Cisco ASA Series Cli Configuration Manual page 1418

Configuring the Botnet Traffic Filter
Command
Step 5
inspect dns [map_name]
dynamic-filter-snoop
Example:
hostname(config-pmap-c)# inspect dns
preset_dns_map dynamic-filter-snoop
Step 6
service-policy policymap_name interface
interface_name
Example:
hostname(config)# service-policy
dynamic-filter_snoop_policy interface
outside
Examples
The following recommended configuration creates a class map for all UDP DNS traffic, enables DNS
inspection and Botnet Traffic Filter snooping with the default DNS inspection policy map, and applies
it to the outside interface:
hostname(config)# class-map dynamic-filter_snoop_class
hostname(config-cmap)# match port udp eq domain
hostname(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname(config-pmap)# class dynamic-filter_snoop_class
hostname(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface outside
What to Do Next
See the
Enabling Traffic Classification and Actions for the Botnet Traffic Filter
This procedure enables the Botnet Traffic Filter. The Botnet Traffic Filter compares the source and
destination IP address in each initial connection packet to the following:
•
•
•
•
When an address matches, the ASA sends a syslog message. The only additional action currently
available is to drop the connection.
Prerequisites
In multiple context mode, perform this procedure in the context execution space.
Cisco ASA Series CLI Configuration Guide
1-12
"Enabling Traffic Classification and Actions for the Botnet Traffic Filter" section on page
Dynamic database IP addresses
Static database IP addresses
DNS reverse lookup cache (for dynamic database domain names)
DNS host cache (for static database domain names)
Chapter 1
Purpose
Enables DNS inspection with Botnet Traffic Filter snooping. To
use the default DNS inspection policy map for the map_name,
specify preset_dns_map for the map name. See the
Inspection" section on page 46-1
creating a DNS inspection policy map.
Activates the policy map on an interface. The interface-specific
policy overrides the global policy. You can only apply one policy
map to each interface.
Configuring the Botnet Traffic Filter
"DNS
for more information about
1-12.