Техническая Инструкция для Cisco Cisco Security Manager 4.0

Botnets are a collection of malicious software or “bots” covertly installed on endpoints and controlled 
by another entity through a communications channel such as IRC, peer-to-peer (P2P), or HTTP. The 
Cisco ASA Botnet Traffic Filter complements existing endpoint security solutions by monitoring 
network ports for rogue botnet activity and by detecting infected internal endpoints sending command 
and control traffic back to a host on the Internet. The Botnet Traffic Filter database identifies command 
and control traffic as well as the domains or hosts receiving the information.

Cisco Security Manager is an enterprise-class security management software application. You can use it 
to manage security policies on a wide variety of devices.

This paper describes how to use Cisco Security Manager 4.0 to configure Botnet Traffic Filtering on 
ASA devices running version 8.3 software. Although this paper is specific to this ASA version, you can 
use these concepts and techniques with any version of ASA software that supports Botnet Traffic 
Filtering (version 8.2(1)+). Keep in mind that Botnet configuration features can differ between ASA 
software releases.

This paper uses the following document as a basis for showing how to perform the equivalent 
configuration using Security Manager: Combating Botnets Using the Cisco ASA Botnet Traffic Filter, 

This paper assumes the following:

That you have already installed (or upgraded) the appropriate ASA software version on the device 
and performed basic device configuration. This paper assumes that the ASA is installed and 
functional in your production network or at least in a test network with realistic connections, that 
there is a network path between the device and the Cisco Security Manager server, and that you have 
configured a username and password on the device that Cisco Security Manager can use.