Users Guide

5. Select (check) Spoofed Deauth Blacklist.
6. Click Apply.
To enabled spoofed deauth detection and blacklisting via the command-line interface, access the CLI in config
mode, and issue the following commands:
ids dos-profile <profile>
spoofed-deauth-blacklist
Setting Blacklist Duration
You can configure the duration that clients are blacklisted on a per-SSID basis via the virtual AP profile. There
are two different blacklist duration settings:
l For clients that are blacklisted due to authentication failure. By default, this is set to 0 (the client is
blacklisted indefinitely).
l For clients that are blacklisted due to other reasons, including manual blacklisting. By default, this is set to
3600 seconds (one hour). You can set this to 0 to blacklist clients indefinitely.
To configure the blacklist duration via the WebUI:
1. Navigate to the Configuration > Wireless > AP Configuration page.
2. Select either AP Group or AP Specific tab. Click Edit for the AP group or AP name.
3. In the Profiles list, select Wireless LAN, then Virtual AP. Select the virtual AP instance.
n To set a blacklist duration for authentication failure, enter a value for Authentication Failure
Blacklist Time.
n To set a blacklist duration for other reasons, enter a value for Blacklist Time.
4. Click Apply.
To configure the blacklist duration via the command-line interface, access the CLI in config mode and issue the
following commands:
wlan virtual-ap <profile>
auth-failure-blacklist-time <seconds>
blacklist-time <seconds>
Removing a Client from Blacklisting
You can manually remove a client from blacklisting using either the WebUI or CLI:
To remove a client from blacklisting via the WebUI:
1. Navigate to the Monitoring > Controller > Blacklist Clients page.
2. Select the client that you want to remove from the blacklist, then click Remove from Blacklist.
To remove a client from blacklisting via the command-line interface, access the CLI in enable mode and issue
the following command:
stm remove-blacklist-client <macaddr>
Working with WIP Advanced Features
Device Classification is the first step in securing the corporate environment from unauthorized wireless access.
Adequate measures that quickly shut down intrusions are critical in protecting sensitive information and
network resources. APs and stations must be accurately classified to determine whether they are valid, rogue,
or a neighboring AP. Then, an automated response can be implemented to prevent possible intrusion
attempts.
Dell Networking W-Series ArubaOS 6.4.x | User Guide Wireless Intrusion Prevention |
560