Configuring WIDS and WIPS
You can configure WIDS and WIPS to detect and defend against intrusion from unauthorized devices on WLAN networks and enable the AC to detect attacks and add devices initiating the attacks to the dynamic blacklist, ensuring security of authorized users.
Configuring the AP Attack Detection Function
Context
On small- and medium-scale WLANs, the attack detection function can be enabled to detect flooding attacks, weak initialization vector (IV), spoofing attacks, and brute force cracking of WPA/WPA2/WAPI preshared keys and WEP shared keys. This function enables an AP to add attackers to the dynamic blacklist and send alarms to alert administrators.
After the dynamic blacklist function is enabled, the AP can add the detected attackers to the dynamic blacklist. For details, see Configuring the Dynamic Blacklist Function.
Procedure
- Run system-view
The system view is displayed.
- Run interface wlan-radio wlan-radio-number
The radio interface view is displayed.
- Run attack detection enable { all | flood | weak-iv | spoof | wpa-psk | wpa2-psk | wapi-psk | wep-share-key }
Attack detection is enabled on the radio.
By default, attack detection is disabled on an AP radio.
- Configure attack detection parameters when enabling detection of flooding attacks and brute force cracking of WPA/WPA2/WAPI preshared keys and WEP shared keys.
Configuring the Dynamic Blacklist Function
Context
The device supports the attack detection function. When the device detects flooding attacks and brute force cracking of WPA/WPA2/WAPI preshared keys and WEP shared keys, the dynamic blacklist function can be configured. This function enables the AP to add attackers to the dynamic blacklist and reject any packets sent from the attackers until the dynamic blacklist entry ages.
Procedure
- Run system-view
The system view is displayed.
- Run wlan
The WLAN view is displayed.
- Run dynamic-blacklist enable
The dynamic blacklist function is enabled.
By default, the dynamic blacklist function is disabled on an AP.
- Run dynamic-blacklist aging-duration duration
The aging time for the dynamic blacklist is set.
By default, the aging time for the dynamic blacklist is 600 seconds.
Verifying the WIDS and WIPS Configuration
Context
After WIDS and WIPS are configured, you can check the WIDS and WIPS configuration and detected device information.
Procedure
- Run the display ap command to check the configuration of an AP.
- Run the display wlan ids attack-detected { all | flood | spoof | wapi-psk | weak-iv | wep-share-key | wpa-psk | wpa2-psk | mac-address mac-address } command to check information about devices initiating attacks.
- Run the display wlan ids attack-detected statistics command to check the number of attack times.
- Run the display wlan ids dynamic-blacklist { all | mac-address mac-address } command to view devices added to the dynamic blacklist.