210
| Using RAPIDS and Rogue Classification
Dell PowerConnect W AirWave 7.1
| User Guide
Deleting or Editing a Rules
To delete a rule from the RAPIDS rules list, go to the
RAPIDS > Rules
page. Select the check box next to the
rule you want to delete, and click the
Delete
button. The rule is automatically deleted from the
RAPIDS > Rules
page.
To edit any existing rule, click the pencil icon next to that rule to launch the
RAPIDS Classification Rule
page
(see
Figure 136
). Edit or revise the fields (see
Table 107
) as necessary then select the Save button.
To change the sequence in which rules apply to any rogue device, drag and drop the rule to a new position in the
rules sequence.
Recommended RAPIDS Rules
If Any Device Has Your SSID, Then Classify as Rogue
The only devices broadcasting your corporate SSID should be devices that you are aware of and are managed
by AWMS. Rogue devices often broadcast your official SSID in an attempt to get access to your users, or to
trick your users into providing their authentication credentials. Devices with your SSID generally pose a severe
threat. This rule helps to discover, flag, and emphasize such a device for prompt response on your part.
If Any Device Has Your SSID and is Not an Ad-Hoc Network Type, Then Classify as Rogue
This rule classifies a device as a rogue when the SSID for a given device is your SSID and is not an Ad-Hoc
device. Windows XP automatically tries to create an Ad-hoc network if it can not find the SSID for which it is
searching. This means that user’s laptops on your network may appear as Ad-Hoc devices that are
broadcasting your SSID. If this happens too frequently, you can restrict the rule to apply to non-ad-hoc
devices.
If More Than Four APs Have Discovered a Device, Then Classify as Rogue
By default, AWMS tries to use Signal Strength to determine if a device is on your premises. Hearing device
count is another metric that can be used.
The important concept in this scenario is that legitimate neighboring devices are only heard by a few APs on
the edge of your network. Devices that are heard by a large number of your APs are likely to be in the heart of
your campus. This rule works best for scenarios in large campuses or that occupy an entire building.
Using RAPIDS Rules with Additional AWMS Functions
Rules that you configure on the
RAPIDS > Rules
page establish an important way of processing rogue devices on
your network, and flagging them for attention as required. Such devices appear on the following pages in AWMS,
with additional information:
RAPIDS > List
—Lists rogue devices as classified by rules.
RAPIDS > Rules
—Displays the rules that classify rogue devices.
RAPIDS > Overview
—Displays general rogue device count and statistical information.
System > Triggers
—Displays triggers that are currently configured, including any triggers that have been
defined for rogue events.
Reports > Definitions
—Allows you to run New Rogue Devices Report with custom settings.
VisualRF
—Displays physical location information for rogue devices.
Score Override
On
RAPIDS > Score Override
page you can change the OUI scores that are given to MAC addresses detected
during scans of bridge forwarding tables on routers or switches.
Figure 137
,
Figure 138
, and
Table 109
illustrate
and describe RAPIDS Score Override. Perform these steps to create a score override.
Summary of Contents for PowerConnect W Airwave 7.1
Page 1: ...Dell PowerConnect W AirWave Version 7 1 User Guide ...
Page 10: ...10 Dell PowerConnect W AirWave 7 1 User Guide ...
Page 30: ...30 Installing AWMS Dell PowerConnect W AirWave 7 1 User Guide ...
Page 194: ...194 Creating and Using Templates Dell PowerConnect W AirWave 7 1 User Guide ...
Page 260: ...260 Performing Daily Administration in AWMS Dell PowerConnect W AirWave 7 1 User Guide ...
Page 294: ...294 Creating Running and Emailing Reports Dell PowerConnect W AirWave 7 1 User Guide ...
Page 302: ...302 Using the AWMS Helpdesk Dell PowerConnect W AirWave 7 1 User Guide ...
Page 304: ...304 Package Management for AWMS Dell PowerConnect W AirWave 7 1 User Guide ...
Page 308: ...308 Third Party Security Integration for AWMS Dell PowerConnect W AirWave 7 1 User Guide ...
Page 314: ...314 Access Point Notes Dell PowerConnect W AirWave 7 1 User Guide ...
Page 316: ...316 Initiating a Support Connection Dell PowerConnect W AirWave 7 1 User Guide ...
Page 318: ...318 Cisco Clean Access Integration Perfigo Dell PowerConnect W AirWave 7 1 User Guide ...
Page 330: ...330 Third Party Copyright Information Dell PowerConnect W AirWave 7 1 User Guide ...
Page 334: ...334 Index Dell PowerConnect W AirWave 7 1 User Guide ...
