Where do geolocation and IP reputation data come from and how often are they updated?

Short answer

The two data sets come through separate paths. The IP reputation database is managed from the Settings → General Settings → IP Intelligence & Reputation screen (IP Intelligence & Reputation): it is updated from the TR7 reputation server with Update Online, or with the file provided by the TR7 Support Team with Update Offline. With Online Update Period on the Edit tab, a daily (02:00), weekly (Monday 03:00) or monthly (the 1st of the month 04:00) automatic update is scheduled; its default value is Off, and with Off, the update is done only manually. The scheduled update also refreshes the defined External Sources; in a cluster, it runs only on the first device. If the database is not updated for 45 days, Notification Management produces a notification. Geolocation (country, city, ASN) and network type data, on the other hand, is not data that the device downloads on its own: it comes with the IP database component published by TR7 and is applied from the Settings → General Settings → System Update screen with Start Update or Update Offline (component rows); it has no fixed frequency, and in a cluster, it is done separately on every device. The WAF uses the reputation data in Blacklist Protection, and the geographic data in the Detected Attacks by Country panel in the Dashboard, in the location information in Event Logs and in the analysis filters. The country and city in Event Logs are calculated with the current database when the record is displayed; after the IP database is updated, the location of old records is also displayed with the new data.

How Does It Work?

	IP reputation data	Geolocation and network type data
Content	Addresses with a bad reputation divided into threat categories; merged with the external sources and the manually entered Blacklist Content, and Whitelist Content is removed	The country, city, ASN and network type of the address
Source	The TR7 reputation server (Update Online) or the file provided by the TR7 Support Team (Update Offline, `.tar.gz` or `.zip`, at most 200 MB); in addition, at most 10 External Sources URLs	The IP Database component published by TR7
Screen where it is managed	IP Intelligence & Reputation	System Update → IP Database row
Automatic update	Online Update Period: Off (default), Daily (every day 02:00), Weekly (Monday 03:00), Monthly (the 1st of the month 04:00)	None; a published update is applied by the administrator
Manual update	Update Online, Update Offline; the external sources are refreshed separately with the update icon in the External Sources heading	Check for Updates → Start Update or Update Offline
Cluster	The scheduled update runs only on the first device, and the result is transferred to the peer device (Online Update Period)	The update is done separately on every device; the screen shows only the device it is opened on (System Update)
Warning	A Notification Management warning if the database is not updated for 45 days (default) or if there is no data at all	-

When the update is applied, the vServices that use the data start working with the new data; no separate deployment step is required.

Where Is It Used in the WAF?

Use	Data	When it is read
Blacklist Protection and Blacklist IP Category	IP reputation	At the time of the request
The Detected Attacks by Country panel in the WAF Dashboard	Geographic	At the time of the request; the counters accumulate with the data current at that moment
Event Logs: Attacker Location, Attack Network, Ip Provider	Geographic	When the record is displayed; after the IP database is updated, old records are also shown with the new data
Analysis & Learning filters (country, blacklist)	Both	When the analysis is run

The WAF's signature library is separate from these two data sets; it is updated with the WAF Rules row in System Update (Signature Rule Library).

Setting Up the Update

IP Reputation: Automatic Update

Adım 1 Open the screen

The Configuration Menu is opened with the TR7 logo at the bottom left; the Settings → General Settings → IP Intelligence & Reputation path is followed (how to edit). The Status, Last Check and Last Online Update rows show the status and time of the last update.

Adım 2 Open the Edit tab

Edit is clicked; the tab where the update settings are edited opens.

Adım 3 Select the period and the sources

Online Update Period = Daily, Weekly or Monthly is selected. Over which route table the device goes out to the TR7 reputation server is determined in the Route Table field. If an external feed is to be used, a URL is added under External Sources; the Max Entries default is 50,000 (1–200,000), and if needed, an authentication header is added with HTTP Headers. When a URL is deleted from the list and saved, the addresses coming from that source leave the blacklist immediately; a source whose fetch fails, on the other hand, keeps its last successful list until the next successful fetch.

Adım 4 Save

Save is clicked. The schedule runs in the next period; if the database is to be updated immediately, Update Online on the screen is clicked and confirmed.

Geographic Data: IP Database Update

Adım 1 Open the System Update screen

The Configuration Menu → Settings → General Settings → System Update path is followed (how to update). On first use, the Update Server Address is entered with Edit and saved with Save; the address is provided by the TR7 Support Team.

Adım 2 Check for updates

Check for Updates is clicked; the published versions appear in the component rows.

Adım 3 Update the IP database row

On the IP Database row, Start Update is clicked. If there is no internet access, the file provided by the TR7 Support Team is selected with Update Offline on the same row, the version number is written and Submit is clicked.

Adım 4 Repeat on the peer device

In a cluster, steps 1–3 are also performed on the peer device's own interface; System Update is not transferred to the peer device automatically.

Common Misconceptions

"The reputation database updates on its own." Online Update Period is Off by default; unless a period is selected, the update is done only with Update Online or Update Offline.
"Geographic data comes with the reputation update." Country, city, ASN and network type data comes with the IP Database component in System Update; the update on the IP Intelligence & Reputation screen does not change this data.
"In a cluster, the IP database update also passes to the peer device." System Update runs separately on every device; the scheduled update of the reputation database, on the other hand, runs on the first device and is transferred to the peer device.
"The country information of old WAF records does not change." The location in Event Logs is calculated with the current database when the record is displayed; after the IP database is updated, old records may appear with the new location.

How it is done in the documentation

Where do geolocation and IP reputation data come from and how often are they updated? ​

How Does It Work? ​

Where Is It Used in the WAF? ​

Setting Up the Update ​

IP Reputation: Automatic Update ​

Geographic Data: IP Database Update ​

Common Misconceptions ​