Users Guide

486 | Wireless Intrusion Prevention Dell PowerConnect ArubaOS 5.0 | [User Guide
Man in the middle (MITM) attacks begin with an intruder impersonating a valid enterprise AP. If an AP needs to
reboot, it sends deauthentication packets to connected clients to enable them to disconnect and reassociate with
another AP. An intruder or attacker can spoof deauthentication packets, forcing clients to disconnect from the
network and reassociate with the attacker’s AP.
A valid enterprise client associates to the intruder’s AP, while the intruder then associates to the enterprise AP.
Communication between the network and the client flows through the intruder (the man in the middle), thus
allowing the intruder the ability to add, delete, or modify data. When this type of attack is identified by the Dell
system, the client can be blacklisted, blocking the MITM attack. Enable this blacklisting ability in the IDS DoS
profile (this is disabled by default).
To enable spoofed deauth detection and blacklisting via the WebUI:
1. Navigate to the Configuration > Wireless > AP Configuration page.
2. Select either AP Group or AP Specific tab. Click Edit for the AP group or AP name.
3. In the Profiles list, expand the IDS menu, then select IDS profile.
4. Select the IDS DOS profile.
5. Select (check) Spoofed Deauth Blacklist.
6. Click Apply.
To enabled spoofed deauth detection and blacklisting via the command-line interface, access the CLI in config
mode, and issue the following commands:
ids dos-profile <profile>
spoofed-deauth-blacklist
Blacklist Duration
You can configure the duration that clients are blacklisted on a per-SSID basis via the virtual AP profile. There
are two different blacklist duration settings:
z For clients that are blacklisted due to authentication failure. By default, this is set to 0 (the client is
blacklisted indefinitely).
z For clients that are blacklisted due to other reasons, including manual blacklisting. By default, this is set to
3600 seconds (one hour). You can set this to 0 to blacklist clients indefinitely.
To configure the blacklist duration via the WebUI:
1. Navigate to the Configuration > Wireless > AP Configuration page.
2. Select either AP Group or AP Specific tab. Click Edit for the AP group or AP name.
3. In the Profiles list, select Wireless LAN, then Virtual AP. Select the virtual AP instance.
 To set a blacklist duration for authentication failure, enter a value for Authentication Failure Blacklist
Time.
 To set a blacklist duration for other reasons, enter a value for Blacklist Time.
4. Click Apply.
To configure the blacklist duration via the command-line interface, access the CLI in config mode and issue the
following commands:
wlan virtual-ap <profile>
auth-failure-blacklist-time <seconds>
blacklist-time <seconds>