D-Link DWS-4026 [717/741] Mitigating a rogue client threat

DetectingandPreventingWirelessIntrusion

D-Link UnifiedWiredandWirelessAccessSystem

November2011 Page717

D‐LinkUWSUserManual

MitigatingaRogueClientThreat

Inthisscenario,thenetworkadministratorforaretailstoreisimpleme ntingRogueClientThreatMitigationto

provideadditionalsecurityinherstorelocatedinashoppingmall.SeveraltabletPCsareusedtotrack

inventorywithintheestablishment.ThenetworkadministratordecidestouseClie ntThreatMitigationtomake

suretha

tthesetabletsareassociatedonlywithcompany‐controlledAPs.

ThisscenariousesClientThreatMitigationratherthantheAPDe‐AuthenticationAttackforthefollowing

reasons:

•UsingAPMitigationwouldbedifficultbecausetheadministratorhasnocontroloverAPsinadjoining

stores,andkeepingupwithchangesinAPsloc

atedinotherstoresmightcreatetoomuchoverhead.

•Iftheadministratorweretoaccidentallyclassifyaneighboringstore'sAPasRogueandjamtheother

store'straffic,shecouldpotentiallybeliableforinterruptingthebusinessoftheadjacentstore.

•EmployeescanbepreventedfromusingthetabletPCstoaccesspubl

icnetworksfornonwork ‐related

functionsortocircumventcorporatefirewalls,whichcouldexposecompanydata.

ToaddthetheclientsthatareallowedtoaccessthenetworkintotheKnownClientDatabaseandconfigurethe

ClientThreatMitigationfeature:

1. VerifytheMACAuthenticationmodeiswhite‐listontheWLAN>Adminis

tration>AdvancedConfiguration

>Globalpage.

Thewhite‐listauthenticationmodemeansthatwirelessclientswithMACaddressesthatarespecifiedin

theKnownClientdatabase,andarenotexplicitlydeniedaccess,aregrantedaccess.IftheMACaddressis

notinthedatabasethentheaccesstothenetworkisden

ied.

Note:Radiosinnon‐sentrymodewillnottransmitClientThreatMitigationframes.Therefore,sentry

radiosmustbedeployedforthenetworkadministratortousethisfeature.