Users Guide

544 | Wireless Intrusion Prevention Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
Example Rules
If SSID equals xyz AND SNR > 40 then classify AP as suspected-rogue with conf-level-increment of 20
If SNR > 60 and DISCOVERING_APS > 2, then classify AP as suspected-rogue with conf-level increment of
35
If SSID equals ‘XYZ’, then classify AP as known-neighbor
Rule Matching
A rule must be enabled before it is matched. A maximum of 32 rules can be created with a maximum of 16 rules
active simultaneously. If a rule matches, an AP is classified to:
 Suspected-Rogue—an associated confidence-level is provided (minimum is 5%)
 Neighbor
The following mechanism is used for rule matching.
 When all the conditions specified in the rule evaluate to true, the rule matches.
 If multiple rules match causing the AP to be classified as a Suspected-Rogue, the confidence level of each rule
is aggregated to determine the confidence level of the classification.
 When multiple rules match and any one of those matching rules cause the AP to be classified as a Neighbor,
then the AP is classified as Neighbor.
 APs classified as either Neighbor or Suspected-Rogue will attempted to match any configured AP rule.
 Once a rule matches an AP, the same rule will not be checked for the AP.
 When the controller reboots, no attempt to match a previously matched AP is made.
 If a rule is disabled or modified, all APs that were previously classified based on that rule will continue to be in
the newly classified state.
Intrusion Detection
This section covers Infrastructure and Client Intrusion Detections.
Infrastructure Intrusion Detection
Detecting attacks against the infrastructure is critical in avoiding attacks that may lead to a large-scale Denial of
Service (DOS) attack or a security breach. This group of features detects attacks against the WLAN
infrastructure, which consists of authorized APs, the RF medium, and the wired network. An authorized or valid-
AP is defined as an AP that belongs to the WLAN infrastructure. The AP is either an Dell AP or a third party AP.
ArubaOS automatically learns authorized Dell APs.
Table 107 presents a summary of the Intrusion infrastructure detection features with their related commands,
traps, and syslog identification. Feature details follow the table.
Table 107 Infrastructure Detection Summary
Feature Command Trap Syslog ID
Detect 802.11n 40MHz
Intolerance Setting
ids dos-profile
detect-ht-40mhz-intolerance
client-ht-40mhz-intol-quiet-
time
wlsxHT40MHzIntoleranceAP
wlsxHT40MHzIntoleranceSta
126052, 126053, 127052,
127053
Detect Active 802.11n
Greenfield Mode
ids unauthorized-device-profile
detect-ht-greenfield
wlsxHtGreenfieldSupported 126054, 127054