Deleting Or Editing A Rule; Recommended Rapids Rules; Using Rapids Rules With Additional Airwave Functions; Viewing Rogues On The Rapids > List Page - Dell PowerConnect W-Airwave User Manual

Deleting or Editing a Rule

To delete a rule from the RAPIDS rules list, go to the RAPIDS > Rules page. Select the check box next to the
rule you want to delete, and select Delete. The rule is automatically deleted from RAPIDS > Rules.
To edit any existing rule, select its pencil icon to launch the RAPIDS Classification Rule page (see
Edit or revise the fields as necessary, then select Save.
To change the sequence in which rules apply to any rogue device, drag and drop the rule to a new position in the
rules sequence.

Recommended RAPIDS Rules

If Any Device Has Your SSID, Then Classify as Rogue

The only devices broadcasting your corporate SSID should be devices that you are aware of and are managed
by AirWave. Rogue devices often broadcast your official SSID in an attempt to get access to your users, or to
trick your users into providing their authentication credentials. Devices with your SSID generally pose a severe
threat. This rule helps to discover, flag, and emphasize such a device for prompt response on your part.
If Any Device Has Your SSID and is Not an Ad-Hoc Network Type, Then Classify as Rogue

This rule classifies a device as a rogue when the SSID for a given device is your SSID and is not an Ad-Hoc
device. Windows XP automatically tries to create an Ad-hoc network if it can not find the SSID for which it is
searching. This means that user's laptops on your network may appear as Ad-Hoc devices that are
broadcasting your SSID. If this happens too frequently, you can restrict the rule to apply to non-ad-hoc
devices.
If More Than Four APs Have Discovered a Device, Then Classify as Rogue

By default, AirWave tries to use Signal Strength to determine if a device is on your premises. Hearing device
count is another metric that can be used.
The important concept in this scenario is that legitimate neighboring devices are only heard by a few APs on
the edge of your network. Devices that are heard by a large number of your APs are likely to be in the heart of
your campus. This rule works best for scenarios in large campuses or that occupy an entire building. For
additional rules that may help you in your specific network scenario, contact Dell support at support.dell.com.

Using RAPIDS Rules with Additional AirWave Functions

Rules that you configure on the RAPIDS > Rules page establish an important way of processing rogue devices on
your network, and flagging them for attention as required. Such devices appear on the following pages in
AirWave, with additional information:
RAPIDS > List—Lists rogue devices as classified by rules.

RAPIDS > Rules—Displays the rules that classify rogue devices.

RAPIDS > Overview—Displays general rogue device count and statistical information.

System > Triggers—Displays triggers that are currently configured, including any triggers that have been

defined for rogue events.
Reports > Definitions—Allows you to run New Rogue Devices Report with custom settings.

VisualRF—Displays physical location information for rogue devices.

Viewing Rogues on the RAPIDS > List Page
To view a rogue AP, select the RAPIDS > List tab and select a rogue device type from the Minimum
Classification drop-down menu (see
column head. Most columns can be filtered using the funnel icon (
additional pages for RAPIDS configuration or device processing.
176 | Using RAPIDS and Rogue Classification
Figure 123). You can sort the table columns (up/down) by selecting the
). The active links on this page launch
Dell PowerConnect W-AirWave 7.4 | User Guide
Figure 122).