BelAir100SN User Guide
Wi-Fi AP Security
May 31, 2010
Confidential
Document Number BDTM11001-A01 Released
for changes in the gateway's MAC address updates the secure MAC white list
accordingly.
By default, the auto-secure gateway functionality mode is
disabled
.
Note: If you are automatically discovering the MAC addresses of your
network gateways, then you typically enable auto-secure gateway before
enabling the secure port mode. This ensures that wireless clients that
are already associated do not lose their connection to the Internet.
Protecting against
Denial of Service
Attacks
The BelAir100SN provides protection against the following types of Denial of
Service (DoS) attacks:
• deauthentication DoS, where deauthentication packets are maliciously sent
to the BelAir platform causing it to terminate wireless sessions
The BelAir100SN also automatically generates alarms when it detects the
following conditions:
• If the BelAir100SN detects more than 600 DHCP requests within 30
seconds, it raises a
DHCP_STARVATION
alarm.
• If the BelAir100SN detects a client with a MAC address that matches any of
the addresses in the secure MAC white list, it raises a
SECURE_MAC_SPOOF
alarm.
You can clear these alarms with the following command:
/interface/wifi-<n>-<m>/clear alarm {secure-mac-spoof |
dhcp-starvation |
deauth-dos}
Deauthentication DoS
/interface/wifi-<n>-<m>/set deauth dos defense {enabled|disabled}
When a deauthentication packet arrives and this feature is enabled, the BelAir
platform waits 5 to 10 seconds before it terminates the wireless session. If the
wireless client sends another data packet during that interval, then the previous
deauthentication packet is deemed false and ignored. If the BelAir platform
does not receive any data packets during the interval, then the session is
terminated.
Use the
show config access
command to display the number of potential attacks
it has detected since you enabled the feature.
