Cisco Systems ASA 5580 Manual De Usuario
26-10
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 26 Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
Examples
The following example creates entries for the blacklist and whitelist:
ciscoasa(config)# dynamic-filter blacklist
ciscoasa(config-llist)# name bad1.example.com
ciscoasa(config-llist)# name bad2.example.com
ciscoasa(config-llist)# address 10.1.1.1 255.255.255.0
ciscoasa(config-llist)# dynamic-filter whitelist
ciscoasa(config-llist)# name good.example.com
ciscoasa(config-llist)# name great.example.com
ciscoasa(config-llist)# name awesome.example.com
ciscoasa(config-llist)# address 10.1.1.2 255.255.255.255
What to Do Next
See the
Enabling DNS Snooping
This procedure enables inspection of DNS packets and enables Botnet Traffic Filter snooping, which
compares the domain name with those on the dynamic database or static database, and adds the name
and IP address to the Botnet Traffic Filter DNS reverse lookup cache. This cache is then used by the
Botnet Traffic Filter when connections are made to the suspicious address.
compares the domain name with those on the dynamic database or static database, and adds the name
and IP address to the Botnet Traffic Filter DNS reverse lookup cache. This cache is then used by the
Botnet Traffic Filter when connections are made to the suspicious address.
The following procedure creates an interface-specific service policy for DNS inspection. See the
and
for detailed information about configuring advanced DNS inspection options using
the Modular Policy Framework.
Prerequisites
In multiple context mode, perform this procedure in the context execution space.
Restrictions
TCP DNS traffic is not supported.
name
domain_name
Example:
ciscoasa(config-llist)# name good.example.com
Adds a name to the whitelist. You can enter this
command multiple times for multiple entries. You can
add up to 1000 whitelist entries.
command multiple times for multiple entries. You can
add up to 1000 whitelist entries.
address
ip_address mask
Example:
ciscoasa(config-llist)# address 10.1.1.2
255.255.255.255
Adds an IP address to the whitelist. You can enter this
command multiple times for multiple entries. The
mask can be for a single host or for a subnet.
command multiple times for multiple entries. The
mask can be for a single host or for a subnet.
Command
Purpose