Users Guide

482 | Wireless Intrusion Prevention Dell PowerConnect ArubaOS 5.0 | [User Guide
To enable AP learning via the command-line interface, access the CLI in config mode and issue the following
commands:
wms general learn-ap {enable|disable}
Classifying APs
If AP learning is enabled, non-Dell APs connected on the same wired network as Dell APs are classified as valid
APs. If AP learning is disabled, a non-Dell AP is classified as a rogue AP. You can also manually classify an AP. For
example, if you know about an interfering AP, you can manually reclassify it as a known interfering AP. You can
use the WebUI or CLI to manually classify an AP into one of the following categories:
To enable AP learning via the WebUI:
1. Navigate to the Reports > AP Reports> All Interfering APs page on the master controller.
2. Select the checkbox for the AP(s) you want to classify.
3. Click the appropriate Set as button on the page.
4. Click Apply.
To enable AP learning via the command-line interface, access the CLI in config mode and issue the following
commands:
Enter the following command in privilege mode:
wms ap <bssid> mode {dos|interfering|known-interfering|unsecure|valid}
Configuring Misconfigured AP Detection and Protection
An AP is classified as misconfigured if it does not meet any of the following configurable parameters:
z Valid channels
z Encryption type
z Short preamble
Table 101 AP Manual Classification Categories
AP Type Description
Valid AP An AP that is part of the enterprise providing WLAN service. Dell APs that successfully
connect to the controller and load software and configuration should be classified as
valid APs.
NOTE: Any client that successfully authenticates with a valid AP and passes encrypted
traffic is classified as a valid client. (Encrypted traffic includes encrypted 802.11 frames
and unencrypted 802.11 frames which are VPN encrypted.)
Interfering AP An AP that is seen in the RF environment but is not connected to the wired network. An
interfering AP is not considered a direct security threat since it is not connected to the
wired network. For example, an interfering AP can be an AP that belongs to a
neighboring office’s WLAN and is not part of your WLAN network.
Known Interfering AP An interfering AP where the BSSIDs are known. Once classified, a known interfering AP
does not change its state.
Unsecure AP (rogue AP) A rogue AP is an unauthorized AP that is plugged into the wired side of the network. You
can configure automatic shutdown of rogue APs in the IDS unauthorized device
detection profile.
Suspected Unsecure AP A suspected rogue AP is plugged into the wired side of the network, but may not be an
unauthorized device. Automatic rogue containment does not apply to suspected rogue
APs.
DoS AP An AP for which denial of service is enabled. Any clients connected to this AP are
disconnected.