D-Link DWS-4026 Product Manual - Page 525

Software User Manual 12/10/09 D-Link Unified Access System Although operational mode radios can detect most threats, the sentry radios detect the threats faster, especially when a potential rogue is operating on a different channel from any of the managed AP radios. The number of deployed sentry radios should be sufficient to provide coverage by one sentry radio in every geographical location within the network. A denser sentry deployment may be desirable in order to improve rogue or interferer signal triangulation. Figure 365: WIDS AP Configuration Table 340 shows the fields on the WIDS Security AP Configuration page. Table 340: WIDS AP Configuration Field Administrator configured rogue AP Managed SSID from an unknown AP Managed SSID from a fake managed AP Description If the source MAC address is in the valid-AP database on the switch or on the RADIUS server and the AP type is marked as Rogue, then the AP state is Rogue. This test checks whether an unknown AP is using the managed network SSID. A hacker may set up an AP with managed SSID to fool users into associating with the AP and revealing password and other secure information. Administrators with large networks who are using multiple clusters should either use different network names in each cluster or disable this test. Otherwise, if an AP in the first cluster detects APs in the second cluster transmitting the same SSID as APs in the first cluster then these APs are reported as rogues. A hacker may set up an AP with the same MAC address as one of the managed APs and configure it to send one of the managed SSIDs. This test checks for a vendor field in the beacons which is always transmitted by managed APs. If the vendor field is not present, then the AP is identified as a fake AP. Document 34CSFP6XXUWS-SWUM100-D7 Configuring Advanced Settings Page 525