topic ASA Botnet dynamic-filter drop in Network Security

ASA Botnet dynamic-filter drop

Sergey Petrenko — Tue, 12 Mar 2019 00:58:27 GMT

Hi,

During the configuration dynamic filter I have error:

dynamic-filter drop blacklist

ERROR: % Invalid input detected at '^' marker.

Show ver result:

---

Cisco Adaptive Security Appliance Software Version 8.2(1)

Device Manager Version 6.2(1)

---

Botnet Traffic Filter : Enabled

----

I try apply this configuration:

hostname(config)# dynamic-filter updater-client enable

hostname(config)# dynamic-filter use-database

hostname(config)# class-map dynamic-filter_snoop_class

hostname(config-cmap)# match port udp eq domain

hostname(config-cmap)# policy-map dynamic-filter_snoop_policy

hostname(config-pmap)# class dynamic-filter_snoop_class

hostname(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop

hostname(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface outside

hostname(config)# dynamic-filter enable interface outside

hostname(config)# dynamic-filter drop blacklist interface outside

Julio Carvajal — Sun, 10 Feb 2013 17:24:00 GMT

Hello Sergey,

That is not the command you need to run

Please follow the next CSC guide and you will accomplish what you are looking for:

Sergey Petrenko — Wed, 13 Feb 2013 10:02:14 GMT

Hi,

Thanks, this guide has help me. I see blacklist site in report of botnet.

Can ASA deny site from blacklist automaticaly?

Julio Carvajal — Wed, 13 Feb 2013 15:12:34 GMT

Hello Sergey,

Yeah that is the whole purpose... The ASA will drop or deny this traffic automatically.

Pretty cool right,

Have a great day

Julio Carvajal