Threat Detection and Prevention Features

ExtremeWireless Appliances and the wireless APs they manage, provide Wireless Intrusion Detection Services (WIDS) and Wireless Intrusion Prevention Services (WIPS) to detect, report, and protect against potential wireless network attacks and threats such as rogue APs, AP spoofing, honeypot APs, password cracking, man-in-the-middle, denial of service (DoS), and others. The latest generation of controllers and the APs (AP39xx, AP38xx, AP37xx and W78xC series) implement the Radar feature and its major functions:

• Scanning channels for threat identification
• Analyzing and detecting a wide range of wireless security threats
• Taking active countermeasures (if configured to do so) against identified threats
• Validating WLAN (Wireless Local Area Network) Service configuration to protect against security weakness
• Generating threat event reports and forwarding them to Extreme Management Center™

All APs can simultaneously perform channel bridging and scan (monitor) the channels they are bridging. These APs can also be configured (on their controller) to perform countermeasures against detected threats. Radar threat detection scanning of channels on the APs is configured on In-Service Scan Profiles.

You can configure all the APs to operate as full time Radar agents by adding them to a Guardian Scan Profile. When operating in this mode, they are referred to as "Guardians." Once assigned to the Guardian Scan Profile, the APs stop forwarding traffic on both radios and devote all of their resources to threat detection and countermeasures. Any AP added to a Guardian Scan Profile is done so in its entirety. Therefore, it is not possible to dedicate one radio to scanning, and the other to forwarding. The AP cannot scan or transmit on channels that are prohibited by the regulations of the countries in which it is deployed.

Radar feature configuration is described in Working with ExtremeWireless Radar.