Dell 6.2 Blacklisting b y Authentication Failure, Enabling A ttack Blacklisting

To clear the entireclient blacklist using the command-line interface, access the CLI in config mode and issue the
followingco mmand:
stm purge-blacklist-client
Blacklisting b y Authentication Failure
You can configurea maximum authentication failure threshold for each of the following authentication methods:
l802.1x
lMAC
lCaptive portal
lVPN
Whena client exceeds the configured threshold forone of the above methods, the client is automati callyblacklisted
by the controller,an event is logged,and an SNMP trap is sent. By default, the maximum authentication failure
thresholdis set to0 forthe above authentication methods, which means that there is no limit to the number of
times a client can attempt to authenticate.
With 802.1x authentication, you can also co nfigureblacklisting of clients who fail machine authenticati on.
NOTE:When cl ients are blacklisted becausethey exceed the authentication failure threshold, they are blacklisted indefinitely by
default.You can configure the duration of the blacklisting; see "Setting Blacklist Duration" on page 387 .
To set the authentication failure thresholdvia the WebUI:
1. Navigate to the Configuration > Security > A uthentication > Profiles page.
2. In the Profiles list, select the appropriate authentication profile, then select the profile instance.
3. Enter a value in the Max Authentication failures field.
4. Click Apply.
To set the authentication failure thresholdvia the command-line interface, access the CLI in config mode and issue
the followingco mmands:
aaa authentication {captive-portal|dot1x|mac|vpn} <profile>
max-authentication-failures <number>
Enabling A ttack Blacklisting
Thereare two typeof automati c client blacklistingt hat can be enabled:blacklisting due to spoofed
deauthentication, or blacklisting duet o other types of DoS att acks.
Automatic blacklisting for DoS attacks ot herthan spoofed deauthenticatio n is enabled by default.You can di sable
this blacklisting on a per-SSID basis in the virtual AP profile.
Mani n the middle (MITM) attacks begin with an intruder impersonating a valid enterprise AP. If an AP needs to
reboot, it sends deauthenticationpackets to co nnectedclients to enable them to disconnect and reassociate with
anotherA P. An intruder or attacker can spoof deauthentication packets, forcing clients to disco nnect fromt he
network andreassoci ate with the attacker’s AP. A valid enterprise client associates tothe i ntruder’sAP, while the
intruderthen associat es to the enterpriseA P. Communication between the networkand the client flows through the
intruder(the man in the middle), thus allowing the intruderthe ability to add,delete, or modify data. When this
type of attack is identified by the Dell system, the client can be blacklisted, blockingthe MITM attack. Enable this
blacklistingabilit y in the IDS DoS profile (this is disabledby default).
To enable spoofed deauthdetect ion and blacklistingvi a the WebUI:
1. Navigate to the Configuration > Wir eless > AP Configuration page.
2. Select either AP Group or AP Specific tab. Click Edit for the AP group orA P name.
DellPowerConnect W- Series ArubaOS 6.2 | UserGuide WirelessIntrusionPr evention | 386