ASA with FirePOWER, any need for the botnet license?

[mozmorris1974]

1. We are looking to upgrade our ASA from the Legacy IDS/IPS to FirePOWER(need to purchase SSD), we are using the botnet license, would going to FirePOWER make the botnet redundant as sourcefire/firepower does the same job?
2. We are looking to purchase 2 new 5516 for a site with firePOWER so i need to know whether to add botnet to the order.

Cheers

[Marvin Rhoads]

The botnet license is made redundant when you have a licensed FirePOWER module and apply an access policy blocking Botnet CnC connections etc.

The only reason I've seen customers use both is to satisfy an auditor who's interested in checking the  box that says "is botnet filter installed" and won't listen to the explanation that the FirePOWER module accomplishes this function more thoroughly.

[mozmorris1974]

Hi Marvin

I was hoping that you would reply as you seem to be the main man when it comes to firepower.

My customer will do a little cart wheel as they can knock the botnet off next years budget for the 5525X's we have to upgrade.

Thankyou!

[francis56]

On the same note, is it possible to have a trial of the botnet license while in the process to purchase the license ?

[corpengineer818]

With Firepower, I see how 'known malware/botnet' sites can be blocked via URL filtering, as destination addresses.

But how about the case when one is trying to block known malware/botnet sites, as source addresses?  I do not see where this can be configured within Firepower. 

However, I believe that the botnet license does offer this functionality.  Is my understanding correct?

Thank you.

[Marvin Rhoads]

corpengineer818  

You're correct that the URL Filtering policy is used for connections initiated from the inside.

However if you include the Botnet connections in your Access Policy it should address the concern. While in the Intrusion Policy Screen, select Rules in the left pane. When you select rule, you will see numerous categories. Select Rules in the left pane. When you select rule, you will see numerous categories and rules. On the Rules page, type malware into the filter and hit return. The specific rules for Malware should appear. Select the checkbox next to GID to select all malware rules.
Select the Rule State drop-down and choose Drop and Generate events.

You're correct that the URL Filtering policy is used for connections initiated from the inside.

[corpengineer818]

So you are saying to address blocking bad IPs as source address is accomplished w/ an intrusion policy?  I thought the old botnet license functioned differently? Thank you.