Table of Contents
Advertisement
Chapter 13: RF Intrusion Detection and Containment
•
•
•
Click Save to save the alarm configuration settings to the BSC database.
5.
Configuring Manual Containment
You can configure the BSC to automatically block (contain) rogue RF devices operating
within range of the BSAPs on your WLAN. If you manually contain a rogue AP or client,
the BSC configures the BSAPs nearest the rogue device to initiate containment using
802.11 de-authentication and/or disassociation messages.
Up to five BSAPs can participate in the containment if range permits. These BSAPs remain
online for wireless access during the containment period.
Configuring Autocontainment
You can configure the BSC to automatically block, i.e., contain rogue RF devices
operating within range of the BSAPs on your WLAN.
If you enable the BSC's autocontainment feature and a rogue AP or client is detected
within your protected airspace, the BSC configures the BSAP nearest the rogue device to
initiate containment using 802.11 de-authentication and/or disassociation messages.
Up to five BSAPs can participate in the containment if range permits. These BSAPs remain
online for wireless access during the containment period.
To configure the BSC's RF autocontainment feature:
Click the Wireless tab in the BSC administrator console, and then click the Auto
1.
Containment tab.
The Autocontainment Configuration page appears as shown in Figure 13-4.
13-6
Severe - This is the highest alert level and is usually associated with a WLAN
intrusion, e.g., a broadcast attack.
Warning - This alert level is usually associated with a security vulnerability, e.g.,
a client association change.
Informational - This alert level is usually associated with a change in network
operational status, e.g., an authorized AP is down.
Figure 13-3: Alarm Configuration Page
Advertisement
Table of Contents
