Rogue Detection Requirements - 3Com WX4400 Reference Manual

470 C 18: D
HAPTER ETECTING AND
Rogue Detection
Requirements
C R D
OMBATTING OGUE
Rogue detection in 3WXM has the following requirements.
The Enable Rogue Detection option must be selected on the
Monitoring Settings section of the 3WXM Services Setup dialog. (See
"Changing Monitoring Settings" on page 510.)
To use countermeasures, they must be enabled. You can enable them
on an individual radio profile basis. (See "Viewing and Configuring
Radio Profiles" on page 272.)
SNMP notifications must be enabled on the WX switches. Table 34
lists the notification types related to RF detection. The notification
types for Intrusion Detection System (IDS) and Denial of Service (DoS)
protection are also listed. (To enable notifications on a switch, see
"Configuring SNMP" on page 196.)
Table 34 SNMP Notifications for RF Detection
Notification Type
Rogue detection notifications
RogueDetect
RFDetectRougeDisappear
RFDetectInterferingRogueAP
RFDetectInterferingRogueDisappear Indicates that MSS is no longer detecting a
RFDetectAdHocUser
RFDetectUnAuthorizedSSID
RFDetectUnAuthorizedOUI
RFDetectUnAuthorizedAP
IDS/DoS notifications
For more information about IDS/DoS, see the "IDS and DoS Alerts" section in the
"Rogue Detection and Countermeasures" chapter of the
Controller Configuration
CounterMeasureStart
EVICES
Description
Indicates that MSS has detected a rogue AP.
Indicates that MSS is no longer detecting a
previously detected rogue AP.
Indicates that MSS has detected an interfering
device.
previously detected interfering device.
Indicates that MSS has detected an ad-hoc
user.
Indicates that MSS has detected an SSID that
is not on the permitted SSID list.
Indicates that MSS has detected a wireless
device that is not on the list of permitted
vendors.
Indicates that MSS has detected the MAC
address of an AP that is on the attack list.
Guide.
Indicates that MSS has begun
countermeasures against a rogue AP.
Wireless LAN Switch and