RingMaster Management Guide - Juniper Networks

Table 1– 1. SNMP Notifications for RF Detection (continued)
Notification Type Description
RFDetectSpoofedSSIDAP
RFDetectDoS
RFDetectDoSPort
RFDetectClientViaRogueWir
edAP
Mobility Domain Requirement
RF Detection requires a Mobility Domain to be available. If no Mobility Domain is operational — not all
members are up — no new RF Detection data is processed. Existing RF Detection information ages
normally. Processing of RF Detection data is resumed when all members of a Mobility Domain are up.
If a seed MX in a Mobility Domain cannot resume full operation, you can restore the Mobility Domain to
full operation, and therefore resume RF Detection data processing, by removing inoperative MXs from
the member list on the seed.
Rogue Detection Lists
MSS has detected beacon frames for a valid SSID, but sent by a
rogue AP.
MSS has detected a DoS attack other than an associate request
flood, reassociate request flood, or disassociate request flood.
MSS has detected an associate request flood, reassociate request
flood, or disassociate request flood.
MSS has detected, on the wired part of the network, the MAC
address of a wireless client associated with a third-party AP.
Rogue detection lists specify third-party devices and SSIDs that MSS allows on a network, and
devices MSS classifies as rogues.
You can configure the following rogue detection lists:
❑ Permitted SSID list — A list of SSIDs allowed in the Mobility Domain. MSS generates a
message if an SSID not on the list is detected.
❑ Permitted vendor list — A list of the wireless networking equipment vendors whose
equipment is allowed on the network. RingMaster identifies the vendor using the
Organizationally Unique Identifier (OUI) The OUI is the first three bytes of the MAC address of
the equipment. MSS generates a message if an AP or wireless client with an OUI that is not on
the list is detected.
❑ Rogue list — A list of AP MAC addresses to attack whenever they are present on the network.
❑ Client black list — A list of MAC addresses of wireless clients who are not allowed on the
network. MSS prevents clients on the list from accessing the network through an MX. If the
client is placed on the black list dynamically by MSS due to an association, reassociation or
disassociation flood, MSS generates a log message.
❑ Ignore list — A list of third-party devices that you want to exempt from rogue detection. MSS
does not count devices on the ignore list as rogues or interfering devices, and does not issue
countermeasures against them.
An empty permitted SSID list or permitted vendor list implicitly allows all SSIDs and vendors. When
you add an entry to the SSID or vendor list, SSIDs or vendors not in the list are disallowed. An empty
client black list allows all clients, and an empty ignore list considers all third-party wireless devices to
be potential rogues. All lists except the black list require manual configuration. You can configure
entries in the black list, and MSS can place a client in the black list, due to an association,
reassociation, or disassociation flood from a client.
The rogue classification algorithm examines each of these lists when determining if a device is a
rogue. Figure 1–1 shows how the rogue detection algorithm uses lists.
140 Detecting Rogue Devices Copyright © 2011, Juniper Networks, Inc.