Cisco Systems CL-28826-01 Enabling DNS Snooping, Enabling Traffic Classification and Actions for the Botnet Traffic Filter

19-6
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 19 Managing Firewall Botnet Traffic Filter Rules
Task Flow for Configuring the Botnet Traffic Filter
Step 4 Click OK.
Enabling DNS Snooping
This procedure enables inspection of DNS packets and enables Botnet Traffic Filter snooping, which
compares the domain name with those on the dynamic database or static database, and adds the name
and IP address to the Botnet Traffic Filter DNS reverse lookup cache. This cache is then used by the
Botnet Traffic Filter logging function when connections are made to the suspicious address.
The default configuration for DNS inspection inspects all UDP DNS traffic on all interfaces, and does
not have Botnet Traffic Filter snooping enabled. We suggest that you enable Botnet Traffic Filter
snooping only on interfaces where external DNS requests are going. Enabling Botnet Traffic Filter
snooping on all UDP DNS traffic, including that going to an internal DNS server, creates unnecessary
load on the security appliance.
Note TCP DNS traffic is not supported.
Related Topics
•Configure DNS Dialog Box, page 17-18
•Understanding Botnet Traffic Filtering, page19-1
•Task Flow for Configuring the Botnet Traffic Filter, page19-2
•Configuring the Dynamic Database, page 19-4
•Adding Entries to the Static Database, page 19-5
•Enabling Traffic Classification and Actions for the Botnet Traffic Filter, page 19-6
•Botnet Traffic Filter Rules Page, page19-9
Step 1 You must first configure DNS inspection for traffic that you want to snoop using the Botnet Traffic Filter.
See Chapter 17, “Managing Firewall Inspection Rules”.
Step 2 While defining a new inspection rule or editing an existing inspection rule, select DNS as the protocol
you want to inspect.
The Configure button to the right of the Selected Protocol field becomes active.
Step 3 Click Configure.
This opens the Configure DNS Dialog Box, page 17-18.
Step 4 To enable DNS snooping, select Enable Dynamic Filter Snooping.
Step 5 Click OK.
Enabling Traffic Classification and Actions for the Botnet Traffic Filter
This procedure enables the Botnet Traffic Filter, which compares the source and destination IP address
in each initial connection packet to the IP addresses in the dynamic database, static database, DNS
reverse lookup cache, and DNS host cache, and sends a syslog message for any matching traffic. The