Handling Updates

Information retrieved from databases and lists for use in the filtering process must be updated from time to time.

Web objects are filtered on an appliance in a rule-based process. The filtering rules require information about these objects to know whether an action must be executed, such as blocking access to an object. They rely on this information for particular modules (engines).

For example, a malware filtering rule relies on the Anti-Malware module to find out whether an object is malware-infected. A URL filtering rule relies on the URL Filter module for category information.

The modules retrieve this information from particular sources, such as databases and lists. An example of these sources is the virus signatures used in anti-malware filtering, which are stored in DAT files and located in an external database.

Another example is the list of public domain name suffixes. When a URL is filtered, this list is used to find the domain suffix based on the host name within the URL.

Update methods are:

• Manual engine update — Information is manually updated for the modules of a particular appliance.
• Automatic engine update — Information is updated by automatic procedures running in regular intervals for the modules of a particular appliance.
  
  These updates can retrieve information:
  • From the internet — Information is downloaded from external databases.
    NOTE: Information is for the first time updated in this way immediately after the initial setup of an appliance.
  • From other nodes in a cluster — Information is downloaded from other nodes in a Central Management cluster. You can configure for each node whether uploading information from this node to others is allowed.

You can already configure these updates when setting up a Central Management cluster.