Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1409 / 2164

1-3
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the Botnet Traffic Filter
Information About the Botnet Traffic Filter
2.
When the infected host starts a connection to the IP address of the malware site, then the ASA sends
a syslog message informing you of the suspicious activity and optionally drops the traffic if you
configured the ASA to do so.
3.
In some cases, the IP address itself is supplied in the dynamic database, and the Botnet Traffic Filter
logs or drops any traffic to that IP address without having to inspect DNS requests.
Database Files
The database files are downloaded from the Cisco update server, and then stored in running memory;
they are not stored in flash memory. Be sure to identify a DNS server for the ASA so that it can access
the Cisco update server URL. In multiple context mode, the system downloads the database for all
contexts using the admin context interface; be sure to identify a DNS server in the admin context.
If you need to delete the database, use the dynamic-filter database purge command instead. Be sure to
first disable use of the database by entering the no dynamic-filter use-database command.
Note
To filter on the domain names in the dynamic database, you need to enable DNS packet inspection with
Botnet Traffic Filter snooping; the ASA looks inside the DNS packets for the domain name and
associated IP address.
Database Traffic Types
The dynamic database includes the following types of addresses:
•
Ads—These are advertising networks that deliver banner ads, interstitials, rich media ads, pop-ups,
and pop-unders for websites, spyware and adware. Some of these networks send ad-oriented HTML
emails and email verification services.
•
Data Tracking—These are sources associated with companies and websites that offer data tracking
and metrics services to websites and other online entities. Some of these also run small advertising
networks.
•
Spyware—These are sources that distribute spyware, adware, greyware, and other potentially
unwanted advertising software. Some of these also run exploits to install such software.
•
Malware—These are sources that use various exploits to deliver adware, spyware and other malware
to victim computers. Some of these are associated with rogue online vendors and distributors of
dialers which deceptively call premium-rate phone numbers.
•
Adult—These are sources associated with adult networks/services offering web hosting for adult
content, advertising, content aggregation, registration & billing, and age verification. These may be
tied to distribution of adware, spyware, and dialers.
•
Bot and Threat Networks—These are rogue systems that control infected computers. They are either
systems hosted on threat networks or systems that are part of the botnet itself.
Information About the Static Database
You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names
in a blacklist. Static blacklist entries are always designated with a Very High threat level. You can also
enter names or IP addresses in a whitelist, so that names or addresses that appear on both the
dynamic
blacklist and the whitelist are identified only as whitelist addresses in syslog messages and reports. Note
that you see syslog messages for whitelisted addresses even if the address is not also in the dynamic
blacklist.