Users Guide

476 | Wireless Intrusion Prevention Dell PowerConnect ArubaOS 5.0 | [User Guide
Overlay Rogue Classification Overlay Rogue Classification is classification through valid/rogue APs. A controller uses the
wired-mac table of other valid and rogue APs as equivalents of the wired MACs that it sees
on our network. When this match is triggered, it makes a note of the AP that helped in this
process, and this info will be displayed as the Helper-AP. By default, Overlay Rogue
Classification is disabled in ArubaOS 2.x but enabled in later versions of ArubaOS.
Default: enabled
Valid Wired Macs List of MAC addresses of wired devices in the network, typically gateways or servers.
Rogue Containment By default, rogue APs are only detected but are not automatically disabled. This option
automatically shuts down rogue APs. When this option is enabled, clients attempting to
associate to a rogue AP will be disconnected from the rogue AP through a denial of service
attack.
Default: disabled
Allow Well Known MAC Allows devices with known MAC addresses to classify rogues APs.
Depending on your network, configure one or more of the following options for classifying
rogue APs:
z hsrp—Routers configured for HSRP, a Cisco-proprietary redundancy protocol, with the
HSRP MAC OUI 00:00:0c.
z iana—Routers using the IANA MAC OUI 00:00:5e.
z local-mac—Devices with locally administered MAC addresses starting with 02.
z vmware—Devices with any of the following VMWare OUIs: 00:0c:29, 00:05:69, or 00:50:56
z vmware1—Devices with VMware OUI 00:0c:29.
z vmware2—Devices with VMware OUI 00:05:69.
z vmware3—Devices with VMware OUI 00:50:56.
If you modify an existing configuration, the new configuration overrides the original
configuration. For example, if you configure allow-well-known-mac hsrp and then configure
allow-well-known-mac iana, the original configuration is lost. To add more options to the
original configuration, include all of the required options, for example: allow-well-known-
mac hsrp iana.
NOTE: Use caution when configuring this command. If the neighboring network uses similar
routers, those APs might be classified as rogues. If containment is enabled, clients
attempting to associate to an AP classified as a rogue are disconnected through a denial of
service attack.
To clear the well known MACs in the system, issue the following CLI commands pm all
controllers:
1. clear wms wired-mac
This clears all of the learned wired MAC information on the controller.
2. reload
This reboots the controller.
Suspected Rogue Containment Suspected rogue APs are treated as interfering APs, thereby the controller attempts to
reclassify them as rogue APs. By default, suspected rogue APs are not automatically
contained.
In combination with the suspected rogue containment confidence level, this option
automatically shuts down suspected rogue APs. When this option is enabled, clients
attempting to associate to a suspected rogue AP will be disconnected from the suspected
rogue AP through a denial of service attack.
Default: disabled
Suspected Rogue Containment
Confidence Level
When an AP is classified as a suspected rogue AP, it is assigned a 50% confidence level. If
multiple APs trigger the same events that classify the AP as a suspected rogue, the
confidence level increases by 5% up to 95%.
In combination with suspected rogue containment, this option configures the threshold by
which containment should occur. Suspected rogue containment occurs only when the
configured confidence level is met.
Default: 60%
Table 98 IDS Unauthorized Device Profile Configuration Parameters (Continued)
Parameter Description