5-29
Cisco Wireless LAN Controller Configuration Guide
OL-9141-03
Chapter 5 Configuring Security Solutions
Configuring IDS
For the
port-number
parameter, you can enter a value between 1 and 65535. The default value is 443.
This step is optional because Cisco recommends that you use the default value of 443. The sensor uses
this value to communicate by default.
Step 3
To specify how often the controller should query the IDS server for IDS events, enter this command:
config wps cids-sensor interval
index interval
For the
interval
parameter, you can enter a value between 10 and 3600 seconds. The default value is 60
seconds.
Step 4
To enter a 40-hexadecimal-character security key used to verify the validity of the sensor, enter this
command:
config wps cids-sensor fingerprint
index
sha1
fingerprint
You can get the value of the fingerprint by entering
show tls fingerprint
on the sensor’s console.
Note
Make sure to include the colons that appear between every two bytes within the key (for
example, AA:BB:CC:DD).
Step 5
To enable or disable this controller’s registration with an IDS sensor, enter this command:
config wps cids-sensor
{
enable
|
disable
}
index
Step 6
To save your settings, enter this command:
save config
Step 7
To view the IDS sensor configuration, enter one of these commands:
•
show wps cids-sensor summary
•
show wps cids-sensor detail
index
The second command provides more information than the first.
Step 8
To obtain debug information regarding IDS sensor configuration, enter this command:
debug wps cids enable
Note
If you ever want to delete or change the configuration of a sensor, you must first disable it by entering
config wps cids-sensor disable
index
. To then delete the sensor, enter
config wps
cids-sensor delete
index
.
Viewing Shunned Clients
When an IDS sensor detects a suspicious client, it alerts the controller to shun this client. The shun entry
is distributed to all controllers within the same mobility group. If the client to be shunned is currently
joined to a controller in this mobility group, the anchor controller adds this client to the dynamic
exclusion list, and the foreign controller removes the client. The next time the client tries to connect to
a controller, the anchor controller rejects the handoff and informs the foreign controller that the client is
being excluded. See
Chapter 11
for more information on mobility groups.
You can view the list of clients that the IDS sensors have identified to be shunned through either the GUI
or the CLI.
