Users Guide

170 | Using RAPIDS and Rogue Classification Dell PowerConnect W AirWave 7.2 | User Guide
 “Rogue Device Threat Level” on page171
 “Viewing and Configuring RAPIDS Rules” on page171
 “Recommended RAPIDS Rules” on page173
 “Using RAPIDS Rules with Additional AWMS Functions” on page174
Controller Classification with WMS Offload
This classification method is supported only when WMS offload is enabled on Dell WLAN controllers.
Controller classification of this type remains distinct from RAPIDS classification. WLAN switches feed wireless
device information to AWMS, which AWMS then processes. AWMS then pushes the WMS classification to all
of the ArubaOS controllers that are WMS offload enabled.
WMS Offload ensures that a particular BSSID has the same classification on all of the controllers. WMS Offload
removes some load from master controllers and feeds 'connected-to-lan' information to the RAPIDS classification
engine. RAPIDS classifications and controller classifications are separate and often are not synchronized.
The following table compares how default classification may differ between AWMS and ArubaOS for scenarios
involving WMS Offload.
For additional information about WMS Offload, refer to the Best Practices Guide in Home > Documentation.
Device OUI Score
The Organizationally Unique Identifier (OUI) score is based on the LAN MAC address of a device. RAPIDS can
be configured to poll your routers and switches for the bridge forwarding tables. RAPIDS then takes the MAC
addresses from those tables and runs them through a proprietary database to derive the OUI score. The OUI score
of each device is viewable from each rogue’s detail page. Table 98 provides list the OUI scores definitions.
NOTE: RAPIDS classification is not pushed to the devices.
Table 97 Rogue Device Classification Matrix
AWMS AOS (ARM)
Unclassified (default state) Unknown
Rogue Rogue
Suspected Neighbor Interfering
Neighbor Known Interfering
Valid Valid
Contained Rogue DOS
Table 98 Device OUI Scores
Score Description
Score of 1 Indicates any device on the network; this is the lowest threat level on the network.
Score of 2 Indicates any device in which the OUI belongs to a manufacturer that produces wireless (802.11) equipment.
Score of 3 Indicates that the OUI matches a block that contains APs from vendors in the Enterprise and small office/ small
home market.
Score of 4 Indicates that the OUI matches a block that belonged to a manufacturer that produces small office/ small home
access points.