59-12
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter59 Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
Step4 (Optional) To automatically drop malware traffic, perform the following steps.
To manually drop traffic, see the “Blocking Botnet Traffic Manually” section on page59-13.
a. In the Blacklisted Traffic Actions area, click Add.
The Add Blacklisted Traffic Action dialog box appears.
b. From the Interface drop-down list, choose the interface on which you want to drop traffic. Only
interfaces on which you enabled Botnet Traffic Filter traffic classification are available.
c. In the Threat Level area, choose one of the following options to drop traffic specific threat levels.
The default level is a range between Moderate and Very High.
Note We highly recommend using the default setting unless you have strong reasons for changing
the setting.
•Value—Specify the threat level you want to drop:
–
Very Low
–
Low
–
Moderate
–
High
–
Very High
Note Static blacklist entries are always designated with a Very High threat level.
•Range—Specify a range of threat levels.
d. In the ACL Used area, from the ACL Used drop-down list choose either --ALL TRAFFIC-- (the
default), or any access list configured on the ASA.
Note Be sure the access list is a subset of the traffic you specified in the Traffic Classification area.
To add or edit access lists, click Manage to bring up the ACL Manager. See the “Adding ACLs and
ACEs” section on page21-2 for more information.
e. Click OK.
You return to the Traffic Settings pane.
f. If you want to apply additional rules to a given interface, repeat steps a through e.
Make sure you do not specify overlapping traffic in multiple rules for a given interface. Because you
cannot control the exact order that rules are matched, overlapping traffic means you do not know
which command will be matched. For example, do not specify both a rule that matches --ALL
TRAFFIC-- as well as a command with and access list for a given interface. In this case, the traffic
might never match the command with the access list. Similarly, if you specify multiple commands
with access lists, make sure each access list is unique, and that the networks do not overlap.
Step5 Click Apply.