settings ip-intelligence

The settings ip-intelligence command manages how often the database that determines the reputation of the source addresses will be updated and which external sources it will be fed from. This database is used in the address reputation and blacklist criteria in the protection rules.

Command Summary

TR7 WEB-CLI · settings ip-intelligence

# Tab after the command

admin@TR7LBWAF01> settings ip-intelligence

show update

 

admin@TR7LBWAF01> settings ip-intelligence show # show the settings

admin@TR7LBWAF01> settings ip-intelligence update … # change

admin@TR7LBWAF01>  

Fields

This resource is a single setting: no identifier is written, update is run directly and only the fields to be changed are given.

Field	What it does	What is written after it
--onlineUpdatePeriod	Selects how often the database will be updated	daily · weekly · monthly. When it is left empty, no online update is done
--namespace	Selects which routing table the update will be downloaded from	A routing table (the default is 1)
--externalSources.N.url	Determines the address the external list will be downloaded from	An address; every source with its own index
--externalSources.N.maxEntries	Limits how many records at most will be taken from that source	A number (the default is 50000)
--externalSources.N.headers.M.name · --externalSources.N.headers.M.value	Adds a header to the download request	The header name and value; it is used for the sources that require an identity

Examples

TR7 WEB-CLI · settings ip-intelligence

# a weekly update and an external list that requires an identity

admin@TR7LBWAF01> settings ip-intelligence update --onlineUpdatePeriod weekly \

--externalSources.0.url <address> --externalSources.0.maxEntries 100000 \

--externalSources.0.headers.0.name Authorization --externalSources.0.headers.0.value <token>

admin@TR7LBWAF01>  

Things to Know

• The database is used in the protection rules. The address reputation criterion is evaluated in the lb threat-protection and lb condition records.
• The online update can be turned off. When --onlineUpdatePeriod is left empty, the database is not updated by itself.
• The download depends on the routing table. The table the download will go out from is selected with --namespace; there must be access to the external network from that table.
• The number of records can be limited. On large lists the number of records to be taken is limited with --externalSources.N.maxEntries.