dynamic-filter updater-client enable

ciscoasa(config)# dynamic-filter updater-client enable

In multiple context mode, enter this command in the system execution space. If you do not have a database already installed on the ASA, it downloads the database after approximately 2 minutes. The update server determines how often the ASA polls the server for future updates, typically every hour.

changeto context context_name

ciscoasa# changeto context admin
ciscoasa/admin#

dynamic-filter use-database

ciscoasa(config)# dynamic-filter use-database

• In Single mode, choose the Configuration > Firewall > Botnet Traffic Filter > Botnet Database pane, then check the Enable Botnet Updater Client check box.

• In multiple context mode in the System execution space, choose the Configuration > Device Management > Botnet Database pane, then check the Enable Botnet Updater Client check box.

This setting enables downloading of the dynamic database from the Cisco update server. In multiple context mode, enter this command in the system execution space. If you do not have a database already installed on the ASA, it downloads the database after approximately 2 minutes. The update server determines how often the ASA polls the server for future updates, typically every hour.

1. Disable use of the database by unchecking the Use Botnet data dynamically downloaded from updater server check box.

2. Click Apply.

3. Click Purge Botnet Database.

4. To redownload the database, re-check the Use Botnet data dynamically downloaded from updater server check box.

5. Click Apply.

Note	The Fetch Botnet Database button is for testing purposes only; it downloads and verifies the dynamic database, but does not store it in running memory. For information about the Search Dynamic Database area, see Search the Dynamic Database.

dynamic-filter blacklist

ciscoasa(config)# dynamic-filter blacklist

• Add a name to the blacklist:

  name domain_name

ciscoasa(config-llist)# name bad.example.com

You can enter this command multiple times for multiple entries.

• Add an IP address to the blacklist:

  address ip_address mask

ciscoasa(config-llist)# address 10.1.1.1 255.255.255.255

You can enter this command multiple times for multiple entries. The mask can be for a single host or for a subnet.

dynamic-filter whitelist

ciscoasa(config)# dynamic-filter whitelist

• Add a name to the whitelist:

  name domain_name

ciscoasa(config-llist)# name good.example.com

You can enter this command multiple times for multiple entries.

• Add an IP address to the whitelist:

  address ip_address mask

ciscoasa(config-llist)# address 10.1.1.2 255.255.255.255

You can enter this command multiple times for multiple entries. The mask can be for a single host or for a subnet.

Enter multiple entries separated by commas, spaces, lines, or semi-colons. You can enter up to 1000 entries for each type.

class-map name

ciscoasa(config)# class-map dynamic-filter_snoop_class

match parameters

ciscoasa(config-cmap)# match port udp eq domain

For example, you can specify an ACL for DNS traffic to and from certain addresses, or you can specify all UDP DNS traffic.

policy-map name

ciscoasa(config)# policy-map dynamic-filter_snoop_policy

class name

ciscoasa(config-pmap)# class dynamic-filter_snoop_class

inspect dns [ map_name] dynamic-filter-snoop

ciscoasa(config)# policy-map dynamic-filter_snoop_policy

To use the default DNS inspection policy map for the map_name, specify preset_dns_map for the map name.

service-policy policymap_name interface interface_name

ciscoasa(config)# service-policy dynamic-filter_snoop_policy interface outside

The interface-specific policy overrides the global policy. You can only apply one policy map to each interface.

Note	You can also configure DNS snooping directly in the Configuration > Firewall > Service Policy Rules > Rule Actions > Protocol Inspection > Select DNS Inspect Map dialog box by checking the Enable Botnet traffic filter DNS snooping check box.

All existing service rules that include DNS inspection are listed in the table.

access-list access_list_name extended { deny | permit} protocol source_address mask[ operator port ] dest_address mask [ operator port ]

ciscoasa(config)# access-list dynamic-filter_acl extended permit tcp any any eq 80
ciscoasa(config)# access-list dynamic-filter_acl_subset extended permit tcp 10.1.1.0
255.255.255.0 any eq 80

If you do not create an ACL for monitoring, by default you monitor all traffic. You can optionally use an ACL to identify a subset of monitored traffic that you want to drop; be sure the ACL is a subset of the monitoring ACL. See the general operations configuration guide for more information about creating an ACL.

dynamic-filter enable [ interface name] [ classify-list access_list]

ciscoasa(config)# dynamic-filter enable interface outside classify-list dynamic-filter_acl

We recommend enabling the Botnet Traffic Filter on all traffic on the Internet-facing interface using the interface keyword.

You can optionally limit monitoring to specific traffic by using the classify-list keyword with an ACL.

You can enter this command one time for each interface and one time for the global policy (where you do not specify the interface keyword). Each interface and global command can have an optional classify-list keyword. Any interface-specific commands take precedence over the global command.

dynamic-filter drop blacklist [ interface name] [ action-classify-list subset_access_list] [ threat-level { eq level | range min max }]

ciscoasa(config)# dynamic-filter drop blacklist interface outside action-classify-list
dynamic-filter_acl_subset threat-level range moderate very-high

To manually drop traffic, see Block Botnet Traffic Manually.

Be sure to first configure a dynamic-filter enable command to monitor any traffic you also want to drop.

You can set an interface policy using the interface keyword, or a global policy (where you do not specify the interface keyword). Any interface-specific commands take precedence over the global command. You can enter this command multiple times for each interface and global policy.

The action-classify-list keyword limits the traffic dropped to a subset of monitored traffic. The dropped traffic must always be equal to or a subset of the monitored traffic. For example, if you specify an ACL for the dynamic-filter enable command, and you specify the action-classify-list for this command, then it must be a subset of the dynamic-filter enable ACL.

Make sure you do not specify overlapping traffic in multiple commands for a given interface/global policy. Because you cannot control the exact order that commands are matched, overlapping traffic means you do not know which command will be matched. For example, do not specify both a command that matches all traffic (without the action-classify-list keyword) as well as a command with the action-classify-list keyword for a given interface. In this case, the traffic might never match the command with the action-classify-list keyword. Similarly, if you specify multiple commands with the action-classify-list keyword, make sure each ACL is unique, and that the networks do not overlap.

You can additionally limit the traffic dropped by setting the threat level. If you do not explicitly set a threat level, the level used is threat-level range moderate very-high.

Note	We highly recommend using the default setting unless you have strong reasons for changing the setting.

The level and min and max options are:

• very-low

• low

• moderate

• high

• very-high

Note	Static blacklist entries are always designated with a Very High threat level.

dynamic-filter ambiguous-is-black

If you do not enable this command, greylisted traffic will not be dropped. See Botnet Traffic Filter Address Types, for more information about the greylist.

1. In the Traffic Classification area, check the Traffic Classified check box for each interface on which you want to enable the Botnet Traffic Filter.

   You can configure a global classification that applies to all interfaces by checking the Traffic Classified check box for Global (All Interfaces). If you configure an interface-specific classification, the settings for that interface overrides the global setting.

2. For each interface, from the ACL Used drop-down list choose either --ALL TRAFFIC-- (the default), or any ACL configured on the ASA.

   For example, you might want to monitor all port 80 traffic on the outside interface.

   To add or edit ACLs, click Manage ACL to bring up the ACL Manager. See the general operations configuration guide for more information.

If you do not enable this option, greylisted traffic will not be dropped if you configure a rule in the Blacklisted Traffic Actions area. See Botnet Traffic Filter Address Types, for more information about the greylist.

To manually drop traffic, see Block Botnet Traffic Manually.

1. In the Blacklisted Traffic Actions area, click Add.

   The Add Blacklisted Traffic Action dialog box appears.

2. From the Interface drop-down list, choose the interface on which you want to drop traffic. Only interfaces on which you enabled Botnet Traffic Filter traffic classification are available.

3. In the Threat Level area, choose one of the following options to drop traffic specific threat levels. The default level is a range between Moderate and Very High.

   Note	We highly recommend using the default setting unless you have strong reasons for changing the setting.

   • Value—Specify the threat level you want to drop:

     • Very Low

     • Low

     • Moderate

     • high

     • very-high

       Note	Static blacklist entries are always designated with a Very High threat level.

   • Range—Specify a range of threat levels.

4. In the ACL Used area, from the ACL Used drop-down list choose either --ALL TRAFFIC-- (the default), or any ACL configured on the ASA.

   Note	Be sure the ACL is a subset of the traffic you specified in the Traffic Classification area.

   To add or edit ACLs, click Manage to bring up the ACL Manager. See general operations configuration guide for more information.

5. Click OK.

   You return to the Traffic Settings pane.

6. If you want to apply additional rules to a given interface, repeat steps a through e.

   Make sure you do not specify overlapping traffic in multiple rules for a given interface. Because you cannot control the exact order that rules are matched, overlapping traffic means you do not know which command will be matched. For example, do not specify both a rule that matches --ALL TRAFFIC-- as well as a command with and ACL for a given interface. In this case, the traffic might never match the command with the ACL. Similarly, if you specify multiple commands with ACLs, make sure each ACL is unique, and that the networks do not overlap.