Update the geolocation database used in dashboards

Overview

The F5 NGINX Security Monitoring module tracks security violations on NGINX App Protect WAF instances. It uses MaxMind’s GeoLite2 Free Database to provide geolocation data in analytics dashboards.

Follow these steps to update the Security Monitoring module with the latest geolocation database, ensuring dashboards display accurate geolocation data.

Before you begin

Ensure the following prerequisites are met:

• NGINX App Protect is configured, and the Security Monitoring dashboard is collecting security violations.

Update the geolocation database

1. Create a MaxMind account and subscribe to receive updates for the GeoLite2 database.

2. Download the GeoLite2 Country database (Edition ID: GeoLite2-Country) in GeoIP2 Binary .mmdb format from the MaxMind website. The database is included in a .gzip file.

3. Extract the .gzip file to access the GeoLite2 Country database file, named GeoLite2-Country.mmdb.

4. Replace the existing GeoLite2-Country.mmdb file on the NGINX Instance Manager control plane at /usr/share/nms/geolite2/GeoLite2-Country.mmdb with the new database:

   Copy

   sudo scp /path/to/GeoLite2-Country.mmdb {user}@{host}:/usr/share/nms/geolite2/GeoLite2-Country.mmdb

5. Restart the NGINX Instance Manager services to apply the update:

   bash

   Copy

   sudo systemctl restart nms-ingestion
   sudo systemctl restart nms-core