Cisco Systems Adding Entries to the Static Database, Enabling DNS Snooping

26-9
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter26 Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
section on page 26-13.
What to Do Next
See the “Adding Entries to the Static Database” section on page26-9.
Adding Entries to the Static Database
The static database lets you augment the dynamic database with domain names or IP addresses that you
want to blacklist or whitelist. Static blacklist entries are always designated with a Very High threat level.
See the “Information About the Static Database” section on page26-3 for more information.
Prerequisites
•In multiple context mode, perform this procedure in the context execution space.
•Enable ASA use of a DNS server in the Device Management > DNS > DNS Client > DNS Lookup
area. In multiple context mode, enable DNS per context.
Detailed Steps
Step1 Choose the Configuration > Firewall > Botnet Traffic Filter > Black or White List pane, click Add
for the Whitelist or Blacklist.
The Enter hostname or IP Address dialog box appears.
Step2 In the Addresses field, enter one or more domain names, IP addresses, and IP address/netmasks.
Enter multiple entries separated by commas, spaces, lines, or semi-colons. You can enter up to 1000
entries for each type.
Step3 Click OK.
Step4 Click Apply.
What to Do Next
See the “Enabling DNS Snooping” section on page26-9.
Enabling DNS Snooping
This procedure enables inspection of DNS packets and enables Botnet Traffic Filter snooping, which
compares the domain name with those on the dynamic database or static database, and adds the name
and IP address to the Botnet Traffic Filter DNS reverse lookup cache. This cache is then used by the
Botnet Traffic Filter when connections are made to the suspicious address.
Prerequisites
•In multiple context mode, perform this procedure in the context execution space.