SPAN traffic to ASA Firewall with Botnet feature

[Alfred Berberich]

Hi

I create a SPAN port for all our traffic which goes to the internet .

The fraffic from the span will be directed to the ASA FW where botnet filter is active and which has access to the internet

I suppose the ASA must be configured in transparent mode for  working .

Thats right ?

Any other issues where I have to pay attention ?

sincerely Alfred                   

[Julio Carvajal]

Hello Alfred,

I suppose the ASA must be configured in transparent mode for  working .

Thats right ?

Can you tell me why it should be running transparent mode? I don't see any reason for that

Is the traffic going to go out via the ASA FW to the internet or is this some sort of just monitoring implementation ASA?

Regards

[Alfred Berberich]

Hi

I do not want to actived the botnet feature on a internet firewall and so I thought only to see the infected hosts I can turn the traffic via SPAN to a other firewall where the feature is actived.

Just to see how effective the feature is .

Additional Infos : I think now regardless which mode it is .

regards

[Julio Carvajal]

Hello Alfred,

Well this is a feature that needs the traffic to go through the ASA as that it's how it works,

It see's the DNS A record and determine whether it's a valid good host or a bad known malicious site,

So what I am saying is : Traffic to the internet must traverse this ASA, Queries, Replies,etc. So as long as this traffic goes through it should work. I would say it should work

Let me know if U do not understand me

[Alfred Berberich]

FW configured as routed , SPAN to Interface "inside" activated .

No packet coming in , Interface count nearly null , capture only a few packets .

SPAN delivers 45 MB /sec .

I´am going to configure the fw as transparent now

Any idea why it is not working ?

Why should the fw let the packets in ?

sincerely Alfred

[Alfred Berberich · Accepted solution]

Answer from cisco :

If you want to get this working he mentioned to put this on inline mode, as mirroring would make

Duplicate packets and at some point ASA will see this as spoofed packets.

Reason: if you are mirroring the traffic, this means you have duplicate packets going to the ASA. To get the botnet to work,

This traffic needs to have a destination. So now you have legitimate traffic going out and a duplicate packets (which are mirrored)

Also going out. In return of the packets this will be dropped.

[Julio Carvajal]

Hello Alfred,

Exactly, needs to be inline

For Networking Posts check my blog at http://www.laguiadelnetworking.com/category/english/

Cheers,

Julio Carvajal Segura