A proper classification and categorization of
access points and clients can help suppress unnecessary unauthorized access point
alarms, and allow an administrator to focus on alarms on devices actually behaving in a
suspicious manner. An intruder with a device erroneously authorized could potentially
perform activities that harm your organization.
Authorized access points and clients
are generally known to you and conform with your organization‘s security policies.
Unauthorized devices are those detected as interoperating within the network, but
have not been approved. These devices should be filtered to avoid jeopardizing the
data managed by the access point and its connected clients. Use the Device
Categorization screen to apply neighboring and sanctioned (approved) filters on peer
access points operating in this access point‘s radio coverage area. Detected client
MAC addresses can also be filtered based on their classification in this access
point‘s coverage area.
To categorize access points and clients as authorized
or unauthorized:
Procedure
Select ConfigurationSecurityDevice
Configuration to display existing device categorization policies.
The Device Categorization
screen lists the device authorizations defined thus far.
Device Categorization screen
Select Add to create a new
Device Categorization policy, Edit to modify the
attributes of a selected policy or Delete to remove
obsolete policies from the list of those available.
Device Categorization Screen - Marked
Devices
If you are creating a new Device Categorization filter, give it a
Name (up to 32 characters).
Select OK to save the name and enable the remaining
device categorization parameters.
Select + Add Row to populate the Marked
Devices field with parameters for classifying an access point or
client and defining the target device‘s MAC address and SSID.
Select the red (-) Delete Row icon as needed to remove
an individual table entry.
Refer to Thresholds field to set the thresholds used as filtering
criteria.
Index
Use the spinner control to
designate a index value to this entry. Use a value in the
range 1 - 1000.
Classification
Use the drop-down menu to
designate the target device as either
Sanctioned or
Neighboring.
Device Type
Use the drop-down menu to
designate the target device as either an access point or
client.
MAC Address
Enter the factory coded MAC
address of the target device. This address is hard coded by
the device manufacturer and cannot be modified. This MAC
address is defined as authorized or unauthorized as part of
the device categorization process.
SSID
Enter the SSID of the target
device requiring categorization. The SSID cannot exceed 32
characters.
Select OK to save the updates to the Marked
Devices list.
Select Reset to revert to the last saved
configuration.
