topic botnet filter no longer functions after disk format in Network Security

botnet filter no longer functions after disk format

lcaruso — Mon, 11 Mar 2019 20:54:11 GMT

Hi,

I was having major issues with a 5505 (too long a discussion to go into here) so I formatted the disk and uploaded fresh binaries and recreated my configuration. I noticed the licenses were preserved. I also noticed there were several fsck records after the format that were reclaiming lost chains. I suspect the flash on this ASA is going bad, since everytime it boots it says "reading from flash ..!!" like it cannot even read flash successfully. When I purchased this one new, it also had several fsck records being brand new. I'm going to open a case on these flash issues/questions.

Anyway, after all of the above, the only thing that is not working is the botnet filter. I copied my config line for line, but I don't know why it isn't working:

dynamic-filter updater-client enable
dynamic-filter use-database
dynamic-filter enable 
dynamic-filter enable interface inside 
dynamic-filter enable interface outside 
dynamic-filter drop blacklist 
dynamic-filter drop blacklist interface outside threat-level range moderate very-high
dynamic-filter ambiguous-is-black
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect dns preset_dns_map dynamic-filter-snoop 
  inspect http 
  inspect icmp 
  inspect icmp error 
!
service-policy global_policy global

botnet filter no longer functions after disk format

Jennifer Halim — Mon, 04 Jul 2011 05:05:37 GMT

A couple of things to check:

1) Make sure that your ASA still has the AES/3DES license enabled after reformatting the flash. The output of show version will show you whether it is enabled or disabled. AES/3DES license is required to download the dynamic database.

2) From the above output, you have configured "inspect dns preset_dns_map dynamic-filter-snoop" configured, however, I couldn't find the policy-map created with the name "dynamic-filter-snoop". Can you please confirm if that policy-map has been created to inspect DNS (UDP/53) traffic?

If it hasn't, the following needs to be configured:

class-map dynamic-filter_snoop_class

match port udp eq domain

policy-map dynamic-filter-snoop

class dynamic-filter_snoop_class

Hope that helps.

botnet filter no longer functions after disk format

Kureli Sankar — Mon, 04 Jul 2011 14:36:51 GMT

Is botnet license enabled?

"sh ver" and "sh activation-key detail"

Follow this doc and make sure the configuration in place is correct:

https://supportforums.cisco.com/docs/DOC-8782

-KS

botnet filter no longer functions after disk format

lcaruso — Tue, 05 Jul 2011 01:13:16 GMT

My config was missing those pieces. Nice catch.

botnet filter no longer functions after disk format

lcaruso — Tue, 05 Jul 2011 01:16:48 GMT

Thanks for the help. It seems to be the backup config was missing some commands.