3Com WX1200 3CRWX120695A, WXR100 3CRWXR10095A, WX4400 3CRWX440095A manual Countermeasures

574CHAPTER 26: ROGUE DETECTION AND COUNTERMEASURES

Table 48 Rogue Detection Features (continued)

Rogue		Applies To
Detection		Third-Party
Feature	Description	APs	Clients
Countermeasures	Packets sent by 3Com MAPs to	Yes	Yes
	interfere with the operation of a
	rogue or interfering device.
	Countermeasures are configurable
	on a radio-profile basis.
Active scan	Active scan sends probe any requests	Yes	No
	(probes with a null SSID name) to
	look for rogue APs.
	Active scan is configurable on a
	radio-profile basis.
3Com MSP	Value in a MAP’s management	No	No
signature	frames that identifies the MAP to
	MSS. MAP signatures help prevent
	spoofing of the MAP MAC address.
Log messages	Messages and traps for rogue	Yes	Yes
and traps	activity. Messages are described in
	“IDS and DoS Alerts” on page 584.

Configuring Rogue The following sections describe how to configure lists to specify the

Detection Lists devices that are allowed on the network and the devices that MSS should attack with countermeasures.

(For information about how MSS uses the lists, see “Rogue Detection Lists” on page 569.)

Configuring a The permitted vendor list specifies the third-party AP or client vendors Permitted Vendor List that are allowed on the network. MSS does not list a device as a rogue or

interfering device if the device’s OUI is in the permitted vendor list.

By default, the permitted vendor list is empty and all vendors are allowed. If you configure a permitted vendor list, MSS allows only the devices whose OUIs are on the list. The permitted vendor list applies only to the WX switch on which the list is configured. WX switches do not share permitted vendor lists.