topic ASA Botnet Filter in Network Security

ASA Botnet Filter

kdietz — Tue, 12 Mar 2019 02:46:09 GMT

I have recently added the Botnet filter license to an ASA5510. Im needing assistance with viewing the config and being able to know that it is working. How can i test? Thanks

ASA Botnet Filter

Karsten Iwen — Wed, 02 Oct 2013 14:29:01 GMT

Here is a document that should get you started:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/white_paper_c11-532091.html

If there are more questions after going through that doc, fell free to ask.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA Botnet Filter

johnlloyd_13 — Thu, 03 Oct 2013 03:53:10 GMT

hi kevin,

here's some show commands as per my FIREWALL notes and a useful link that i've bookmarked.

usually the ASA will generate a syslog if a bad or infected machine is detected.

https://supportforums.cisco.com/docs/DOC-8782

Commands to Verify Botnet Traffic Filtering Operation

Function Command Syntax

Dynamic database status ciscoasa# show dynamic-filter updater-client

Connections filtered ciscoasa# show dynamic-filter statistics

List infected hosts ciscoasa# show dynamic-filterreport infected-hosts

Top-n botnet activity ciscoasa# show dynamic-filter top [infected-hosts | malware-ports | malware-sites]

ASA Botnet Filter

rmujeeb81 — Fri, 04 Oct 2013 12:40:45 GMT

Hi,

I have to enable botnet filter as well for one of our customer. So is it possible to enable botnet filter in monitoring mode only, means without dropping any traffic or impacting the production environment ?

Thanks

ASA Botnet Filter

johnlloyd_13 — Tue, 08 Oct 2013 04:15:49 GMT

hi,

the answer is no. the ASA will intercept DNS queries and match it against the configured blacklist sites on its database and drops the traffic.

ASA Botnet Filter

kdietz — Fri, 11 Oct 2013 17:38:07 GMT

My filter was origanly set to monitor mode which wasnt dropping the malicous requests - Scenerio; I have a DNS server where the filter is detecting as a malicouis host naking DNS requests. My question is, does this necessarily imply that the DNS server is infected or is it another host on my network using this DNS server for name resolution.