Dell PowerConnect W-Airwave 7.1 Instrukcja Użytkownika Pobierz pdf (Strona 210)

210 | Using RAPIDS and Rogue Classification Dell PowerConnect W AirWave 7.1 | User Guide

Deleting or Editing a Rules

To delete a rule from the RAPIDS rules list, go to the RAPIDS > Rules page. Select the check box next to the

rule you want to delete, and click the Delete button. The rule is automatically deleted from the RAPIDS > Rules

page.

To edit any existing rule, click the pencil

icon next to that rule to launch the RAPIDS Classification Rule page

(see Figure 136). Edit or revise the fields (see Table 107) as necessary then select the Save button.

To change the sequence in which rules apply to any rogue device, drag and drop the rule to

a new position in the

rules sequence.

Recommended RAPIDS Rules

 If Any Device Has Your SSID, Then Classify as Rogue

The only devices broadcasting your corporate SSID should be devices that you are aware of and are managed

by AWMS. Rogu

e devices often broadcast your official SSID in an attempt to get access to your users, or to

trick your users into providing their authentication credentials. Devices with your SSID generally pose a severe

threat. This rule helps to discover, flag, and emphasize such a device for prompt response on your part.

 If Any Device Has Your SSID and is Not an Ad-Hoc Network Type, Then Classify as Rogue

This rule classifies a device as a rogue when the SSID for a given device is your SSID and is not an Ad-Hoc

dev

ice. Windows XP automatically tries to create an Ad-hoc network if it can not find the SSID for which it is

searching. This means that user’s laptops on your network may appear as Ad-Hoc devices that are

broadcasting your SSID. If this happens too frequently, you can restrict the rule to apply to non-ad-hoc

devices.

 If More Than Four APs Have Discovered a Device, Then Classify as Rogue

By default, AWMS tries to use Signal Strength to determine

if a device is on your premises. Hearing device

count is another metric that can be used.

The important concept in this scenario is

that legitimate neighboring devices are only heard by a few APs on

the edge of your network. Devices that are heard by a large number of your APs are likely to be in the heart of

your campus. This rule works best for scenarios in large campuses or that occupy an entire building.

Using RAPIDS Rules with Additional AWMS Functions

Rules that you configure on the RAPIDS > Rules page establish an important way of processing rogue devices on

your network, and flagging them for attention as required. Such devices appear on the following pages in AWMS,

with additional information:

 RAPIDS > List—Lists rogue devices as classified by rules.

 RAPIDS > Rules—Displays the rules that classify rogue devices.

 RAPIDS > Overview—Displays general rogue device count and statistical information.

 System > Triggers—Displays triggers that are currently configured, including any triggers that have been

defined for rogue events.

 Reports > Definitions—Allows you to run New Rogue Devices Report with custom settings.

 VisualRF—Displays physical location information for rogue devices.

Score Override

On RAPIDS > Score Override page you can change the OUI scores that are given to MAC addresses detected

during scans of bridge forwarding tables on routers or switches. Figure 137, Figure 138, and Table 109 illustrate

and describe RAPIDS Score Override. Perform th

ese steps to create a score override.

1 2 ... 205 206 207 208 209 210 211 212 213 214 215 ... 333 334

Komentarze do niniejszej Instrukcji

Brak uwag

Dell PowerConnect W-Airwave 7.1 Instrukcja Użytkownika Strona 210

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Oprogramowanie Dell PowerConnect W-Airwave 7.1