Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Wireless Intrusion Prevention | 47 5
Creating a New Signature via the CLI
To configure this profile via the command-line interface, access the CLI in config mode and issue the following
commands:
ids signature-profile <profile>
bssid <macaddr>
clone <profile>
dst-mac <macaddr>
frame-type {assoc|auth|beacon|control|data|deauth|disassoc|mgmt|probe-request|
probe-response} [ssid <ssid>] [ssid-length <bytes>]
payload <pattern> [offset <number>]
seq-num <number>
src-mac <macaddr>
Unauthorized Device Detection
Table 98 describes the parameters (and their defaults) you can configure in the IDS unauthorized device
detection profile. There is also one default profile and three predefined unauthorized device profiles, each of
which provides different levels of detection and containment, as described in “Default and Predefined IDS
Unauthorized Device Profiles” on page 478.
Table 98 IDS Unauthorized Device Profile Configuration Parameters
Parameter Description
Detect Adhoc Networks Enable or disable detection of adhoc networks.
Default: enabled
Protect from Adhoc Networks Enable or disable protection from adhoc networks. When adhoc networks are detected, they
are disabled using a denial of service attack.
Default: disabled
Detect Windows Bridge Enable or disable detection of Windows station bridging.
Default: enabled
Detect Wireless Bridge Enable or disable detection of wireless bridging.
Default: enabled
Detect Devices with an Invalid
MAC OUI
Enables or disables the checking of the first three bytes of a MAC address, known as the
MAC organizationally unique identifier (OUI), assigned by the IEEE to known manufacturers.
Often clients using a spoofed MAC address do not use a valid OUI and instead use a
randomly generated MAC address. Enabling MAC OUI checking causes an alarm to be
triggered if an unrecognized MAC address is in use.
Default: disabled
MAC OUI detection Quiet Time The time, in seconds, that must elapse after an invalid MAC OUI alarm has been triggered
before another identical alarm may be triggered.
Default: 900 seconds
Adhoc Network detection Quiet
Time
The time, in seconds, that must elapse after an adhoc network detection alarm has been
triggered before another identical alarm may be triggered.
Default: 900 seconds
Wireless Bridge detection Quiet
Time
The time, in seconds, that must elapse after a wireless bridging alarm has been triggered
before another identical alarm may be triggered.
Default: 900 seconds
Rogue AP Classification Enable or disable rogue AP classification. A rogue AP is one that is unauthorized and
plugged into the wired side of the network. Any other AP seen in the RF environment that is
not part of the valid enterprise network is considered to be “interfering” — it has the
potential to cause RF interference but it is not connected to the wired network and thus does
not represent a direct threat.
Default: enabled