Aruba Networks AirOS v2.3, User Manual

Page: 157 / 254

Intrusion Detection 147
Chapter 10
C
HAPTER
10
Intrusion Detection
This document outlines the steps needed to configure the various IDS capabilities present in
an Aruba network. Like most other security related configuration on the Aruba system, the
IDS configuration is completely done on the Master switch in the network.
The Aruba solution offers a variety of IDS/IPS features that can be configured and deployed
as required. The following are the important IDS/IPS features provided in the Aruba
solution:
Rogue/Interfering AP Detection
The most important IDS functionality offered in the Aruba solution is the ability to
detect a interfering/rogue AP and classify it as a interfering or a rogue AP. An interfering
AP is an Access Point that the Aruba Access points/Air Monitors in the air. A rogue AP is
an Access Point that is detected as interfering AND is connected to the network on the
wired side. As is obvious an Access Point that is connected to the network is the one that
presents a security threat while an AP that is not part of the network only contributes to
the interference in the air. The administrator can enable rogue AP containment. If this
feature is enabled, the APs that are detected as rogue
N
OTE
—
Not interfering) are contained by disallowing clients from associating to this AP.
Refer to the Configuring Rogue AP detection section for more details on how to configure
Rogue AP detection/classification/containment.