topic IPS subscription vs Botnet traffic filter in Network Security

IPS subscription vs Botnet traffic filter

Viet Bui — Tue, 12 Mar 2019 06:28:00 GMT

hi,

firstly i don't think that we have any problems with two kind of licenses. but i found that, if i also have Firepower and ASA firewall in data center, there are some issues below:.

If you buy IPS subscription license on FirePower, BotNet update on ASA may not be useful. Because bad reputation IP list are updated through IPS(FirePower) subscription already.

so can anyone tell me more about this issue?

thanks,

Hello, Viet.If you are going

Boris Uskov — Thu, 20 Aug 2015 10:40:04 GMT

Hello, Viet.

If you are going to use FirePOWER module on cisco ASA with IPS subscriptions, you don't need to order Cisco ASA Botnet Filter licenses. The "Security Intelligence" component of FirePOWER module receives updates from the cloud service VRT (Vulnerability Research Team). Those updates contain the information about IP-addresses with bad reputation. The IPS signatures of FirePOWER module and updates from Security Intelligence component will be correlated. As a result, FirePOWER will provide you with information about hosts in your network, who participates in Bot-Nets. You'll receive messages:
CnC Connected

So, if you want to protect your network from participating in Bot-Nets, you can use only FirePOWER module on Cisco ASA with IPS subscriptions. The function of Cisco ASA Botnet Filter licenses overlaps with IPS subscriptions of FirePOWER.

Moreover, as far as I know, Cisco continuously works on consolidation of both cloud services: Vulnerability Research Team (VRT), which updates FirePOWER, and Cisco Security Intelligence Operations (SIO), which updates Cisco ASA Botnet Filter. So, the probability exists, that the information about IP-address reputation from both cloud services will be very similar or even identical.

thank Boris,right now i'm

Viet Bui — Thu, 20 Aug 2015 11:01:42 GMT

thank Boris,

right now i'm going to upgrade my ASA with this module:

Upgrade Kit: ASA5555-X FW, IPS, CX to ASA5555-X FirePower

ASA5555-FP-UPG

ASA5555-CTRL-LIC=

L-ASA5555-TA=

L-ASA5555-TA-1Y

i see here also included IPS license subscription. so that mean i do not need to buy Botnet traffic filter license any more?

thanks,

Hi, Viet.Please, pay an

Boris Uskov — Thu, 20 Aug 2015 11:30:18 GMT

Hi, Viet.

Please, pay an attantion. This upgrade kit is suitable for you, if previously your ASA had CX module installed. In other words, there is no SSD-disk for ASA included in this upgrade kit. Be sure, that your ASA is equipped with SSD-disk. And one more important thing. To configure FirePOWER module on ASA you need to have Defence Center Appliance. The cheapest form of Defence Center for Cisco ASA is Defence Center in form factor of Virtual Appliance for VMWare:
FS-VMW-2-SW-K9
This Defence Center can control and monitor up to two ASAs with FirePOWER module installed.

And, yes, if you'll buy all those parts, you don't need to order ASA Botner Filter licenses to protect your network against Bot-Nets.

Thank so much Boris.My

Viet Bui — Fri, 21 Aug 2015 02:43:58 GMT

Thank so much Boris.

My devices already got these items as you mentioned.

ASA5555-2SSD120-K9

FS-VMW-10-SW-K9

so i think that enough for me to update Firepower services on my devices and i don't need to buy Botnet filter for these devices any more.

thanks,

Hello, Viet. Yes, you have

Boris Uskov — Fri, 21 Aug 2015 06:35:16 GMT

Hello, Viet.

Yes, you have enough to update ASA to FirePOWER. I'm glad, that my answers were helpful.

thank Boris Uskov for your

Viet Bui — Mon, 21 Sep 2015 03:19:48 GMT

thank Boris Uskov for your Reply.

one thing i still concern, can you help me to clarify?

as i see that, if i upgrade an ASA with firepower service. i need also buy FS-VMW-2-SW-K9 for management purpose. So where will the VM be installed? on ASA SSD driver or on an external server?

thank,

Hello, Viet.You need to

Boris Uskov — Mon, 21 Sep 2015 07:02:50 GMT

Hello, Viet.

You need to install VM to ESXi Server. It should be installed separate from ASA.