Planex CQW-AP108AG, Руководство по установке и настройке

Страница: 188 / 301

Managing Rogue Access Points
Installation and Configuration Guide, (CQW-AP108AG) 175
Managing Rogue Access Points
A rogue AP is an access point that connects to the wireless network without authorization. In some
cases, the AP may be performing a legitimate function and the appropriate management action is to
classify the AP as “known.” If it is not possible to identify a legitimate role for the AP, then the AP
is considered to be a true rogue. NM Portal provides information to help determine where rogue
APs are physically located and how recently they have accessed the network. With this
information, it may be possible to find and disable them.
Potential rogue AP candidates are identified during discovery. Every 15 minutes NM Portal scans
the network to discover and identify known 108 Mbps Wireless APs. The domain for the discovery
process is specified in the Discover Configuration panel (see “Configuring Network Discovery” on
page 184). Discovery can be restricted to specific subnetworks, ranges of IP addresses, or
individual APs. It is also possible to specify whether the discovery is at the IP (layer 3) or wireless/
MAC level (layer 2).
Wireless discovery is based on the beacon sent by APs within range of the receiving AP. Each AP
collects information about beacons it sees and passes that information to NM Portal. NM Portal
checks the MAC address of the detected AP to see whether it matches that of a known AP. If it does
not match, the detected AP becomes a rogue AP candidate.
IP level discovery requires that the detecting AP be able to determine the IP address of the
discovered AP through an IP / SNMP connectivity check and establish IP level communications
with it. NM Portal then performs a series of consistency checks and certification to determine
whether the AP is a recognized part of the network.
After an AP is successfully discovered and authenticated, the system checks to see whether it is
enrolled and places it into the Enrolled or APs to be Enrolled table. For more information on AP
enrollment, see “Enrolling APs” on page 167.A variety of conditions may cause NM Portal to label
an AP as a rogue candidate:
•
The AP is in a subnet not included in the discovery domain.
•
The AP is not an 108 Mbps Wireless AP.
•
A problem exists with the AP certificate, and the AP cannot be authenticated.
•
The AP is a legitimate device on a neighboring network, but has been detected through a
wireless scan.
•
An unauthorized device attempts to access the network
The objectives of rogue AP management are to determine which APs pose a security risk and to
take action to reduce the risk.
The Rogue AP panels within NM Portal provide an interface to monitor and classify rogue APs.
Use the IP Rogue AP panel to manage potential rogues detected through IP discovery, and use the
Wireless Rogue AP panel to manage potential rogues detected through wireless discovery.
Each panel opens to the Unclassified tab, which lists the candidate rogue APs. From the list, select
individual APs to classify as known in your network or a neighbor’s network. Once classified, the
APs are listed in the IP or Wireless Classified tab.
NOTE:
Use the Discovery Configuration panel to enable the rogue AP discovery
feature. For instructions, see “Configuring Network Discovery” on page 184.