Configure the Botnet Detection Update Server

The Botnet Detection subscription service uses a list of known botnet site IP addresses from Reputation Enabled Defense (RED).

To make sure your Botnet Detection Sites list is current, you must enable automatic updates.

  1. Select Subscription Services > Botnet Detection.
    The Botnet Detection page appears with the Settings tab selected.
  2. Select the Update Server tab.

Screen shot of the Update Server page

  1. To enable automatic updates, select the Enable automatic update check box.
  2. In the Interval text box, type or select the number of hours between automatic updates.
  3. To automatically update the Botnet Detection Sites list at the selected update interval, select the Botnet Detection Sites check box.
  4. Click Save.
  1. Select Subscription Services > Botnet Detection.
    The Botnet Detection dialog box appears.
  2. Click Update Server.
    The Update Server dialog box appears.

Screen shot of the Update Server dialog box

  1. To enable automatic updates, select the Enable automatic update check box.
  2. In the Interval text box, type or select the number of hours between automatic updates.
  3. To automatically update the Botnet Detection Sites list at the selected update interval, select the Botnet Detection Sites check box.
  4. Save the configuration to the Firebox.

Connect to the Update Server Through an HTTP-Proxy Server

If your Firebox must connect to the update server through an HTTP-proxy, you must add information about the HTTP-proxy server to your update server configuration.

  1. In the HTTP Proxy Server section, select the Connect to Update Server with an HTTP Proxy Server check box.
  2. In the Server Address section, type the IP address or host name of your HTTP-proxy server.
  3. (Optional) To specify which port number to use to connect to your HTTP-proxy server, in the Server Port text box, type the port number.
    Most HTTP-proxy servers accept requests on port 8080. You must only specify a different port if your server does not use port 8080.
  4. From the Server Authentication drop-down list, select the type of authentication your HTTP-proxy server uses.
    • If your HTTP-proxy does not require authentication, select No Auth.
    • If your HTTP-proxy server requires NTLM or Basic authentication, in the text boxes, type your User Name, Domain, and Password.
  5. Save your configuration.

Update Signatures Manually

For information about how to see the status of signature updates, and how to manually force an update to the most current signatures, see Subscription Services Status and Manual Signatures Updates.

Offline Signature Updates

For security reasons, some customer environments require direct control over the distribution and installation of periodic signature updates for signature services such as Gateway AntiVirus, Intrusion Prevention, and Data Loss Prevention.

WatchGuard offers Offline Signature Updates that enable you to download the latest signatures for these services directly from WatchGuard, and then use a script to manually install these files on your Fireboxes.

A special set of credentials are required to access the signature update files from the WatchGuard servers. For more information about this feature, contact WatchGuard technical support.

Related Topics

About Botnet Detection

Configure Botnet Detection

Botnet Site Exceptions