Technical Tip: Update FortiWeb Web Security signatures and Geolocation Database manually

[AACastillo]

Description

This article describes how to update the FortiWeb's Web Security signatures and the Geolocation Database manually using the FortiCloud services.

Solution

To update the FortiWeb security signatures and geolocation database (or GEO DB) it's always recommended to use the FortiWeb automatic updates and validate the correct connection with FortiGuard databases. However, sometimes this procedure could not work and a manual update may be needed. Check the FortiWeb's database versions by accessing System -> Config -> FortiGuard. In License Information, it can be seen in Security Service (Signature Build Number) and GEO DB (GEO Database Version). FortiWeb license information can also be seen using the following commands: diag sys update info get sys upd-db-version For example, executing 'get sys upd-db-version': FWB-LABOS # get sys upd-db-version Regular Virus Database Version: 00092.09942 Extended Virus Database Version: 00092.09939 Virus Engine Version: 00006.00290 Waf Signature Version: 00000.00391 <------ Initial Signature Build Number. IP Intelligence Signature Version: 00004.00913 Credential Stuffing Defense Database Version: 00001.00512 FortiSandbox Malware Signature Database Version: 0.0 Geo Database Version: Fortiweb-Country-Build0261 2024-12-23 <------ Initial GEO Database Version. DLP Signature Database Version: 00000.00000 Access to FortiCloud (support.fortinet.com) with the respective user, password, and Token. Then select Support and go to Downloads -> Service Updates: In the Service Updates screen, select: Select Product: FortiWeb Service Type: Web Security Signatures The list will show the latest available package file related to the firmware version in the LASTEST RELEASE column. Select the latest release .pkg file and complete the captcha to download the package file. Note: If one of the two previous releases is needed, the PREVIOUS RELEASES column will show the two previous version packages to download. After downloading the .pkg file, in the FortiWeb go to System -> Config -> FortiGuard. In License Information select the Update button and in the Update Signature window, in From File select the Upload button. Select the downloaded .pkg file and then select OK. It will appear a Confirm window informing: 'This operation will update current signatures. Are you sure you want to continue? This operation will take some time to complete whole process, please stay on this page and don't switch to other one'. Select OK to start the update. Important: This procedure does not REBOOT the FortiWeb. Let about 20-60 seconds to finish the update. After that, refresh the browser or go to System -> Config -> FortiGuard; in License Information check Signature Build Number in Security Service and GEO Database Version in GEO DB: This license information can also be seen with the following commands: diag sys update info get sys upd-db-version Check FortiWeb signature Version and FortiWeb GEODB version with 'diag sys update info' command, or Waf Signature Version or Geo Database Version with 'get sys upd-db-version' command. This is an example after the update executing 'get sys upd-db-version': FWB-LABOS # get sys upd-db-version Regular Virus Database Version: 00092.09942 Extended Virus Database Version: 00092.09939 Virus Engine Version: 00006.00290 Waf Signature Version: 00000.00392 <------ New Signature Build Number IP Intelligence Signature Version: 00004.00916 Credential Stuffing Defense Database Version: 00001.00512 FortiSandbox Malware Signature Database Version: 0.0 Geo Database Version: Fortiweb-Country-Build0263 2025-01-07 <------ New GEO Database Version DLP Signature Database Version: 00000.00000 Related document: Updating signatures from FortiGuard