Dell PowerConnect W-Airwave 7.2 Instrukcja Użytkownika Pobierz pdf (Strona 165)

Dell PowerConnect W AirWave 7.2 | User Guide Using RAPIDS and Rogue Classification | 165

Chapter 7

Using RAPIDS and Rogue Classification

This chapter provides an overview to rogue device and IDS event detection, alerting, and analysis using RAPIDS,

and contains the following sections:

 “Introduction to RAPIDS” on page165

 “Viewing Rogues on the RAPIDS > List Page” on page 174

 “Setting Up RAPIDS” on page 167

 “Defining RAPIDS Rules” on page 169

 “Score Override” on page 177

 “Audit Log” on page 178

 “Additional Security Resources” on page 179

Introduction to RAPIDS

Rogue device detection is a core component of wireless security. With RAPIDS rules engine and containment

options, you can create a detailed definition of what constitutes a rogue device, and quickly act on a rogue AP for

investigation, restrictive action, or both. Once rogue devices are discovered, RAPIDS alerts your security team of

the possible threat and provides essential information needed to locate and manage the threat.

RAPIDS discovers unauthorized devices in your WLAN network in the following ways:

 Over the Air

 Using your existing enterprise APs

 Optional AirWave Management Client (AMC)

 On the Wire

 Polling routers and switches to identify, classify, and locate unknown APs

 Using HTTP and SNMP scanning

 Using the controller’s wired discovery information

Furthermore, RAPIDS integrates with external intrusion detection systems (IDS), as follows:

 Dell WIP—ADell’s Wireless Intrusion Protection (WIP) module integrates wireless intrusion protection into

the mobile edge infrastructure. The WIP module provides wired and wireless AP detection, classification and

containment; detects DoS and impersonation attacks; and prevents client and network intrusions.

 Cisco WLSE (1100 and 1200 IOS)—AWMS fetches rogue information from the HTTP interface and gets

new AP information from SOAP API. This system provides wireless discovery information rather than rogue

detection information.

 AirMagnet Enterprise—Retrieves a list of managed APs from AWMS.

 AirDefense—Uses the AWMS XML API to keep its list of managed devices up to date.

 WildPackets OmniPeek—Retrieves a list of managed APs from AWMS.

NOTE: To set up a scan, refer to “Discovering and Adding Devices” on page107.

1 2 ... 160 161 162 163 164 165 166 167 168 169 170 ... 281 282

Brak uwag

Dell PowerConnect W-Airwave 7.2 Instrukcja Użytkownika Strona 165