Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Wireless Intrusion Prevention | 48 5
Manual Blacklisting
There are several reasons why you may choose to blacklist a client. For example, you can enable different Dell
intrusion detection system (IDS) features that detect suspicious activities, such as MAC address spoofing or
denial of service attacks. When these activities are detected, an event is logged and an SNMP trap is sent with the
client information.To blacklist a client, you need to know its MAC address.
To manually blacklist a client via the WebUI:
1. Navigate to the Monitoring > Controller > Clients page.
2. Select the client to be blacklisted and click the Blacklist button.
To manually blacklist a client via the command-line interface, access the CLI in config mode and issue the
following command:
stm add-blacklist-client <macaddr>
Authentication Failure Blacklisting
You can configure a maximum authentication failure threshold for each of the following authentication methods:
z 802.1x
z MAC
z Captive portal
z VPN
When a client exceeds the configured threshold for one of the above methods, the client is automatically
blacklisted by the controller, an event is logged, and an SNMP trap is sent. By default, the maximum
authentication failure threshold is set to 0 for the above authentication methods, which means that there is no
limit to the number of times a client can attempt to authenticate.
With 802.1x authentication, you can also configure blacklisting of clients who fail machine authentication.
To set the authentication failure threshold via the WebUI:
1. Navigate to the Configuration > Security > Authentication > Profiles page.
2. In the Profiles list, select the appropriate authentication profile, then select the profile instance.
3. Enter a value in the Max Authentication failures field.
4. Click Apply.
To set the authentication failure threshold via the command-line interface, access the CLI in config mode and
issue the following commands:
aaa authentication {captive-portal|dot1x|mac|vpn} <profile>
max-authentication-failures <number>
Attack Blacklisting
There are two type of automatic client blacklisting that can be enabled: blacklisting due to spoofed
deauthentication, or blacklisting due to other types of denial of service (DoS) attacks.
Automatic blacklisting for DoS attacks other than spoofed deauthentication is enabled by default. You can
disable this blacklisting on a per-SSID basis in the virtual AP profile.
Note: When clients are blacklisted because they exceed the authentication failure threshold, they are blacklisted indefinitely by
default. You can configure the duration of the blacklisting; see “Blacklist Duration” on page 486.