Using Rapids And Rogue Classification; Overview Tab - Dell PowerConnect W-Airwave User Manual

This chapter provides an overview to rogue device detection using RAPIDS, and contains the following sections:
"Overview Tab" on page 195

"List" on page 197

"RAPIDS Setup" on page 202

"RAPIDS Rules" on page 204

"Score Override" on page 210

"Audit Log" on page 212

"Additional Rogue Device Resources" on page 212


Overview Tab

Rogue device detection is a core component of wireless security. With RAPIDS rules engine and containment
options, you can create a detailed definition of what constitutes a rogue device, and quickly act to mitigate a
rogue AP for investigation, restrictive action, or both. Once rogue devices are discovered, RAPIDS alerts your
security team of the possible threat and provides essential information needed to eliminate the threat.
RAPIDS discovers unauthorized devices in your WLAN network in the following ways:
Over the Air

Using your existing enterprise APs (Aruba, Alcatel-Lucent, Cisco WLC, Symbol for example)

RF scanning using AirWave Management Client (AMC)—Optional

On the Wire

Using HTTP and SNMP Scanning

Polling routers and switches to identify, classify, and locate unknown APs

Furthermore, RAPIDS integrates with external intrusion detection systems (IDS), as follows:
Cisco WLSE (1100 and 1200 IOS)—AWMS fetches rogue information from the HTTP interface and gets

new AP information from SOAP API. This system provides wireless discovery information rather than rogue
detection information.
AirMagnet Enterprise—Retrieves a list of managed APs from AWMS.

AirDefense—Uses the AWMS XML API to keep its list of managed devices up to date.

WildPackets OmniPeek—Retrieves a list of managed APs from AWMS.

The Overview tab displays a page of RAPIDS summary information (see
to the AirWave Management Client, an optional utility that reports wireless discovery information to AWMS.
Table 97 defines the summary information that appears on the page.
Dell PowerConnect W AirWave 7.1 | User Guide
Chapter 7
Using RAPIDS and Rogue
Classification
Figure 128). This page also includes links

Using RAPIDS and Rogue Classification |

195