Cisco Systems and the ASA Services Module Manual De Usuario
26-7
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 26 Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
This section includes the following topics:
•
•
•
•
•
•
•
Task Flow for Configuring the Botnet Traffic Filter
To configure the Botnet Traffic Filter, perform the following steps:
Step 1
Enable use of the dynamic database. See the
.
This procedure enables database updates from the Cisco update server, and also enables use of the
downloaded dynamic database by the ASA. Disallowing use of the downloaded database is useful in
multiple context mode so you can configure use of the database on a per-context basis.
downloaded dynamic database by the ASA. Disallowing use of the downloaded database is useful in
multiple context mode so you can configure use of the database on a per-context basis.
Step 2
(Optional) Add static entries to the database. See the
.
This procedure lets you augment the dynamic database with domain names or IP addresses that you want
to blacklist or whitelist. You might want to use the static database instead of the dynamic database if you
do not want to download the dynamic database over the Internet.
to blacklist or whitelist. You might want to use the static database instead of the dynamic database if you
do not want to download the dynamic database over the Internet.
Step 3
Enable DNS snooping. See the
.
This procedure enables inspection of DNS packets, compares the domain name with those in the
dynamic database or the static database (when a DNS server for the ASA is unavailable), and adds the
name and IP address to the DNS reverse lookup cache. This cache is then used by the Botnet Traffic
Filter when connections are made to the suspicious address.
dynamic database or the static database (when a DNS server for the ASA is unavailable), and adds the
name and IP address to the DNS reverse lookup cache. This cache is then used by the Botnet Traffic
Filter when connections are made to the suspicious address.
Step 4
Enable traffic classification and actions for the Botnet Traffic Filter. See the
.
This procedure enables the Botnet Traffic Filter, which compares the source and destination IP address
in each initial connection packet to the IP addresses in the dynamic database, static database, DNS
reverse lookup cache, and DNS host cache, and sends a syslog message or drops any matching traffic.
in each initial connection packet to the IP addresses in the dynamic database, static database, DNS
reverse lookup cache, and DNS host cache, and sends a syslog message or drops any matching traffic.
Step 5
(Optional) Block traffic manually based on syslog message information. See the
.
If you choose not to block malware traffic automatically, you can block traffic manually by configuring
an access rule to deny traffic, or by using the shun command to block all traffic to and from a host.
an access rule to deny traffic, or by using the shun command to block all traffic to and from a host.