Reference Guide

262 | ids unauthorized-device-profile Dell PowerConnect ArubaOS 5.0 Command Line Interface | Reference Guide
Syntax
Parameter Description Range Default
<profile> Name that identifies an instance of the profile. The name must be 1-63
characters.
— “default”
adhoc-quiet-
time
Time, in seconds, that must elapse after an adhoc network detection alarm
has been triggered before another identical alarm may be triggered.
60-360000 900
seconds
allow-well-
known-mac
Allows devices with known MAC addresses to classify rogues APs.
Depending on your network, configure one or more of the following options
for classifying rogue APs:
hsrp—Routers configured for HSRP, a Cisco-proprietary redundancy
protocol, with the HSRP MAC OUI 00:00:0c.
iana—Routers using the IANA MAC OUI 00:00:5e.
local-mac—Devices with locally administered MAC addresses starting with
02.
vmware—Devices with any of the following VMWare OUIs: 00:0c:29, 00:05:69,
or 00:50:56
vmware1—Devices with VMWare OUI 00:0c:29.
vmware2—Devices with VMWare OUI 00:05:69.
vmware3—Devices with VMWare OUI 00:50:56.
If you modify an existing configuration, the new configuration overrides the
original configuration. For example, if you configure allow-well-
known-mac hsrp and then configure allow-well-known-mac
iana, the original configuration is lost. To add more options to the original
configuration, include all of the required options, for example: allow-
well-known-mac hsrp iana.
Use caution when configuring this command. If the neighboring network uses
similar routers, those APs might be classified as rogues. If containment is
enabled, clients attempting to associate to an AP classified as a rogue are
disconnected through a denial of service attack.
To clear the well known MACs in the system, use the following commands on
all controllers:
clear wms wired-mac
This clears all of the learned wired MAC information on the controller.
reload
This reboots the controller.
——
cfg-valid-11a-
channel
List of valid 802.11a channels that third-party APs are allowed to use. 34-165 N/A
cfg-valid-11g-
channel
List of valid 802.11b/g channels that third-party APs are allowed to use. 1-14 N/A
classification Enable/disable rogue AP classification. A rogue AP is one that is
unauthorized and plugged into the wired side of the network. Any other AP
seen in the RF environment that is not part of the valid enterprise network is
considered to be interfering — it has the potential to cause RF interference
but it is not connected to the wired network and thus does not represent a
direct threat.
—true
clone Name of an existing IDS rate thresholds profile from which parameter values
are copied.
——
detect-adhoc-
network
Enable detection of adhoc networks. — true
detect-bad-wep Enables detection of WEP initialization vectors that are known to be weak
and/or repeating. A primary means of cracking WEP keys is to capture 802.11
frames over an extended period of time and search for implementations that
are still used by many legacy devices.
—false
detect-ht-
greenfield
Enables or disables detection of high-throughput devices advertising
greenfield preamble capability.
—true