Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Wireless Intrusion Prevention | 48 3
z List of valid AP MAC OUIs
z Valid SSID list (exceptions are described in “Valid Enterprise SSIDs” on page 483)
This classification is primarily for enforcing security policies on non-Dell APs, although the classification and
protection mechanism also applies to all valid Dell APs.
Valid Enterprise SSIDs
SSIDs added to the Valid Enterprise SSID list are known as “Valid SSIDs” or “Reserved SSIDs.” The list is empty
by default and does not contain any SSIDs configured on the controller. You can add SSIDs to the list using the
WebUI or CLI.
To add or remove SSIDs from the Valid Enterprise SSID list via the WebUI:
1. Navigate to the Configuration > Advanced Services> All Profiles
2. In the profiles list on the left window pane, expand the IDS menu
3. Expand the IDS Unauthorized Device Profile menu.
4. In the profiles list, select the name of the profile to which you want to add a valid SSID.
5. Scroll down to the Valid and Protected SSIDs section.
z To add an SSID, Enter the name of the SSID, then click Add.
z To remove an SSID, select an SSID from the list, then click Delete.
6. Click Apply to save your changes.
To add or remove SSIDs from the list via the command-line interface, access the CLI in config mode and issue
the following commands:
ids unauthorized-device-profile valid-and-protected-ssid [no] <ssid>
As part of its function, Multi-Tenancy protection prevents an interfering AP from advertising an SSID that is
added to the Valid Enterprise SSID list. This feature protects against honeypot attacks. Misconfigured AP
protection also uses the Valid Enterprise SSID list to classify an AP as misconfigured.
Whether a client can connect to an SSID depends on if a Multi-Tenancy protection or Misconfigured AP
protection are enabled or disabled, whether the AP is valid or interfering, and whether the SSID is in the Valid
Enterprise SSID list. Table 102 describes client connections to valid and non-valid SSIDs when Multi-Tenancy
protection and Misconfigured AP protection are enabled or disabled.
Table 102 Valid SSIDs with Multi-Tenancy and Misconfigured AP Protection
Multi-Tenancy
Protection
Misconfigured
AP Protection
Client Connections
Enabled Disabled If there are entries in the valid SSID list:
z Clients can connect to valid SSIDs on valid APs.
z Clients cannot connect to valid SSIDs on interfering APs (including known
interfering APs).
z Clients can connect to SSIDs not in the valid SSID list on valid APs.
z Clients can connect to SSIDs not in the valid SSID list on interfering APs
(including known interfering APs).
If the valid SSID list is empty, it is ignored and clients can connect to all SSIDs on
both valid APs and interfering APs (including known interfering APs). Not adding
an SSID to the valid SSID list exposes that SSID to honeypot attacks.