botnet filter no longer functions after disk format

[lcaruso]

Hi,

I was having major issues with a 5505 (too long a discussion to go into here) so I formatted the disk and uploaded fresh binaries and recreated my configuration. I noticed the licenses were preserved. I also noticed there were several fsck records after the format that were reclaiming lost chains. I suspect the flash on this ASA is going bad, since everytime it boots it says "reading from flash ..!!" like it cannot even read flash successfully. When I purchased this one new, it also had several fsck records being brand new. I'm going to open a case on these flash issues/questions.

Anyway, after all of the above, the only thing that is not working is the botnet filter. I copied my config line for line, but I don't know why it isn't working:

dynamic-filter updater-client enable
dynamic-filter use-database
dynamic-filter enable 
dynamic-filter enable interface inside 
dynamic-filter enable interface outside 
dynamic-filter drop blacklist 
dynamic-filter drop blacklist interface outside threat-level range moderate very-high
dynamic-filter ambiguous-is-black
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect dns preset_dns_map dynamic-filter-snoop 
  inspect http 
  inspect icmp 
  inspect icmp error 
!
service-policy global_policy global

[Jennifer Halim · Accepted solution]

A couple of things to check:

1) Make sure that your ASA still has the AES/3DES license enabled after reformatting the flash. The output of show version will show you whether it is enabled or disabled. AES/3DES license is required to download the dynamic database.

2) From the above output, you have configured "inspect dns preset_dns_map dynamic-filter-snoop" configured, however, I couldn't find the policy-map created with the name "dynamic-filter-snoop". Can you please confirm if that policy-map has been created to inspect DNS (UDP/53) traffic?

If it hasn't, the following needs to be configured:

class-map dynamic-filter_snoop_class

     match port udp eq domain

policy-map dynamic-filter-snoop

     class dynamic-filter_snoop_class

Hope that helps.

[Kureli Sankar · Accepted solution]

Is botnet license enabled?

"sh ver" and "sh activation-key detail"

Follow this doc and make sure the configuration in place is correct:

https://supportforums.cisco.com/docs/DOC-8782

-KS

[lcaruso]

Thanks for the help. It seems to be the backup config was missing some commands.

[lcaruso]

My config was missing those pieces. Nice catch.