Dell PowerConnect W-AirWave 7.6 User Manual download pdf (Page 190)

178 | Using RAPIDS and Rogue Classification Dell PowerConnect W-AirWave 7.6 | User Guide

Option Description

Operating System

Rogue matches OS criteria. Specify matching or non-matching OS criteria as prompted by the

fields.

Wireless/Wireline Properties

Manufacturer

Rogue matches the manufacturer information of the rogue device. Specify matching or non-

matching manufacturer criteria.

MAC Address

Rogue matches the MAC address. Specify matching or non-matching address criteria, or use a

wildcard (*) for partial matches.

Dell Controller Properties

Controller Classification Rogue matches the specified controller classification.

Confidence Rogue falls within a specified minimum and maximum confidence level, ranging from 1 to 100.

After creating a new rule, select Add to return to the RAPIDS > Rules page. Select Save and Apply to have the new

rule take effect.

Deleting or Editing a Rule

To delete a rule from the RAPIDS rules list, go to the RAPIDS > Rules page. Select the check box next to the rule

you want to delete, and select Delete. The rule is automatically deleted from RAPIDS > Rules.

To edit any existing rule, select its pencil icon to launch the RAPIDS Classification Rule page (see Figure 120).

Edit or revise the fields as necessary, then select Save.

To change the sequence in which rules apply to any rogue device, drag and drop the rule to a new position in the

rules sequence.

Recommended RAPIDS Rules

l If Any Device Has Your SSID, then Classify as Rogue

The only devices broadcasting your corporate SSID should be devices that you are aware of and are managed by

AirWave. Rogue devices often broadcast your official SSID in an attempt to get access to your users, or to trick

your users into providing their authentication credentials. Devices with your SSID generally pose a severe threat.

This rule helps to discover, flag, and emphasize such a device for prompt response on your part.

l If Any Device Has Your SSID and is Not an Ad-Hoc Network Type, then Classify as Rogue

This rule classifies a device as a rogue when the SSID for a given device is your SSID and is not an Ad-Hoc

device. Windows XP automatically tries to create an Ad-hoc network if it can not find the SSID for which it is

searching. This means that user’s laptops on your network may appear as Ad-Hoc devices that are broadcasting

your SSID. If this happens too frequently, you can restrict the rule to apply to non-ad-hoc devices.

l If More Than Four APs Have Discovered a Device, then Classify as Rogue

By default, AirWave tries to use Signal Strength to determine if a device is on your premises. Hearing device

count is another metric that can be used.

The important concept in this scenario is that legitimate neighboring devices are only heard by a few APs on the

edge of your network. Devices that are heard by a large number of your APs are likely to be in the heart of your

campus. This rule works best for scenarios in large campuses or that occupy an entire building. For additional

rules that may help you in your specific network scenario, contact Dell support at dell.com/support.

1 2 ... 185 186 187 188 189 190 191 192 193 194 195 ... 331 332

No comments

Dell PowerConnect W-AirWave 7.6 User Manual Page 190