based on the DPI services might also be interrupted. For example, security policies cannot control access to applications.

·     To upgrade the signature library for a DPI service module such as APR, IPS, anti-virus, Web application protection, URL filtering, IP reputation, domain reputation, and URL reputation, the correct license is required. If the license for a DPI service module expires, you can still use the existing signature library, but you can no longer upgrade the signature library. For more information about licenses, see license online help.

·     Do not perform signature library update or rollback when the device's free memory is below the normal state threshold. The signature library update or rollback operation performed under such conditions is likely to fail and the DPI service will be affected.

·     Update only one signature library at a time.

·     Only the default context supports the signature library update. A user context supports only viewing the signature library version.

·     The IP reputation, URL reputation, and domain reputation are time-sensitive and the factory version is not supported currently. Before using these functions, first upgrade the corresponding signature library as a best practice.

Configure signature library upgrade and rollback

You can upgrade the signature library for a DPI service module to the latest version or roll back the signature library to the previous or the factory default version.

You can also configure a proxy server through which the device can access the company's official website for automatic or immediate online signature library update.

Configure automatic signature library update

Perform this task to configure automatic signature library update for a DPI service module.

For automatic signature library update to work correctly, make sure the device can access the company's official website to obtain the latest signature file.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

3.     Click the box in the Auto update column for a signature library.

In this example, click the box in the Auto update column for the IPS signature library.

The Configure Scheduled Update For IPS Signature Library window opens.

4.     Set the scheduled update time.

The automatic signature library update starts actually at a random time between the following time points:

¡     One hour before the scheduled update time.

¡     One hour after the scheduled update time.

5.     Click OK.

Trigger immediate online update

Anytime you find a release of new signature library version on the company's official website, you can trigger the device to immediately update the local signature library.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

3.     Click Online update in the Actions column for the signature library.

4.     Click OK in the confirmation dialog box that opens.

Perform a manual signature library update

Perform this task to manually update the signature libraries for DPI service modules by using locally stored signature files.

Use this method if the device cannot access the signature database services on the company's official website.

Store the update file on the master device for successful signature library update.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

3.     Click Manual update in the Actions column for a signature library. In this example, click Manual update for the IPS signature library.

The Update IPS Signature Library window opens.

4.     Click Select to select the local update file.

5.     Click OK.

Configure a proxy server

The device must access the company's official website for online or automatic signature library update. If direct connectivity is not available, the device can access the company's official website through the specified proxy server.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

3.     Click Configure proxy server.

The Configure Proxy Server window opens.

4.     Configure the proxy server settings, including the server address, port number, login username, and login password.

5.     Click OK.

Roll back a signature library

If a signature library update causes exceptions or a high false alarm rate, you can roll back the signature library.

Before rolling back the signature library, the device backs up the current signature library as the previous version. For example, the previous library version is V1 and the current library version is V2. If you perform a rollback to the previous version, library version V1 becomes the current version and library version V2 becomes the previous version. If you perform a rollback to the previous version again, the library rolls back to library version V2.

Procedure

1.     Click the System tab.

2.     In the navigation pane, select Upgrade Center > Signature Upgrade.

3.     Click Roll back in the Actions column for a signature library. In this example, click Roll back for the IPS signature library.

The Roll Back IPS Signature Library window opens.

4.     Select Roll back to previous version or Roll back to factory default.

5.     Click OK.

Test the signature library server connectivity

Before triggering an immediate online update, configuring automatic signature library update, or updating the signature library by using the proxy server, click Test signature library server connectivity. If the device fails to connect to the signature library server, resolve the issue according to the prompt on the page.