Choose Security> Wireless Protection Policies > AP Authentication/MFP to open the AP Authentication Policy page.

Enable infrastructure MFP globally for the controller by choosing Management Frame Protection from the Protection Type drop-down list.

Click Apply to commit your changes.

Configure client MFP for a particular WLAN after infrastructure MFP has been enabled globally for the controller as follows:

1. Choose WLANs.

2. Click the profile name of the desired WLAN. The WLANs > Edit page appears.

3. Choose Advanced. The WLANs > Edit (Advanced) page is displayed.

4. From the MFP Client Protection drop-down list, choose Disabled, Optional, or Required . The default value is Optional. If you choose Required, clients are allowed to associate only if MFP is negotiated (that is, if WPA2 is configured on the controller and the client supports CCXv5 MFP and is also configured for WPA2).

   Note	For Cisco OEAP 600, MFP is not supported. It should either be Disabled or Optional.

5. Click Apply to commit your changes.

Save the configuration.

Make sure that rogue detection is enabled on the corresponding access points. Rogue detection is enabled by default for all access points joined to the controller (except for OfficeExtend access points). However, you can enable or disable rogue detection for individual access points by selecting or unselecting the Rogue Detection check box on the All APs > Details for (Advanced) page.

Choose Security > Wireless Protection Policies > Rogue Policies > General.

Choose the Rogue Detection Security Level from the following options:

• Low—Basic rogue detection for small-scale deployments.
• High—Basic rogue detection with auto containment for medium-scale deployments.
• Critical—Basic rogue detection with auto containment and RLDP for highly sensitive deployments.
• Custom

  Note	For auto RLDP, set the security level to Custom mode. Do not enable scheduling for RLDP even in the Custom mode.

Choose one of the following options from the Rogue Location Discovery Protocol drop-down list:

• Disable—Disables RLDP on all the access points. This is the default value.
• All APs—Enables RLDP on all the access points.
• Monitor Mode APs—Enables RLDP only on the access points in the monitor mode.

In the Expiration Timeout for Rogue AP and Rogue Client Entries text box, enter the number of seconds after which the rogue access point and client entries expire and are removed from the list. The valid range is 240 to 3600 seconds, and the default value is 1200 seconds.

To use the AAA server or local database to validate if rogue clients are valid clients, select the Validate Rogue Clients Against AAA check box. By default, the check box is unselected.

To use the Cisco Mobility Services Engine (MSE) that has the rogue client details to validate the clients, select the Validate Rogue Clients Against MSE check box.

If necessary, select the Detect and Report Ad-Hoc Networks check box to enable ad hoc rogue detection and reporting. By default, the check box is selected.

In the Rogue Detection Report Interval text box, enter the time interval, in seconds, at which APs send the rogue detection report to the Cisco WLC. The valid range is 10 to 300 seconds, and the default value is 10 seconds.

In the Rogue Detection Minimum RSSI text box, enter the minimum Received Signal Strength Indicator (RSSI) value for APs to detect the rogue and for a rogue entry to be created in the controller. The valid range is –128 dBm to –0 dBm, and the default value is 0 dBm.

In the Rogue Detection Transient Interval text box, enter the time interval at which a rogue should be scanned for by the AP after the first time the rogue is scanned. After the rogue is scanned for consistently, updates are sent periodically to the controller. Thus, the APs filter the transient rogues, which are active for a short period and are then silent. The valid range is between 120 to 1800 seconds, and the default value is 0.

In the Rogue Client Threshold text box, enter the threshold value. A value of 0 disables the rogue client threshold parameter.

Enable or disable the Rogue Containment Automatic Rate Selection check box.

If you want the controller to automatically contain certain rogue devices, enable the following parameters. By default, these parameters are in disabled state.

• Auto Containment Level—Set the auto containment level. By default, the auto containment level is set to 1.

  If you choose Auto, the controller dynamically chooses the number of APs required for effective containment.

• Auto Containment only for Monitor mode APs—Configure the monitor mode access points for auto-containment.
• Auto Containment on FlexConnect Standalone—Configure the FlexConnect Standalone mode access points for auto containment.

  Note

  The auto-containment is continued if it was configured when the AP was in connected FlexConnect mode. After the standalone AP reassociates with the controller, auto containment is stopped. The configuration on the controller the AP is associated with determines the future course of action. You can also configure auto containment on the ad hoc SSIDs and managed SSIDs on FlexConnect APs.

• Rogue on Wire—Configure the auto containment of rogues that are detected on the wired network.
• Using Our SSID—Configure the auto containment of rogues that are advertising your network’s SSID. If you leave this parameter unselected, the controller only generates an alarm when such a rogue is detected.
• Valid Client on Rogue AP—Configure the auto containment of a rogue access point to which trusted clients are associated. If you leave this parameter unselected, the controller only generates an alarm when such a rogue is detected.
• AdHoc Rogue AP—Configure the auto containment of ad hoc networks detected by the controller. If you leave this parameter unselected, the controller only generates an alarm when such a network is detected.

Click Apply.

Click Save Configuration.

Ensure that rogue detection is enabled on the desired access points. Rogue detection is enabled by default for all the access points that are associated with the controller. You can enable or disable rogue detection for individual access points by entering this command:

Configure the rogue detection security level by entering this command:

• critical —Basic rogue detection with auto containment and RLDP for highly sensitive deployments.
• high —Basic rogue detection with auto containment for medium-scale deployments.
• low —Basic rogue detection for small-scale deployments.

Enable, disable, or initiate RLDP by entering these commands:

• config rogue ap rldp enable alarm-only —Enables RLDP on all the access points.

• config rogue ap rldp enable alarm-only monitor_ap_only —Enables RLDP only on the access points in the monitor mode.

• config rogue ap rldp initiate rogue_mac_address —Initiates RLDP on a specific rogue access point.

• config rogue ap rldp disable —Disables RLDP on all the access points.

• config rogue ap rldp retries —Specifies the number of times RLDP to be tried per rogue access point. The range is from 1 to 5 and default is 1.

Specify the number of seconds after which the rogue access point and client entries expire and are removed from the list by entering this command:

Enable or disable ad hoc rogue detection and reporting by entering this command:

Enable or disable the AAA server or local database to validate if rogue clients are valid clients by entering this command:

Enable or disable the use of MSE that has the rogue client details to validate the clients by entering this command:

Specify the time interval, in seconds, at which APs should send the rogue detection report to the controller by entering this command:

Specify the minimum RSSI value that rogues should have for APs to detect them and for the rogue entries to be created in the controller by entering this command:

Specify the time interval at which rogues have to be consistently scanned for by APs after the first time the rogues are scanned for by entering this command:

If you want the controller to automatically contain certain rogue devices, enter these commands.

• config rogue ap rldp enable auto-contain —Automatically contains the rogues that are detected on the wired network.

• config rogue ap ssid auto-contain —Automatically contains the rogues that are advertising your network’s SSID.

  Note	If you want the controller to only generate an alarm when such a rogue is detected, enter the config rogue ap ssid alarm command.

• config rogue ap valid-client auto-contain —Automatically contains a rogue access point to which trusted clients are associated.

  Note	If you want the controller to only generate an alarm when such a rogue is detected, enter the config rogue ap valid-client alarm command.

• config rogue adhoc auto-contain —Automatically contains ad hoc networks detected by the controller.

  Note	If you want the controller to only generate an alarm when such a network is detected, enter the config rogue adhoc alert command.

• config rogue auto-contain level level monitor_mode_ap_only —Sets the auto containment level for the monitor mode access points. The default value is 1. If you enter the level as 0, then the controller dynamically chooses the number of APs required for effective containment.

• config rogue containment flexconnect {enable | disable}—Sets the auto containment options for standalone FlexConnect access points.

  Note

  The auto containment is continued if the auto containment was configured when the AP was in the connected FlexConnect mode. After the standalone AP is reassociated with the controller, auto containment is stopped and the future course of action is determined by the configuration on the controller the AP is associated with. You can also configure auto containment on ad hoc SSIDs and managed SSIDs on FlexConnect APs.

• config rogue containment auto-rate {enable | disable} —Sets the auto rate for containment of rogues.

Configure ad hoc rogue classification by entering these commands:

• config rogue adhoc classify friendly state {internal | external} mac-addr
• config rogue adhoc classify malicious state {alert | contain} mac-addr
• config rogue adhoc classify unclassified state {alert | contain} mac-addr

Configure RLDP scheduling by entering this command:

Save your changes by entering this command:

Choose Security > Wireless Protection Policies > Rogue Policies > Rogue Rules to open the Rogue Rules page.

Create a new rule as follows:

1. Click Add Rule. An Add Rule section appears at the top of the page.

2. In the Rule Name text box, enter a name for the new rule. Ensure that the name does not contain any spaces.

3. From the Rule Type drop-down list, choose from the following options to classify rogue access points matching this rule as friendly or malicious:

   • Friendly

   • Malicious

   • Custom

4. Configure the notification when the rule is matched from the Notify drop-down list to All, Global, Local, or None.

   Rule description:

   • All—Notifies the Cisco WLC and a trap receiver such as Cisco Prime Infrastructure.

   • Global—Notifies only a trap receiver such as Cisco Prime Infrastructure.

   • Local—Notifies only Cisco WLC.

   • None—No notifications are sent.

   Note

   Rogue Rule Notification options All, Global, Local, and None can control only the following rogue traps mentioned: Rogue AP Detected (Rogue AP: XX:XX:XX:XX:XX:XX detected on Base Radio MAC: XX:XX:XX:XX:XX:XX Interface no: 0(1) Channel: 6 RSSI: 45 SNR: 10 Classification: unclassified, State: alert, RuleClassified : unclassified, Severity Score: 100, RuleName: rule1, Classified AP MAC: XX:XX:XX:XX:XX:XX, Classified RSSI: 45) Rogue Adhoc Detected (Adhoc Rogue : XX:XX:XX:XX:XX:XX detected on Base Radio MAC : XX:XX:XX:XX:XX:XX Interface no: 0(1) on Channel 6 with RSSI: 45 and SNR: 10 Classification: unclassified, State: alert, RuleClassified: unclassified, Severity Score: 100, RuleName: rule1,Classified APMAC: XX:XX:XX:XX:XX:XX, Classified RSSI: 45) Rogue AP contained (Rogue AP: Rogue with MAC Address: XX:XX:XX:XX:XX:XX has been contained due to rule with containment Level : 1) Rogue AP clear contained (Rogue AP: Rogue with MAC Address: XX:XX:XX:XX:XX:XX is no longer contained due to rule

5. Configure the state of the rogue AP when the rule is matched from the State drop-down list.

6. If you choose the Rule Type as Custom, enter the Severity Score and the Classification Name.

7. Click Add to add this rule to the list of existing rules, or click Cancel to discard this new rule.

Edit a rule as follows:

1. Click the name of the rule that you want to edit. The Rogue Rule > Edit page appears.

2. From the Type drop-down list, choose from the following options to classify rogue access points matching this rule:

   • Friendly

   • Malicious

   • Custom

3. Configure the notification when the rule is matched from the Notify drop-down list to All, Global, Local, or None.

4. Configure the state of the rogue AP when the rule is matched from the State drop-down list.

5. From the Match Operation text box, choose one of the following:

   Match All—If this rule is enabled, a detected rogue access point must meet all of the conditions specified by the rule in order for the rule to be matched and the rogue to adopt the classification type of the rule.

   Match Any—If this rule is enabled, a detected rogue access point must meet any of the conditions specified by the rule in order for the rule to be matched and the rogue to adopt the classification type of the rule. This is the default value.

6. To enable this rule, select the Enable Rule check box. The default value is unselected.

7. If you choose the Rule Type as Custom, enter the Severity Score and the Classification Name.

8. From the Add Condition drop-down list, choose one or more of the following conditions that the rogue access point must meet and click Add Condition.

   • SSID—Requires that the rogue access point have a specific user-configured SSID. If you choose this option, enter the SSID in the User Configured SSID text box, and click Add SSID.

     Note	To delete an SSID, highlight the SSID and click Remove.

   • RSSI—Requires that the rogue access point have a minimum received signal strength indication (RSSI) value. For example, if the rogue access point has an RSSI that is greater than the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum RSSI value in the Minimum RSSI text box. The valid range is 0 to –128 dBm (inclusive).

   • Duration—Requires that the rogue access point be detected for a minimum period of time. If you choose this option, enter a value for the minimum detection period in the Time Duration text box. The valid range is 0 to 3600 seconds (inclusive), and the default value is 0 seconds.

   • Client Count—Requires that a minimum number of clients be associated to the rogue access point. For example, if the number of clients associated to the rogue access point is greater than or equal to the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum number of clients to be associated to the rogue access point in the Minimum Number of Rogue Clients text box. The valid range is 1 to 10 (inclusive), and the default value is 0.

   • No Encryption—Requires that the rogue access point’s advertised WLAN does not have encryption enabled. If a rogue access point has encryption disabled, it is likely that more clients will try to associate to it. No further configuration is required for this option.

     Note	Cisco Prime Infrastructure refers to this option as “Open Authentication.”

   • Managed SSID—Requires that the rogue access point’s managed SSID (the SSID configured for the WLAN) be known to the controller. No further configuration is required for this option.

     Note

     The SSID and Managed SSID conditions cannot be used with the Match All operation because these two SSID lists are mutually exclusive. If you define a rule with Match All and have these two conditions configured, the rogue access points are never classified as friendly or malicious because one of the conditions can never be met. You can add up to six conditions per rule. When you add a condition, it appears under the Conditions section.

     Note	To delete a condition from this rule, hover your cursor over the blue drop-down arrow for that condition and click Remove.

   • SSID Wildcard—Requires that the rogue access point have a substring of the specific user-configured SSID. The controller searches the substring in the same occurrence pattern and returns a match if the substring is found in the whole string of an SSID.

9. Click Apply.

Click Save Configuration.

If you want to change the order in which rogue classification rules are applied, follow these steps:

Classify any rogue access points as friendly and add them to the friendly MAC address list as follows:

• Choose Security > Wireless Protection Policies > Rogue Policies > Friendly Rogue to open the Friendly Rogue > Create page.
• In the MAC Address text box, enter the MAC address of the friendly rogue access point.
• Click Apply.
• Click Save Configuration. This access point is added to the controller’s list of friendly access points and should now appear on the Friendly Rogue APs page.

Choose Monitor > Rogues.

Choose the following options to view the different types of rogue access points detected by the controller:

Get more details about a rogue access point by clicking the MAC address of the access point. The Rogue AP Detail page appears.

If you want to change the classification of this device, choose a different classification from the Class Type drop-down list.

From the Update Status drop-down list, choose one of the following options to specify how the controller should respond to this rogue access point:

Click Apply.

Click Save Configuration.

View any rogue clients that are connected to the controller by choosing Rogue Clients. The Rogue Clients page appears. This page shows the following information: the MAC address of the rogue client, the MAC address of the access point to which the rogue client is associated, the SSID of the rogue client, the number of radios that detected the rogue client, the date and time when the rogue client was last reported, and the current status of the rogue client.

Obtain more details about a rogue client by clicking the MAC address of the client. The Rogue Client Detail page appears.

From the Update Status drop-down list, choose one of the following options to specify how the controller should respond to this rogue client:

Click Apply.

If desired, you can test the controller’s connection to this client by clicking Ping.

Click Save Configuration.

See any ad-hoc rogues detected by the controller by choosing Adhoc Rogues. The Adhoc Rogues page appears.

Obtain more details about an ad-hoc rogue by clicking the MAC address of the rogue. The Adhoc Rogue Detail page appears.

From the Update Status drop-down list, choose one of the following options to specify how the controller should respond to this ad-hoc rogue:

From the Maximum number of APs to contain the rogue drop-down list, choose one of the following options to specify the maximum number of access points used to contain this ad-hoc rogue: 1, 2, 3, or 4.

Click Apply.

Click Save Configuration.

View any access points that have been configured to be ignored by choosing Rogue AP Ignore-List. The Rogue AP Ignore-List page appears.

Create a rule by entering this command:

Create a rule by entering these commands:

• Configure a rule for friendly rogues by entering this command:

  config rogue rule add ap priority priority classify friendly notify {all | global | local | none} state {alert | internal | external | delete} rule-name

• Configure a rule for malicious rogues by entering this command:

  config rogue rule add ap priority priority classify malicious notify {all | global | local | none} state {alert | contain | delete} rule-name

• Configure a rule for custom rogues by entering this command:

  config rogue rule add ap priority priority classify custom severity-score classification-name notify {all | global | local | none} state {alert | contain | delete} rule-name

Configure the state on the rogue AP upon rule match by entering this command:

Configure the notification upon rule match by entering this command:

Disable all rules or a specific rule by entering this command:

Add conditions to a rule that the rogue access point must meet by entering this command:

• ssid —Requires that the rogue access point have a specific SSID. You should add SSIDs that are not managed by the controller. If you choose this option, enter the SSID for the condition_value parameter . The SSID is added to the user-configured SSID list.

  Note	If you ever want to delete all of the SSIDs or a specific SSID from the user-configured SSID list, enter the config rogue rule condition ap delete ssid {all | ssid} rule_name command.

  Note	The sub-string should be specified in full or part of SSID (without any asterisks). This sub-string is matched in the same sequence to its occurrence in the rogue AP SSID. Once the condition is met, the rogue AP is classified (depending on OR or AND match condition).

• rssi —Requires that the rogue access point have a minimum RSSI value. For example, if the rogue access point has an RSSI that is greater than the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum RSSI value for the condition_value parameter .

  In Release 8.0 and later releases, for friendly rogue rules, you are required to set a maximum RSSI value. The RSSI value of the rogue AP must be less than the RSSI value set, for the rogue AP to be classified as a friendly rogue. For malicious and custom rogue rules, there is no change in functionality.

  For example, for a friendly rogue rule, the RSSI value is set at –80 dBm. All the rogue APs that are detected and have RSSI value that is less than –80 dBm are classified as friendly rogues. For malicious and custom rogue rules, the RSSI value is set at –80 dBm. All the rogue APs that are detected and have RSSI value that is more than –80 dBm are classified as malicious or custom rogue APs.

• duration —Requires that the rogue access point be detected for a minimum period of time. If you choose this option, enter a value for the minimum detection period for the condition_value parameter . The valid range is 0 to 3600 seconds (inclusive), and the default value is 0 seconds.

• client-count —Requires that a minimum number of clients be associated to the rogue access point. For example, if the number of clients associated to the rogue access point is greater than or equal to the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum number of clients to be associated to the rogue access point for the condition_value parameter . The valid range is 1 to 10 (inclusive), and the default value is 0.

• managed-ssid —Requires that the rogue access point’s SSID be known to the controller. A condition_value parameter is not required for this option.

  Note	You can add up to six conditions per rule. If you ever want to delete all of the conditions or a specific condition from a rule, enter the config rogue rule condition ap delete all condition_type condition_value rule_name command.

• wildcard-ssid —Requires that the rogue access point have a wildcard of the specific user-configured SSID. The controller searches the wildcard in the same occurrence pattern and returns a match if the substring is found in the whole string of an SSID.

Specify whether a detected rogue access point must meet all or any of the conditions specified by the rule in order for the rule to be matched and the rogue access point to adopt the classification type of the rule by entering this command:

Enable all rules or a specific rule by entering this command:

Add a new friendly access point entry to the friendly MAC address list or delete an existing friendly access point entry from the list by entering this command:

Save your changes by entering this command:

View the rogue classification rules that are configured on the controller by entering this command:

View detailed information for a specific rogue classification rule by entering this command:

If desired, create your own custom signature file.

Make sure that you have a Trivial File Transfer Protocol (TFTP) server available. Follow these guidelines when setting up a TFTP server:

If you are downloading a custom signature file (*.sig), copy it to the default directory on your TFTP server.

Choose Commands to open the Download File to Controller page.

Perform one of the following:

From the Transfer Mode drop-down list, choose TFTP, FTP, or SFTP.

In the IP Address text box, enter the IP address of the TFTP, FTP, or SFTP server.

If you are downloading the signature file using a TFTP server, enter the maximum number of times that the controller should attempt to download the signature file in the Maximum retries text box.

If you are downloading the signature file using a TFTP server, enter the amount of time in seconds before the controller times out while attempting to download the signature file in the Timeout text box.

In the File Path text box, enter the path of the signature file to be downloaded or uploaded. The default value is “/.”

In the File Name text box, enter the name of the signature file to be downloaded or uploaded.

If you are using an FTP or SFTP server, follow these steps:

Choose Download to download the signature file to the controller or Upload to upload the signature file from the controller.

Choose Security > Wireless Protection Policies > Standard Signatures or Custom Signatures to open the Standard Signatures page or the Custom Signatures page.

Perform one of the following:

Click Apply to commit your changes.

Click the precedence number of the desired signature to enable or disable an individual signature. The Standard Signature (or Custom Signature) > Detail page appears.

In the Measurement Interval text box, enter the number of seconds that must elapse before the signature frequency threshold is reached within the configured interval. The range is 1 to 3600 seconds, and the default value varies per signature.

In the Signature Frequency text box, enter the number of matching packets per interval that must be identified at the individual access point level before an attack is detected. The range is 1 to 32,000 packets per interval, and the default value varies per signature.

In the Signature MAC Frequency text box, enter the number of matching packets per interval that must be identified per client per access point before an attack is detected. The range is 1 to 32,000 packets per interval, and the default value varies per signature.

In the Quiet Time text box, enter the length of time (in seconds) after which no attacks have been detected at the individual access point level and the alarm can stop. The range is 60 to 32,000 seconds, and the default value varies per signature.

Select the State check box to enable this signature to detect security attacks or unselect it to disable this signature. The default value is enabled (or selected).

Click Apply to commit your changes. The Standard Signatures or Custom Signatures page reflects the signature’s updated state.

Click Save Configuration to save your changes.

Choose Security > Wireless Protection Policies > Signature Events Summary to open the Signature Events Summary page.

Click the Signature Type for the signature to see more information on the attacks detected by a particular signature. The Signature Events Detail page appears.

• The MAC addresses of the clients identified as attackers

• The method used by the access point to track the attacks

• The number of matching packets per second that were identified before an attack was detected.

• The number of access points on the channel on which the attack was detected

• The day and time when the access point detected the attack

Click the Detail link for that attack to see more information for a particular attack. The Signature Events Track Detail page appears.

• The MAC address of the access point that detected the attack

• The name of the access point that detected the attack

• The type of radio (802.11a or 802.11b/g) used by the access point to detect the attack

• The radio channel on which the attack was detected

• The day and time when the access point reported the attack

If desired, create your own custom signature file.

Make sure that you have a TFTP server available.

Copy the custom signature file (*.sig) to the default directory on your TFTP server.

Specify the download or upload mode by entering the transfer {download | upload} mode tftp command.

Specify the type of file to be downloaded or uploaded by entering the transfer {download | upload} datatype signature command.

Specify the IP address of the TFTP server by entering the transfer {download | upload} serverip tftp-server-ip-address command.

Specify the download or upload path by entering the transfer {download | upload } path absolute-tftp-server-path-to-file command.

Specify the file to be downloaded or uploaded by entering the transfer {download | upload } filename filename.sig command.

Enter the transfer {download | upload} start command and answer y to the prompt to confirm the current settings and start the download or upload.

Specify the number of seconds that must elapse before the signature frequency threshold is reached within the configured interval by entering this command:

Specify the number of matching packets per interval that must be identified at the individual access point level before an attack is detected by entering this command:

Specify the number of matching packets per interval that must be identified per client per access point before an attack is detected by entering this command:

Specify the length of time (in seconds) after which no attacks have been detected at the individual access point level and the alarm can stop by entering by entering this command:

Perform one of the following:

• To enable or disable an individual IDS signature, enter this command:

  config wps signature {standard | custom} state signature_id {enable | disable}

• To enable or disable IDS signature processing, which enables or disables the processing of all IDS signatures, enter this command:

  config wps signature {enable | disable}

  Note	If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.

Save your changes by entering this command:

If desired, you can reset a specific signature or all signatures to default values. To do so, enter this command:

Choose Security > Advanced > CIDS > Sensors to open the CIDS Sensors List page.

Click New to add a new IDS sensor to the list. The CIDS Sensor Add page is displayed.

From the Index drop-down list, choose a number (between 1 and 5) to determine the sequence in which the controller consults the IDS sensors. For example, if you choose 1, the controller consults this IDS sensor first.

In the Server Address text box, enter the IP address of your IDS server.

In the Port text box, enter the number of the HTTPS port through which the controller has to communicate with the IDS sensor.

In the Username text box, enter the name that the controller uses to authenticate to the IDS sensor.

In the Password and Confirm Password text boxes, enter the password that the controller uses to authenticate to the IDS sensor.

In the Query Interval text box, enter the time (in seconds) for how often the controller should query the IDS server for IDS events.

Check the State check box to register the controller with this IDS sensor or uncheck this check box to disable registration. The default value is disabled.

Enter a 40-hexadecimal-character security key in the Fingerprint text box. This key is used to verify the validity of the sensor and is used to prevent security attacks.

Click Apply. Your new IDS sensor appears in the list of sensors on the CIDS Sensors List page.

Click Save Configuration.

Choose Security > Advanced > CIDS > Shunned Clients to open the CIDS Shun List page.

Click Re-sync to purge and reset the list as desired.

Add an IDS sensor by entering this command:

(Optional) Specify the number of the HTTPS port through which the controller is to communicate with the IDS sensor by entering this command:

Specify how often the controller should query the IDS server for IDS events by entering this command:

Enter a 40-hexadecimal-character security key used to verify the validity of the sensor by entering this command:

Enable or disable this controller’s registration with an IDS sensor by entering this command:

Enable or disable protection from DoS attacks by entering this command:

Save your settings by entering this command:

See the IDS sensor configuration by entering one of these commands:

• show wps cids-sensor summary

• show wps cids-sensor detail index

The second command provides more information than the first.

See the auto-immune configuration setting by entering this command:

Auto-Immune
  Auto-Immune.................................... Disabled

Client Exclusion Policy
  Excessive 802.11-association failures.......... Enabled
  Excessive 802.11-authentication failures....... Enabled
  Excessive 802.1x-authentication................ Enabled
  IP-theft....................................... Enabled
  Excessive Web authentication failure........... Enabled
Signature Policy
  Signature Processing........................... Enabled


Obtain debug information regarding IDS sensor configuration by entering this command:

View the list of clients to be shunned by entering this command:

Force the controller to synchronize with other controllers in the mobility group for the shun list by entering this command:

Choose Wireless > Access Points > All APs > ap-name.

Set the AP Mode parameter. To configure an access point for wIPS, you must choose one of the following modes from the AP Mode drop-down list:

• Local
• FlexConnect
• Monitor

Choose wIPS from the AP Sub Mode drop-down list.

Save the configuration.

Configure an access point for the monitor mode by entering this command:

Enter Y when you see the message that the access point will be rebooted if you want to continue.

Save your changes by entering this command:

Disable the access point radio by entering this command:

Configure the wIPS submode on the access point by entering this command:

Enable wIPS-optimized channel scanning for the access point by entering this command:

• All—All channels are supported by the access point’s radio
• Country—Only the channels supported by the access point’s country of operation
• DCA—Only the channel set used by the dynamic channel assignment (DCA) algorithm, which, by default, includes all of the nonoverlapping channels allowed in the access point’s country of operation

Default 802.11b AP monitoring
  802.11b Monitor Mode........................... enable
  802.11b Monitor Channels....................... Country channels
  802.11b AP Coverage Interval................... 180 seconds
  802.11b AP Load Interval....................... 60 seconds
  802.11b AP Noise Interval...................... 180 seconds
  802.11b AP Signal Strength Interval............ 60 seconds


Reenable the access point radio by entering this command:

Save your changes by entering this command: