ASA5545 x BOTNET license question

[Steve Coady]

We have an ASA BOTNET license. Should this be enabled "Globally"?

[Murali · Accepted solution]

Hi ,

you have the license key and wanted to activate or want to configure botnet features?

You can apply the license by normal activation-key command and if you want to configure below is the guide.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_botnet.html#wp1129967

HTH

Murali

[Steve Coady]

Murali

Thank you for the response.

I have activated the license. I was on the GUI/Botnet filter?Botnet setting and Traffic Settings (interface options).

None of the options are selected so how is the Botnet function going to detect anything?

[Murali]

Okay i got it, it'll give you an option to enable it on individual interfaces or global(all interfaces). Generally its applied on the outside interfaces.

But before doing that you need to configure few things as mentioned in the document. Below is short summary.

1.Enable DNS
Configuration-->Devic management -->DNS-->DNS Client
2.Enable DNS Snooping
Configuration-->Firewall-->Botnet Traffic Filter-->DNS Snooping
3.Enable client & use dynamic database
Configuration-->Firewall-->Botnet Traffic Filter-->Botnet Database
4.Create static Black/white lists(optoinal )
Configuration-->Firewall-->Botnet Traffic Filter-->Black and White Lists
5.Specify action
Configuration-->Firewall-->Botnet Traffic Filter-->Traffic settings

HTH

Murali

(please mark this as answer if it resolved/answered your problem/question)

[Steve Coady]

Murali

What exactly does the Botnet license do?

Will it deny traffic?