If Internet connectivity is not configured in your NSX-T Data Center, you can use APIs to manually download the NSX intrusion detection signature bundle (.zip) file, and then upload the signature bundle to NSX Manager. Perform the following steps to download signatures in an offline mode and upload them on NSX-T Data Center.

Step 1: Register NSX-T to the Cloud Service

Use the following API to register NSX-T to the cloud service. Before starting any communication with the cloud service, you must use this API to register to the cloud service. Send all licenses and you will be provided with necessary permission. If the license key is valid, the API generates and returns client_id and client_secret. The information about the license is stored in the cloud. Client_secret is used as the request for the Authentication API. If the client has previously registered, but does not have access to client_id and client_secret, the client has to re-register using the same API.

URI Path:

POST https://api.nsx-sec-prod.com/1.0/auth/register
Body: 
{
"license_keys":["XXXXX-XXXXX-XXXXX-XXXXX"],
"device_type":"NSX-Idps-Offline-Download",
"client_id": "client_username"
}
Response: 
{"client_id":"client_username", 
"client_secret": "Y54+V/rCpEm50x5HAUIzH6aXtTq7s97wCA2QqZ8VyrtFQjrJih7h0alItdQn02T46EJVnSMZWTseragTFScrtIwsiPSX7APQIC7MxAYZ0BoAWvW2akMxyZKyzbYZjeROb/C2QchehC8GFiFNpwqiAcQjrQHwHGdttX4zTQ="
}

Step 2: Authenticate NSX-T to the Cloud Service

Use the following API to authenticate NSX-T to the cloud service. This API call authenticates the client using the client_id and client_secret. The API generates access_token to use in the headers of requests to IDS Signatures APIs. The token is valid for 60 minutes. If the token expires, the client has to reauthenticate using the client_id and client_secret.

URI Path:

POST https://api.nsx-sec-prod.com/1.0/auth/authenticate
Body: 
{"client_id":"client_username", 
"client_secret": "Y54+V/rCpEm50x5HAUIzH6aXtTq7s97wCA2QqZ8VyrtFQjrJih7h0alItdQn02T46EJVnSMZWTseragTFScrtIwsiPSX7APQIC7MxAYZ0BoAWvW2akMxyZKyzbYZjeROb/C2QchehC8GFiFNpwqiAcQjrQHwHGdttX4zTQ="
}

Response:

{
    "access_token": "eyJhbGciOiJIUzUxMiJ9.eyJqdGkiOiI3ZjMwN2VhMmQwN2IyZjJjYzM5ZmU5NjJjNmZhNDFhMGZlMTk4YjMyMzU4OGU5NGU5NzE3NmNmNzk0YWU1YjdjLTJkYWY2MmE3LTYxMzctNGJiNS05NzJlLTE0NjZhMGNkYmU3MCIsInN1YiI6IjdmMzA3ZWEyZDA3YjJmMmNjMzlmZTk2MmM2ZmE0MWEwZmUxOThiMzIzNTg4ZTk0ZTk3MTc2Y2Y3OTRhZTViN2MtMmRhZjYyYTctNjEzNy00YmI1LTk3MmUtMTQ2NmEwY2RiZTcwIiwiZXhwIjoxNTU1NTUyMjk0LCJpYXQiOjE1NTU1NDg2OTR9.x4U75GShDLMhyiyUO2B9HIi1Adonzx3Smo01qRhvXuErQSpE_Kxq3rzg1_IIyvoy3SJwwDhSh8KECtGW50eCPg",
    "token_type": "bearer",
    "expires_in": 3600,
    "scope": "[idps_scope]"
}

Step 3: Retrieve Link of the Signature Bundle (Zip) File

Use the following API to retrieve link of the signature bundle file. NSX Cloud downloads the latest signatures every 24 hours, and saves the signatures in a ZIP file. This API returns a ZIP file link in the response. Copy and paste the link in your browser and download the ZIP file.

URI Path:

GET https://api.nsx-sec-prod.com/1.0/intrusion-services/signatures

In the Headers tab, the Authorization key will have the access_token value from the authenticate API response.

Authorization: eyJhbGciOiJIUzUxMiJ9.eyJqdGkiOiI3ZjMwN2VhMmQwN2IyZjJjYzM5ZmU5NjJjNmZhNDFhMGZlMTk4YjMyMzU4OGU5NGU5NzE3NmNmNzk0YWU1YjdjLTJkYWY2MmE3LTYxMzctNGJiNS05NzJlLTE0NjZhMGNkYmU3MCIsInN1YiI6IjdmMzA3ZWEyZDA3YjJmMmNjMzlmZTk2MmM2ZmE0MWEwZmUxOThiMzIzNTg4ZTk0ZTk3MTc2Y2Y3OTRhZTViN2MtMmRhZjYyYTctNjEzNy00YmI1LTk3MmUtMTQ2NmEwY2RiZTcwIiwiZXhwIjoxNTU1NTUyMjk0LCJpYXQiOjE1NTU1NDg2OTR9.x4U75GShDLMhyiyUO2B9HIi1Adonzx3Smo01qRhvXuErQSpE_Kxq3rzg1_IIyvoy3SJwwDhSh8KECtGW50eCPg
Response: 
{
    ""signatures_url": "https://ncs-idps-eu-central-1-prod-signatures.s3.eu-central-1.amazonaws.com/IDSSignatures_1706050811658.zip?
                        X-Amz-Security-Token=IQoJb3JpZ2luX2VjEN7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDGV1LWNlbnRyYWwtMSJGMEQCIDAPvmPd%2B%2B
                        TfMB8Ip4uQ8%2F31s%2FtlYtuEvkmpXJ%2Bth9GyAiAySVdeDVLXOgOEyb%2BalsLPXvJFetYijQFEzxT7GKWdoSq1AwiX%2F%2F%2F%2F%2F%2F%
                        2F%2F%2F%2F8BEAMaDDg1MDUzNDQwNDY2MSIMsq6k%2Bf%2B%2Bap%2FVy9zkKokDc2v6Y79oWgTN7sfFAmuVxkmIVcsTT5QZWb349IX1SaQTXsc0
                        WE8EERO7TOE2L0%2FyRJbUQsj2z3U%2F82ovdA2iodmsn8e%2Bhqdfr2yNUnqrsLeoqbJ317rcFEzlTBhxXgYnDT3%2BtKoyWodbGgG0zXQdvq3aU
                        nOH3zwscveKsBu5ugWJMv9iPeXwGxFx7hzDgI8JM2ZuiSP%2FAcSi13FK%2Bp8Oul07HNTKYt6b%2F%2BmPtssZE0EQCOdU%2FGOm1BVPJcKR5Dx
                        7lCoXr0KWIzzKMEpkVR4kyrhW%2Ff%2F%2FI9PgqN8XZ8aTnA0FdY8EaQVp20QH19OopNP26tLGjQFyccC%2BReQOX7L8SCGHF7BOqzLVYJLS5u5h
                        H%2B1D%2BsV8c8nCOOsylK5uLJdPBWjGkBgrhpjAusaoEOOnatqS7GO2PK2cEutFegjcqILdyd9dlqpzPguOqMg5%2FKEFS%2FPZnn1yznaI12AH
                        ydNhO1SAOEA5RgFEtOyBr2h3msx4guPbmF7FbAh4KF%2BOzN%2Fk3Quk3Xt9kbtPMOO2y60GOp4BmoR9ydv%2FNn3yzD3q%2Fk8nxfu8V3ODuQbHo
                        XKgYZoN1dWcjxZGlWTo2Is1R0Wh39CNGbLEEV5OeClfvXQA1OIkecD6LQIG6GFfEiv7S0C3PwLYFUHcP4RtZu22HQiRKPJd9KDPJ8RkUxHPNRPJY
                        8nXO5hn7XFK80KXgNF1srUiulti1dItCXs%2FzqocFN%2Fk6GnJyNUX99jFI3om3hiANQA%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-
                        Date=20240125T220636Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3599&X-Amz-Credential=ASIA4MB6NCI247AYBKPS%2F202401
                        25%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Signature=b4e210c3ce98e7e792e97333072bd97c4193eab6ba0ecc6016b5d830685fafaa",
    "signature_version": "3",
    "sha256_checksum":"d0b7a20eb9b57c9abd90f95c6a29af5f2056fea4a01eb9c8a30a87e0d0fd43a5",
    "last_updated": "2020-03-01T23:59:59Z",
    "version_name": "IDS/IPSSignature.3.2020-03-01T23:59:59Z"
   }

Step 4: Upload the Signature Bundle to NSX Manager

  • Method 1: Upload using NSX Manager UI

    To upload the file from NSX Manager UI, navigate to Security > IDS/IPS & Malware Prevention > Settings > IDS/IPS, and click Upload IDS/IPS Signatures. Browse the saved signature ZIP file and upload the file.

  • Method 2: Upload using an NSX-T API

    To upload the file using the NSX-T API, use the following API.

    POST https://<mgr-ip>/policy/api/v1/infra/settings/firewall/security/intrusion-services/signatures?action=upload_signatures

Error Code Handling for Authentication API

This is an example authentication API error response:

{
"error_code":100101,
"error_message":"XXXXX"
}
  • If you received an error code from 100101-100150, re-register with the same client id.
  • If you received an error code from 100151-100200, re-register with a different client id.