5-113
Cisco Wireless LAN Controller Configuration Guide
OL-17037-01
Chapter 5 Configuring Security Solutions
Configuring IDS
Step 3
Click
Apply
to commit your changes.
Step 4
To enable or disable an individual signature, click the precedence number of the desired signature. The
Standard Signature (or Custom Signature) > Detail page appears (see
).
Figure 5-59
Standard Signature > Detail Page
This page shows much of the same information as the Standard Signatures and Custom Signatures pages
but provides these additional details:
•
The tracking method used by the access points to perform signature analysis and report the results
to the controller. The possible values are:
–
Per Signature—Signature analysis and pattern matching are tracked and reported on a
per-signature and per-channel basis.
–
Per MAC—Signature analysis and pattern matching are tracked and reported separately for
individual client MAC addresses on a per-channel basis.
–
Per Signature and MAC—Signature analysis and pattern matching are tracked and reported on
a per-signature and per-channel basis as well as on a per-MAC-address and per-channel basis.
•
The pattern that is being used to detect a security attack
Step 5
In the Measurement Interval field, enter the number of seconds that must elapse before the signature
frequency threshold is reached within the configured interval. The range is 1 to 3600 seconds, and the
default value varies per signature.
Step 6
In the Signature Frequency field, enter the number of matching packets per interval that must be
identified at the individual access point level before an attack is detected. The range is 1 to 32,000
packets per interval, and the default value varies per signature.
Step 7
In the Signature MAC Frequency field, enter the number of matching packets per interval that must be
identified per client per access point before an attack is detected. The range is 1 to 32,000 packets per
interval, and the default value varies per signature.
Step 8
In the Quiet Time field, enter the length of time (in seconds) after which no attacks have been detected
at the individual access point level and the alarm can stop. The range is 60 to 32,000 seconds, and the
default value varies per signature.
